Attack detection based on machine learning algorithms for different variants of Spectre attacks and different Meltdown attack implementations

TL;DR

This paper develops a machine learning-based real-time detection system for Spectre and Meltdown attacks, achieving over 99% accuracy across various attack variants and benign programs, enhancing processor security.

Contribution

It introduces a novel detection mechanism using hardware event feature selection and machine learning to identify multiple Spectre and Meltdown attack variants in real-time.

Findings

Detection accuracy exceeds 99% for various attack variants.

The model effectively distinguishes benign programs from attack executions.

The approach is practical and adaptable to different attack implementations.

Abstract

To improve the overall performance of processors, computer architects use various performance optimization techniques in modern processors, such as speculative execution, branch prediction, and chaotic execution. Both now and in the future, these optimization techniques are critical for improving the execution speed of processor instructions. However, researchers have discovered that these techniques introduce hidden inherent security flaws, such as meltdown and ghost attacks in recent years. They exploit techniques such as chaotic execution or speculative execution combined with cache-based side-channel attacks to leak protected data. The impact of these vulnerabilities is enormous because they are prevalent in existing or future processors. However, until today, meltdown and ghost have not been effectively addressed, but instead, multiple attack variants and different attack implementations have evolved from them. This paper proposes to optimize four different hardware performance events through feature selection and use machine learning algorithms to build a real-time detection mechanism for Spectre v1,v2,v4, and different implementations of meltdown attacks, ultimately achieving an accuracy rate of over 99\%. In order to verify the practicality of the attack detection model, this paper is tested with a variety of benign programs and different implementations of Spectre attacks different from the modeling process, and the absolute accuracy also exceeds 99\%, showing that this paper can cope with different attack variants and different implementations of the same attack that may occur daily.