Intel Threat Detection Technology

Intel Threat Detection Technology (TDT) is a CPU-level technology created by Intel in 2018 to enable host endpoint protections to use a CPU's low-level access to detect threats to a system. TDT consists of multiple components including Accelerated Memory Scanning, which uses the CPU's integrated GPU to scan memory, and Advanced Platform Telemetry, which uses processor-level activity monitoring to detect unusual activity.^{[1][2][3][4][5]} It is supported on sixth-generation or newer Intel Core CPUs and additional capabilities were added to the 11th generation Core processors.^[6][7][8][9]

Intel TDT is integrated into several third-party anti-malware solutions including Microsoft Defender,^[10] Check Point Harmony Endpoint,^[11] CrowdStrike Falcon,^[6] and others.^[12]

Accelerated Memory Scanning (also referred to as "Advanced Memory Scanning"^[1][13]) uses the CPU's integrated GPU to scan memory for malicious code, instead of using the CPU directly.^[14] This improves system responsiveness during anti-malware scanning.^[2] and lowers power consumption.^[7] Features include pattern matching, using random forest decision trees, string extraction, entropy calculation, and Euclidean clustering.^[15][16]

Advanced Platform Telemetry collects CPU-level telemetry to detect uncommon activity patterns which might be indicative of malware. The telemetry data is collected from the CPU performance monitoring unit (PMU)^[10] and doesn't require a large signature database to detect malware. Instead, it uses machine-learning based correlations to identify indicators of attack^[17][18]

For example, Microsoft Defender is able to use TDT's Advanced Platform Telemetry features to detect processor usage patterns indicative of ransomware and cryptojacking^[19] with TDT so it can detect them.^[20][7][1]

• Intel vPro

This article needs additional or more specific categories. Please help out by adding categories to it so that it can be listed with similar articles. (December 2024)