US Patent 11328059 Cloud-based tamper detection

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; a user application; telemetry probes to collect telemetry about use of the user space application; a detection proxy to collect telemetry data from the telemetry probes and forward the telemetry data to a detection cloud service; and logic to receive from the detection cloud service a detection message that the user application has exhibited behavior consistent with tampering, and to take remedial action responsive to the detection message.