Detection of Cache Side Channel Attacks Using Thread Level Monitoring of Hardware Performance Counters

Modern multiprocessor systems adopt optimization techniques to boost the speed of execution. These optimizations create vulnerabilities that can be exploited by attackers, thus causing security breaches. The hierarchical structure of cache memory where the Last Level Cache is a super set of previous levels and is shared between multiple cores of the processors creates an attack vector for cache side-channel attacks (SCA). In such attacks, the attacker is able to trace the pattern of victim process execution and correspondingly retrieve secret information by monitoring the shared cache. Mitigation techniques against such attacks trade off security against overall system performance. Hence, mitigation only when an attack is detected is needed. We propose an architecture-agnostic approach that uses hardware performance counters at run time and at thread level instead of current state of the art which use counters at system level to detect cache SCA. The proposed approach reduces the false positives by 48% when compared with system level approaches. Thus, the trade off with performance is also reduced and hence, the proposed approach is especially significant for embedded systems where processor cycle time is a limited resource.