论文标题
Mad-en：通过全系统范围的能源消耗检测微构造攻击检测
MAD-EN: Microarchitectural Attack Detection through System-wide Energy Consumption
论文作者
论文摘要
随着诸如幽灵和崩溃等攻击的多样性，微体系攻击变得更加威胁到硬件安全性。供应商补丁无法跟上新威胁的速度，这使动态异常检测工具比以前更加明显。不幸的是，由于可以同时介绍的少量计数器，因此先前的研究利用了硬件性能计数器，导致高性能开销和概况有限的微体系攻击。在实际情况下，这使这些检测工具效率低下。 在这项研究中，我们介绍了疯狂的动态检测工具，该工具利用从通用的英特尔Rapl工具收集的全系统耗能痕迹来检测系统中的持续异常。在我们的实验中，我们表明基于CNN的MAD-EN可以检测10个不同的微体系攻击，总共15个变体，最高的F1得分为0.999，这使我们的工具成为迄今为止最通用的攻击检测工具。此外，在系统中检测到异常后，可以以98％的精度来区分单个攻击。我们证明，与基于性能计数器的检测机制相比，MAD-EN的性能开销降低了69.3％。
Microarchitectural attacks have become more threatening the hardware security than before with the increasing diversity of attacks such as Spectre and Meltdown. Vendor patches cannot keep up with the pace of the new threats, which makes the dynamic anomaly detection tools more evident than before. Unfortunately, previous studies utilize hardware performance counters that lead to high performance overhead and profile limited number of microarchitectural attacks due to the small number of counters that can be profiled concurrently. This yields those detection tools inefficient in real-world scenarios. In this study, we introduce MAD-EN dynamic detection tool that leverages system-wide energy consumption traces collected from a generic Intel RAPL tool to detect ongoing anomalies in a system. In our experiments, we show that CNN-based MAD-EN can detect 10 different microarchitectural attacks with a total of 15 variants with the highest F1 score of 0.999, which makes our tool the most generic attack detection tool so far. Moreover, individual attacks can be distinguished with a 98% accuracy after an anomaly is detected in a system. We demonstrate that MAD-EN introduces 69.3% less performance overhead compared to performance counter-based detection mechanisms.
