ANOMALY DETECTION IN REAL-TIME MULTI-THREADED PROCESSES ON EMBEDDED SYSTEMS AND DEVICES USING HARDWARE PERFORMANCE COUNTERS AND/OR STACK TRACES

An aspect of behavior of an embedded system may be determined by (a) determining a baseline behavior of the embedded system from a sequence of patterns in real-time digital measurements extracted from the embedded system; (b) extracting, while the embedded system is operating, real-time digital measurements from the embedded system; (c) extracting features from the real-time digital measurements extracted from the embedded system while the embedded system was operating; and (d) determining the aspect of the behavior of the embedded system by analyzing the extracted features with respect to features of the baseline behavior determined.