UadMLPlugin

UadMLPlugin.dll — Machine Learning-based User Anomaly Detection plugin. Integrates with AWS SageMaker for cloud inference and LightGBM for local inference.

File Info

Property	Value
File	UadMLPlugin.dll
Size	~8.2 MB (8,597,768 bytes)
Architecture	x64 (AMD64)
Image Base	0x180000000
Entry Point	0x56c340
Export	NvPluginGetInfo

Core Functionality

1. ML Inference — Two Modes

Local Inference (LightGBM)

• Uses lib_lightgbm.dll for on-rig prediction
• Class: LocalPredictor
• API: LGBM_BoosterPredictForMatSingleRowFast, LGBM_BoosterLoadModelFromString

Cloud Inference (AWS SageMaker)

• Class: SageMakerPredictor
• Invokes SageMaker endpoints with configurable region
• Supports retry logic on failure

2. Feature Extraction

• FeatureExtractor class extracts features from system metrics
• PerfmonCollector collects Windows Performance Monitor data
• Supports feature versioning (FeatureVersion)

3. Telemetry

• Integrates with NvTelemetry framework
• Collects CPU, memory, network metrics
• Sends events and anonymous events

Configuration

{
  "ModelConfig": {
    "endpoint": "AWS SageMaker endpoint URL",
    "region": "AWS region",
    "uri": "Model URI",
    "features": [...]
  },
  "IsLocalModelEnabled": true,
  "IsBackendInferenceEnabled": true,
  "IsFeatureLoggerEnabled": false
}

Config paths:

• Seat userdata: GcisConfigData
• System: C:/Program Files/NVIDIA Corporation/NvContainer/plugins/LocalSystem/messagebus.conf

The plugin can be fully disabled: UadMLPlugin is DISABLED

Internal Classes

Class	Description
UadMLPlugin	Main plugin class
SageMakerPredictor	AWS SageMaker predictor wrapper
LocalPredictor	LightGBM local predictor
MLPredictor	Base ML predictor class
FeatureExtractor	Feature extraction from metrics
FeatureLogger	Feature logging utility
PerfmonCollector	Windows Performance Monitor collector
UadInferenceMessage	Inference message wrapper
GcisPluginTaskQueue	Plugin task queue

Protocol Buffers

Proto File	Purpose
UadInferenceDef.proto	ML inference messages
ErrorDef.proto	Error definitions
MonitorSettings.proto	Monitor configuration
SessionRequestData.proto	Session data
GCISCommunicationMessagesDef.proto	Inter-plugin communication

Error Codes

Hex Code	Meaning
0x80030019	Unauthorized activity detected
0x80210002	ML anomaly score exceeded threshold
0x80210003	SageMaker/LightGBM inference error
0x80210004	Feature extraction from metrics failed

Error Classes

Class	Namespace	Description
Error	NVIDIA.Bifrost.Common	Bifrost common error
CancelledError	MessageBusClient	Operation cancelled
TimeoutError	MessageBusClient	Operation timeout
NotOnBusError	MessageBusClient	Not connected to message bus
ExtractionError	Internal	Feature extraction error
InferenceError	Internal	ML inference error

Common Error Messages

Configuration Errors

UadMLPlugin Config backend MessageBus address error
UadMLPlugin Config rule error
No 'endpoint' in Model configuration file
No 'region' in Model configuration file
No 'features' in Model configuration
Invalid 'features' array in Features configuration
Undefined model 'uri' in Model configuration file

Model/Inference Errors

SageMakerPredictor construction error: No AWS region provided
Unable to invoke SageMaker endpoint: [{}] {}
Unable to open model file: {}
Unable to load model file: {}
Empty data set passed for inference
Failure during local prediction: {}
Wrong number of columns for inference

Performance Monitor Errors

Unable to add feature. PerfmonCollector is already running.
Perfmon feature '{}' already added
PerfmonCollector is not initialized
Failed to subscribe to Perfmon counters

Dependencies

AWS SDK

• aws-cpp-sdk-core.dll
• aws-cpp-sdk-s3.dll
• aws-cpp-sdk-sagemaker-runtime.dll

ML/Data

• lib_lightgbm.dll — LightGBM gradient boosting
• libprotobuf.dll — Protocol Buffers v2.6.1

System Monitoring

• pdh.dll — Performance Data Helper
• wevtapi.dll — Windows Event Log API

Crypto

• CRYPT32, WINTRUST, bcrypt

Build Info

Property	Value
Source Path	C:\dvs\p4\build\sw\gcomp\dev\src\GCIS\
PDB Path	...\UadMLPlugin\UadMLPlugin.pdb
Poco	v1.10.1
Protobuf	v2.6.1
JSON	nlohmann/json v3.11.2
Format	fmt v8