Kernel DPC/ISR Latency Monitoring to Detect Stealth Memory Scraping: Fundamental Mechanics and Deep Mathematical Modeling

[Jake Carter]

I’ve been benchmarking DPC latency with RTSS and LatencyMon during high-stress competitive matches, and I keep hitting a wall trying to connect kernel interrupt behavior to detecting stealth memory scraping. Here’s my core question: when you’re using RDTSC-based timing attacks to catch exfiltration, how do you isolate the actual memory-read footprint from background DPC/ISR jitter that naturally inflates your cycle counts? I’ve read that a single network driver ISR can spike latency by 50ms+, which completely swallows the microsecond-level signatures you’d expect from in-memory credential dumping.

Specifically, at what threshold does a DPC execution time become statistically indistinguishable from a deliberate memory-scraping operation, and how do you model the variance? I’m trying to build a mathematical proof around the delta between expected ISR overhead and anomalous access patterns—something that accounts for the hardware’s natural timing noise without drowning the signal. Has anyone actually calibrated this against real-world drivers, or is the noise floor just too unpredictable outside a controlled lab environment? I’d love to see how you’d set up the baseline calibration.

[Author]

Posts