Detection of hardware based attacks using performance counters

Abstract

Hardware attacks, such as Spectre or Meltdown, try to exploit vulnerabilities on the processor architecture, usually to gain access to privileged memory locations, producing leaks of critical information. Most of this attacks exploit out-of-order execution and also highly stress the computer’s cache, and both of these behaviours can be tracked using hardware performance counters (HPC). In order to try to use HPCs in our advantage we: 1. Collected several samples of different attacks and HPCs 2. Collected an equivalent amount of samples from benign programs 3. Trained a Support Vector Machine to classify the execution as benign or malignant