Using graphics processors to protect against virus attacks

After a series of scandals associated with the Specter and Meltdown, OEMs decided to deal with vulnerabilities at the hardware level. Accelerated Memory Scanning will be one of the solutions Intel is working on. It is assumed that the detection of attacks will be done not at the expense of the power of the central processor, but due to the integrated GPU. This will also damage the performance of the system, since the CPU will be "free" from part of the work. In theory, if malicious code gets into the RAM, it will take less time to find it.

Scanning memory for signs of malicious code is controlled by the Intel driver and works in the ring of user programs (ring 3). However, the capabilities of the solution can be extended to the kernel level (ring 0). Scanning intensity can be changed depending on the employment of the GPU. For example, if a video game is running, scanning may be delayed or entrusted solely to the free cores of the GPU.

This decision a couple of years ago already began to develop in Kaspersky Lab and with its help the company achieved the acceleration of the work of the antivirus more than 300 times. But now Intel will offer this technology at the hardware level.

Another novelty from Intel is called Advanced Platform Telemetry. This is a combination of machine learning and telemetry to identify more complex threats. The behavior and operation of the processor will be traced not at the level of the operating system and all unusual behavior will be analyzed by the internal performance counters. Data on the number of errors will be sent to cloud solutions that will evaluate the state of the system. These tools will already be implemented in Cisco equipment. Data of the DC infrastructure will be collected using software and hardware sensors, allowing to record deviations in the operation of the system.