Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor

Abstract

Cache side channel attacks extract secret information by monitoring the cache behavior of a victim. Normally, this attack targets an L3 cache, which is shared between a spy and a victim. Hence, a spy can obtain secret information without alerting the victim. To resist this attack, many detection techniques have been proposed. However, these approaches have limitations as they do not operate in real time. This article proposes a real-time detection method against cache side channel attacks. The proposed technique performs the detection of cache side channel attacks immediately after observing a variation of the CPU counters. For this, Intel PCM (Performance Counter Monitor) and machine learning algorithms are used to measure the value of the CPU counters. Throughout the experiment, several PCM counters recorded changes during the attack. From these observations, a detecting program was implemented by using these counters. The experimental results show that the proposed detection technique displays good performance for real-time detection in various environments.

Multibyte Microarchitectural Data Sampling and its Application to Session Key Extraction Attacks

“…This characteristic of these attacks regarding cache usage can be exploited to implement an intrusion detection system for MDS attacks. There are already anomalybased detection techniques for cache side-channel attacks [20], [58]- [62]. Certain techniques are also proposed to detect a broad range of attacks including transient execution attacks by leveraging unsupervised deep learning [63] and ensemble learning [64].…”

Hybrid-shield

“…A wide range of classification techniques can be developed by applying off-the-shelf Machine Learning (ML) algorithms. However, existing works in particular on SCAs detection have primarily focused on one or limited ML techniques for attacks detection and classification [8,9,25,42]. Comprehensive analysis of diverse classifiers for SCAs detection is important as each could yield different performance (in terms of accuracy, false positive rate, computational complexity, etc.)…”

“…1 Lack of Robustness: Our comprehensive analysis shows that the previous works on SCAs detection jointly correlate the HPCs traces of victim and attack applications [8,42] where the detectors require HPCs data from both the attack and victim application. However, recent studies [2,11,15,17] show that attackers can craft [42] Yes Yes 100 -5000 No No mitigation module Real-Time Detection [9] No Yes 1. 5 2.4 No No mitigation module Nights-watch [25] No No No Mentioned No No mitigation module Cacheshield [3] No No [11][12][13][14][15][16][17][18][19][20][21][22][23][24] No mitigation module CPU Elasticity [23] No detection module No 32.66% No FLUSH+PREFETCH [24] No detection module No Not Mentioned No Random Fill [21] No detection module Yes No Mentioned No Catalyst [19] No attacks to bypass detectors.…”

RT-Sniper: A Low-Overhead Defense Mechanism Pinpointing Cache Side-Channel Attacks

“…Since the common cache side-channel attacks execute memory-related instructions frequently to manipulate the target cache states, the attacks may provoke uncommon hardware performance counts such as skyrocketing cache misses. The signature-based detection methods [6,[29][30][31][32][33][34] rely on the models with HPCs collected from several attacks such as Flush+Reload [1], Prime+Probe [5], and Flush+Flush [6]. The anomaly-based detection methods [35][36][37][38][39] developed the detection model based on the normal behavior of the potential victim applications, such as cryptography applications.…”