Cache-Based Side-Channel Intrusion Detection using Hardware Performance Counters
Résumé
We present a novel run-time detection approach for cache-based side channel attacks (SCAs). It constitutes machine learning models which take real-time data from hardware performance counters for detection purpose. We have performed our experiments with two state-of-the-art cache-based side channel attacks namely, Flush+Reload and Flush+Flush to evaluate the effectiveness of our detection approach. We have provided the experimental evaluation using real time system load conditions and analyzed the results on detection accuracy, detection speed, system-wide performance overhead and confusion matrix for used models. Proposed detection mechanism uses three different machine learning models, namely LDA, LR, SVM model for intrusion detection. We collect data related to the real-time behavior of running processes through selected CPU events, which are stored in registers called Hardware Performance Counters (HPCs). This data is used as features for our machine learning models. The method is designed for run-time detection of cache-based SCAs on RSA and AES crypto-systems. The proposed method uses carefully selected unique hardware events in a multiplexed fashion to reduce false positives and false negatives. We perform experiments on Intel's Core i5 i7 machines under No load, Average load, and Full load system conditions. Our results show detection accuracy of up to 99.51%in the best case for Flush+Reload and 99.97% in the best case for Flush+Flush SCA. Our detection approach shows considerably high detection efficiency under realistic system load conditions.
Origine : Fichiers produits par l'(les) auteur(s)
Loading...