SoK: Can We Really Detect Cache Side-Channel Attacks by Monitoring Performance Counters?

Kosasih, William; Feng, Yusi; Chuengsatiansup, Chitchanok; Yarom, Yuval; Zhu, Ziyuan

doi:10.1145/3634737.3637649

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2024

Publication Types

Select...

Article2

Book1

Relationship

Self Cite0

Independent3

Authors

Journals

Cited by 3 publications

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“There’s Always Another Counter”: Detecting Micro-Architectural Attacks in a Probabilistically Interleaved Malicious/Benign Setting

Mandal,

Kalundia,

Mishra

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

“There’s Always Another Counter”: Detecting Micro-Architectural Attacks in a Probabilistically Interleaved Malicious/Benign Setting

Mandal,

Kalundia,

Mishra

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Systematical Evasion from Learning-based Microarchitectural Attack Detection Tools

Dipta,

Tan,

Gulmezoglu

2024

IEEE J. Emerg. Sel. Topics Circuits Syst.

View full text Add to dashboard Cite

T-Smade: A Two-Stage Smart Detector for Evasive Spectre Attacks Under Various Workloads

Jiao,

Wen,

2024

Electronics

View full text Add to dashboard Cite

Evasive Spectre attacks have used additional nop or memory delay instructions to make effective hardware performance counter based detectors with lower attack detection successful rate. Interestingly, the detection performance gets worse under different workloads. For example, the attack detection successful rate is only 59.8% for realistic applications, while it is much lower 27.52% for memory stress test. Therefore, this paper proposes a two-stage smart detector T-Smade designed for evasive Spectre attacks (e.g., evasive Spectre nop and evasive Spectre memory) under various workloads. T-Smade uses the first-stage detector to identify the type of workloads and then selects the appropriate second-stage detector, which uses four hardware performance counter events to characterize the high cache miss rate and low branch miss rate of Spectre attacks. More importantly, the second stage detector adds one dimension of reusing cache miss rate and branch miss rate to exploit the characteristics of various workloads to detect evasive Spectre attacks effectively. Furthermore, to achieve the good generalization for more unseen evasive Spectre attacks, the proposed classification detector T-Smade is trained by the raw data of Spectre attacks and non-attacks in different workloads using simple Multi-Layer Perception models. The comprehensive results demonstrate that T-Smade makes the average attack detection successful rate of evasive Spectre nop under different workload return from 27.52% to 95.42%, and that of evasive Spectre memory from 59.8% up to 100%.

show abstract

SoK: Can We Really Detect Cache Side-Channel Attacks by Monitoring Performance Counters?

Cited by 3 publications

References 33 publications

“There’s Always Another Counter”: Detecting Micro-Architectural Attacks in a Probabilistically Interleaved Malicious/Benign Setting

“There’s Always Another Counter”: Detecting Micro-Architectural Attacks in a Probabilistically Interleaved Malicious/Benign Setting

Systematical Evasion from Learning-based Microarchitectural Attack Detection Tools

T-Smade: A Two-Stage Smart Detector for Evasive Spectre Attacks Under Various Workloads

Contact Info

Product

Resources

About