论文标题
使用机器学习对幽灵和崩溃攻击的实时检测
Real time Detection of Spectre and Meltdown Attacks Using Machine Learning
论文作者
论文摘要
最近发现的Spectre和Meltdown攻击几乎通过通过侧向通道攻击将机密信息泄漏到其他过程来影响所有处理器。这些漏洞在现代CPU的架构中暴露了设计缺陷。为了解决这些设计缺陷，有必要在现代处理器的硬件上进行更改，这是一项非平凡的任务。这些漏洞的软件缓解技术会导致大量的性能下降。为了减轻幽灵和崩溃的攻击，同时保留了现代处理器的性能优势，在本文中，我们通过确定滥用投机性执行和侧渠道攻击，提出了一种实时检测机制，用于幽灵和崩溃攻击。我们使用硬件性能计数器和软件事件来监视与投机执行，分支预测和缓存干扰有关的活动。我们使用各种机器学习模型来分析这些事件。这些事件在系统受到攻击时产生非常独特的模式。机器学习模型能够在逼真的负载条件下检测崩溃和幽灵攻击，精度超过99％。
Recently discovered Spectre and meltdown attacks affects almost all processors by leaking confidential information to other processes through side-channel attacks. These vulnerabilities expose design flaws in the architecture of modern CPUs. To fix these design flaws, it is necessary to make changes in the hardware of modern processors which is a non-trivial task. Software mitigation techniques for these vulnerabilities cause significant performance degradation. In order to mitigate against Spectre and Meltdown attacks while retaining the performance benefits of modern processors, in this paper, we present a real-time detection mechanism for Spectre and Meltdown attacks by identifying the misuse of speculative execution and side-channel attacks. We use hardware performance counters and software events to monitor activity related to speculative execution, branch prediction, and cache interference. We use various machine learning models to analyze these events. These events produce a very distinctive pattern while the system is under attack; machine learning models are able to detect Meltdown and Spectre attacks under realistic load conditions with an accuracy of over 99%.
