Multi-stage detection of microarchitectural attack using machine learning

Abstract

Microarchitectural attack is an emerging security threat in computer architecture field. Previous works used machine learning and hardware performance counters (HPCs) to detect abnormal behaviors in hardware-level occurred by microarchitectural attack. However, these traditional works have limitations that they can detect limited types of attacks or consume too much time for detecting various attacks. Moreover, it is hard to apply them against new attacks because they manually or experimentally selected HPC events. In this thesis, we propose a multi-stage detection of microarchitectural attack using machine learning. First, to detect various types of microarchitectural attacks, we propose an effective HPC events selection method. Then, through the multi-stage detection method, the first stage detects attacks fast, and, when an attack is detected, next stage identifies a type of the attack. The experiments about 9 microarchitectural attacks have shown that multi-stage detection method achieves 99.96% attack detection accuracy in less than 1ms, and 97.48% attack type identification accuracy. Also, we have shown that the proposed HPC events selection method achieves 10.73% increase in recall (true positive rate) than prior work.