Hardware system detects microarchitectural attacks before data leaks
PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron
Cryptography and Security
Summary
Microarchitectural attacks sneakily exploit the inner workings of computer processors to steal information. The authors show how these attacks leave behind unique patterns or footprints in hardware behavior. They design a tool called PerSpectron that uses a simple type of neural network inside the processor to spot these attack footprints early. By detecting attacks quickly, the system can stop data theft before it happens and does so without slowing down the computer noticeably.
What this means in practice
- •For processor designers: Integrate perceptron-based predictors to detect and classify microarchitectural attacks at runtime for enhanced chip security.
- •For security engineers: Deploy early-warning hardware detectors in computing systems to trigger countermeasures before sensitive data exposure occurs.
Authors
Samira Mirbagher-Ajorpaz, Gilles Pokam, Esmaeil Mohammadian-Koruyeh, Elba Garza, Nael Abu-Ghazaleh, Daniel A. Jiménez
Abstract
Detecting microarchitectural attacks is critical given their proliferation in recent years. Many of these attacks exhibit intrinsic behaviors essential to the nature of their operation, such as creating contention or misspeculation. This study systematically investigates the microarchitectural footprints of hardware-based attacks and shows how they can be detected and classified using an efficient hardware predictor. We present a methodology to use correlated microarchitectural statistics to design a hardware-based neural predictor capable of detecting and classifying microarchitectural attacks before data is leaked. Once a potential attack is detected, it can be proactively mitigated by triggering appropriate countermeasures. Our hardware-based detector, PerSpectron, uses perceptron learning to identify and classify attacks. Perceptron-based prediction has been successfully used in branch prediction and other hardware-based applications. PerSpectron has minimal performance overhead. The statistics being monitored have similar overhead to already existing performance monitoring counters. Additionally, PerSpectron operates outside the processor's critical paths, offering security without added computation delay. Our system achieves a usable detection rate for detecting attacks such as SpectreV1, SpectreV2, SpectreRSB, Meltdown, breakingKSLR, Flush+Flush, Flush+Reload, Prime+Probe as well as cache-attack calibration programs. We also believe that the large number of diverse microarchitectural features offers both evasion resilience and interpretability---features not present in previous hardware security detectors. We detect these attacks early enough to avoid any data leakage, unlike previous work that triggers countermeasures only after data has been exposed.