CacheGhost: A fileless cache timing attack model using adaptive eviction patterns for browser activity fingerprinting

doi:10.1016/j.sysarc.2026.104004

CacheGhost: A fileless cache timing attack model using adaptive eviction patterns for browser activity fingerprinting

2026-09-13

0

PRE

AI

DOI：10.1016/j.sysarc.2026.104004

Original

Original request for help

Save

Abstract

En 中文

• Fileless, memory-resident Prime+Probe attack fingerprints browser activity, no disk trace. • Adaptive three-phase eviction builds stable sets, monitoring 64 cache sets at once. • 98.89%–99.67% per-browser accuracy on Chromium, Edge, Firefox; trace-level split. • Eviction-set construction in 70–167 ms with 91.5%–98.5% reliability in-sandbox. • Evaded host tools tested (ClamAV, auditd); HW/OS/browser mitigations analysed.

Keywords:

Fileless attacks

Cache timing

Prime+Probe

Browser activity fingerprinting

Side-channel attacks

Adaptive eviction sets

CacheGhost: A fileless cache timing attack model using adaptive eviction patterns for browser activity fingerprinting

Abstract

Journal

Organization

Cited Papers