ADVANCED PERSISTENT THREAT DETECTION

Techniques are described herein for advanced persistent threat detection. An example method can include a device receiving a message identifying an instruction loaded onto an instruction cache of a secure processer. The device can transmit a control instruction to configure a kernel image to collect a metric over a first time interval, the metric being generated based at least in part on the secure processor executing the instruction during the first time interval. The device can receive the first metric from the kernel image, the metric being indicative of a transition of the secure processor from a non-secure state to a secure state. The device can determine whether the secure processor is undergoing a computing attack based on the metric. The device can transmit the determination of whether the secure processor is undergoing a computing attack to a sender of the message.