Real-Time Detection on Cache Side Channel Attacks using Performance Counter Monitor

Cho, JongHyeon; Kim, TaeHyun; Shin, Youngjoo

doi:10.1109/ictc46691.2019.8939797

Cited by 7 publications

(10 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The main side effects of cache SCA are related to the use of caches and small loops. These effects increase several stats such as cache misses [21,23], cache hits [21], cache accesses [21], number of executed instructions [21], number of CPU clock cycles [21], speculative branches taken [23], retired branches [23]. The side effects observed values will be different for each architecture.…”

Section: Memory Attacksmentioning

confidence: 99%

“…The detection method used by the mechanisms might not rely on a single value, but rather on side effect waveforms throughout the attack. Complex techniques involving neural networks are now being used to detect side effects, such as in [21], [23], and [79]. For example, cache hits or cache accesses do not provide enough information to identify a malicious process, and instead, the designer must use a combination of cache side effects to come to a decision.…”

Section: Side Effect Criteriamentioning

confidence: 99%

“…The proposed solution demonstrated high accuracy and fast detection time. Another machine learning approach presented in [23] uses the Instruction Per Cycle (IPC), L3 cache miss, L2 cache miss, L1 cache miss, and the speculative and retired branch counters to train the system. In this solution (HPC-Cho), the Intel PCM from the user-space was used to access the counters.…”

Section: Cache Side Channelmentioning

confidence: 99%

See 2 more Smart Citations

A Comprehensive Survey of Attacks without Physical Access Targeting Hardware Vulnerabilities in IoT/IIoT Devices, and Their Detection Mechanisms

PolychronouNikolaos-Foivos

ThevenonPierre-Henri

PuysMaxime

et al. 2021

ACM Trans. Des. Autom. Electron. Syst.

View full text Add to dashboard Cite

With the advances in the field of the Internet of Things (IoT) and Industrial IoT (IIoT), these devices are increasingly used in daily life or industry. To reduce costs related to the time required to develop these devices, security features are usually not considered. This situation creates a major security concern. Many solutions have been proposed to protect IoT/IIoT against various attacks, most of which are based on attacks involving physical access. However, a new class of attacks has emerged targeting hardware vulnerabilities in the micro-architecture that do not require physical access. We present attacks based on micro-architectural hardware vulnerabilities and the side effects they produce in the system. In addition, we present security mechanisms that can be implemented to address some of these attacks. Most of the security mechanisms target a small set of attack vectors or a single specific attack vector. As many attack vectors exist, solutions must be found to protect against a wide variety of threats. This survey aims to inform designers about the side effects related to attacks and detection mechanisms that have been described in the literature. For this purpose, we present two tables listing and classifying the side effects and detection mechanisms based on the given criteria.

show abstract

Section: Memory Attacksmentioning

confidence: 99%

Section: Side Effect Criteriamentioning

confidence: 99%

Section: Cache Side Channelmentioning

confidence: 99%

See 1 more Smart Citation

A Comprehensive Survey of Attacks without Physical Access Targeting Hardware Vulnerabilities in IoT/IIoT Devices, and Their Detection Mechanisms

PolychronouNikolaos-Foivos

ThevenonPierre-Henri

PuysMaxime

et al. 2021

ACM Trans. Des. Autom. Electron. Syst.

View full text Add to dashboard Cite

show abstract

“…Their monitor uses the HPCs to gather the necessary information to train the machine learning classifier. Chiappetta et al [2] and Cho et al [3] use the HPCs and machine learning to detect Cache Side-Channel attacks (CacheCSA). Chiappetta et al implement a detection mechanism that could be run in user space, read the HPCs and feed the data in a classifier to decide for the existence of CacheCSA.…”

Section: Related Workmentioning

confidence: 99%

“…To address SATHV researchers proposed online detection mechanisms [1]- [3] that utilize Hardware Performance Counters (HPCs). HPCs are special-purpose registers integrated in most modern architectures.…”

Section: Introductionmentioning

confidence: 99%

MaDMAN: Detection of Software Attacks Targeting Hardware Vulnerabilities

Polychronou

Thevenon

Puys

et al. 2021

2021 24th Euromicro Conference on Digital System Design (DSD)

View full text Add to dashboard Cite

The increasing complexity of modern microprocessors created new attack areas. Attackers exploit these areas using Software Attacks Targeting Hardware Vulnerabilities (SATHV) such as Cache Side-Channel, Spectre, and Rowhammer attacks. These attacks target the microarchitecture to extract privileged information. As their target is the hardware, antivirus programs cannot detect them. But, they modify the normal behavior of the microarchitecture. Modern systems are equipped with hardware performance counters (HPCs), which measure events related to hardware components. Designers can take advantage of these counters to monitor and protect the system. In the literature, there exist many solutions that use HPCs to detect SATHV. But, due to the limited number of counters, proposed solutions only protect the microprocessor against a limited set of SATHV. In contrast, we propose MaDMAN, a Malware Detector, which gathers information from HPCs to detect a large set of SATHV. MaDMAN uses a Logistic Regression classifier. In our threat model, we include Cache Side-Channel, Rowhammer, and Spectre SATHV. Our detection mechanism succeeds to detect these attacks with 98.96% accuracy, 96.3% F-score, and 0% false positive rate. In addition, MaDMAN works in noisy environments and can detect successfully evasive malware.

show abstract

Multibyte Microarchitectural Data Sampling and its Application to Session Key Extraction Attacks

Shin

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Microarchitectural data sampling (MDS) attacks leak secret data from the internal buffers of a processor to the attacker during transient execution. Because of the narrow window of transient execution, previous MDS attacks relied on repetitive sampling to obtain arbitrarily sized data from the buffer. However, as an MDS attacker cannot control the address for data leakage, such an approach significantly degrades the signal-to-noise ratio in the sampled data. In this paper, we propose a novel multibyte microarchitectural data sampling technique for performing MDS attacks. The proposed technique allows several continuous bytes to be captured in one execution without repetition of sampling. The implementation of the technique is quite challenging, because a transient execution window is not sufficiently large to allow multibyte sampling to be completed. We address this problem by leveraging a return stack buffer-based speculation technique, which originally was used for variants of Spectre-type attacks. We repurpose it to enlarge the transient execution window in our attack. Our implementations can capture data of up to 16 bytes in length in one execution from a line-fill buffer. To validate the effectiveness of the multibyte sampling technique, we demonstrate session key extraction attacks against secure network protocols. In particular, our objective is to extract AES-128 and AES-256 keys from TLS and SSH applications. To recover session keys in a postprocessing phase efficiently, we also propose a novel clustering-based search method that assembles the bytes of interest from the noisy sampled data. The experimental results show that our technique can successfully extract AES-128/256 session keys from victim applications with a probability of at least 98% and a reasonable search complexity. INDEX TERMS Microarchitectural data sampling, Transient execution attack, Session key extraction attackRecently, new vulnerabilities have been found on microarchitectural buffers inside some Intel processors [3], [4]. The

show abstract

Real-Time Detection on Cache Side Channel Attacks using Performance Counter Monitor

Cited by 7 publications

References 2 publications

A Comprehensive Survey of Attacks without Physical Access Targeting Hardware Vulnerabilities in IoT/IIoT Devices, and Their Detection Mechanisms

A Comprehensive Survey of Attacks without Physical Access Targeting Hardware Vulnerabilities in IoT/IIoT Devices, and Their Detection Mechanisms

MaDMAN: Detection of Software Attacks Targeting Hardware Vulnerabilities

Multibyte Microarchitectural Data Sampling and its Application to Session Key Extraction Attacks

Contact Info

Product

Resources

About