IMS: Intelligent Hardware Monitoring System for Secure SoCs

TL;DR

This paper introduces IMS, a neural network-based hardware module integrated into RISC-V SoCs, capable of real-time detection of AXI protocol violations to enhance security with minimal performance overhead.

Contribution

The paper presents a novel, lightweight neural network-based hardware monitoring system for real-time AXI protocol violation detection in SoCs, demonstrating high accuracy and low latency.

Findings

Achieved 98.7% detection accuracy with <=3% latency overhead.

Implemented on AMD Zynq UltraScale+ MPSoC with minimal hardware footprint.

Demonstrated feasibility for resource-constrained edge environments.

Abstract

In the modern Systems-on-Chip (SoC), the Advanced eXtensible Interface (AXI) protocol exhibits security vulnerabilities, enabling partial or complete denial-of-service (DoS) through protocol-violation attacks. The recent countermeasures lack a dedicated real-time protocol semantic analysis and evade protocol compliance checks. This paper tackles this AXI vulnerability issue and presents an intelligent hardware monitoring system (IMS) for real-time detection of AXI protocol violations. IMS is a hardware module leveraging neural networks to achieve high detection accuracy. For model training, we perform DoS attacks through header-field manipulation and systematic malicious operations, while recording AXI transactions to build a training dataset. We then deploy a quantization-optimized neural network, achieving 98.7% detection accuracy with <=3% latency overhead, and throughput of >2.5 million inferences/s. We subsequently integrate this IMS into a RISC-V SoC as a memory-mapped IP core to monitor its AXI bus. For demonstration and initial assessment for later ASIC integration, we implemented this IMS on an AMD Zynq UltraScale+ MPSoC ZCU104 board, showing an overall small hardware footprint (9.04% look-up-tables (LUTs), 0.23% DSP slices, and 0.70% flip-flops) and negligible impact on the overall design's achievable frequency. This demonstrates the feasibility of lightweight, security monitoring for resource-constrained edge environments.