Detecting Spectre Attacks Using Hardware Performance Counters

doi:10.1109/TC.2021.3082471

2021-01-01

PRE

Congmiao Li *

Jean‐Luc Gaudiot

DOI：10.1109/TC.2021.3082471

原文链接

原文求助

摘要

En 中文

Spectre attacks can be catastrophic and widespread because they exploit common design flaws caused by the speculative capabilities in modern processors to leak sensitive data through side channels. Completely fixing the problem would require a redesign of the architecture for transient execution or the implementation of a new design on re-configurable hardware. However, such fixes cannot be backported to old machines with fixed hardware design. Completely replacing those machines will take a long time. Moreover, existing software patches may cause significant performance overhead. This paper proposes to detect Spectre by monitoring deviations in microarchitectural events using hardware performance counters with promising accuracy above 90 percent under a variety of workload conditions. However, the attacker may attempt to evade detection by slowing down the attack or mimicking benign programs. This paper thus compares different evasion strategies quantitatively and demonstrates that it is possible for the attacker to avoid detection when operating the attacks at a lower speed while maintaining a reasonable attack success rate. Then, we show that, in order to resist evasion, the original detector must be enhanced by randomly switching between a set of detectors using different features and sampling periods so we can keep the detection accuracy above 80 percent.

Keyword:

Program processors

Microarchitecture

Malware

Hardware

Detectors

Machine learning algorithms

Feature extraction

Evasive malware

microarchitectural attacks

security