Jonghyeon Cho, Taehyun Kim, Youngjoo Shin

KIPS Transactions on Computer and Communication Systems, Vol. 8, No. 6, pp. 151-158, Jun. 2019
https://doi.org/10.3745/KTCCS.2019.8.6.151,   PDF Download:
Keywords: Cache-Side Channel Attack, FLUSH+RELOAD Attack, Performance Counter Monitor, Attack Detection
Abstract

FLUSH+RELOAD attack exposes the most serious security threat among cache side channel attacks due to its high resolution and low noise. This attack is exploited by a variety of malicious programs that attempt to leak sensitive information. In order to prevent such information leakage, it is necessary to detect FLUSH+RELOAD attack in real time. In this paper, we propose a novel run-time detection technique for FLUSH+RELOAD attack by utilizing PCM (Performance Counter Monitor) of processors. For this, we conducted four kinds of experiments to observe the variation of each counter value of PCM during the execution of the attack. As a result, we found that it is possible to detect the attack by exploiting three kinds of important factors. Then, we constructed a detection algorithm based on the experimental results. Our algorithm utilizes machine learning techniques including a logistic regression and ANN(Artificial Neural Network) to learn from different execution environments. Evaluation shows that the algorithm successfully detects all kinds of attacks with relatively low false rate.

Statistics
Cite this article