Hardware Performance Counters Research Articles

CarePlus: A general framework for hardware performance counter based malware detection under system resource competition

Hardware performance counter (HPC) has been used for malware detection because of its lightweight overhead. Unfortunately, such detection models including their software implementation and hardware implementation suffer from performance decline in environments where resource competition among programs exists in the operating system. In this paper, we propose a framework called CarePlus, which enables two kinds of implementations of hardware performance counter-based malware detection (HMD) resilient to resource competition. The core idea is to detect malware by using invariants extracted from HPC-level behaviors in resource competition environments. To achieve this, a benchmark-based resource pressure generator is designed to generate controlled resource competition environments for observing typical HPC-level behavior of a program. Then, a behavior representation network is trained to map HPC-level behaviors in any competition environment into low-dimensional representations, which allows software-implemented HMD models built on them to detect malware regardless of resource competition. Finally, an adapter is introduced to project behavior representation in the competition environment into data that conforms to the training distribution of the hardware-implemented HMD model. Using three datasets collected in different application systems (e.g., server or desktop) with different resource competition types or levels, the experimental results show that compared with existing detection models, CarePlus is helpful to improve the performance of software-implemented HMD classifier and hardware-implemented HMD classifier in the competition environment. We also prove that the classifier using CarePlus is insensitive to different application systems. Finally, we demonstrate the computational overhead.

Hardware Prefetching Tuning Method Based on Program Phase Behavior

Modern high-performance processor systems universally employ hardware prefetch engines to address the “memory wall” issue. Nonetheless, prefetchers are typically activated with the default configuration at system startup, and this fixed configuration does not always achieve the intended performance in the face of varied programs and may even degrade performance. As a result, it is crucial to investigate the prefetch configuration tuning method that adapts to different program characteristics in order to take full advantage of hardware prefetching. In this study, a hardware prefetching tuning method based on program phase behavior is proposed to determine the prefetch configuration that maximizes the overall predicted performance of the program through low-overhead online profiling. In the profiling process, the branch instruction vector sampled by the hardware performance counter is used to dynamically classify the program phase behavior, and the performance profiling is performed for each type of phase. Simultaneously, the recurring program phases are no longer profiled to reduce overhead. Following the profiling, the prefetch configuration with the best predicted performance is derived by combining the performance data from each phase and its running time proportion. The results of the tests on prefetch-sensitive programs in SPEC2006, NPB, and PARSEC demonstrate that the prefetch configuration obtained using the suggested method has a geometric average performance improvement of 7.34% over the default configuration and achieves 99.34% of the optimal configuration. Furthermore, the profiling run adds only 2.24% extra overhead as compared to the default configuration.

DROPSYS: Detection of ROP attacks using system information

As modern return-oriented programming (ROP) attacks have become more sophisticated, preventing or detecting these attacks is essential for real-world exploit defense. As an alternative to many defense techniques of ROP attacks that require software modification and hardware assistance, researchers have proposed ROP defense techniques using hardware performance counters (HPCs) to mitigate concerns about additional cost and compatibility issues. However the existing HPC data-based ROP detection techniques typically suffer from low detection performance mainly because of the non-deterministic nature of HPCs.To address these issues, we propose DROPSYS, an enhanced detection of ROP attacks using system information. DROPSYS is based on the detection of the abnormal change of system information that takes place during ROP attacks. Differing from the existing techniques, DROPSYS harnesses not only HPC data, but also system utilization data to mitigate the non-deterministic nature of HPCs. Using both HPCs of processors and system utilization of operating systems makes transparent operation without requiring any modifications to the protected programs. DROPSYS uses a long short-term memory-based variational autoencoder to effectively analyze the multivariate time-series HPC data and system utilization data for better detection performance. DROPSYS also performs feature selection for low computational overhead while maintaining the attack detection performance.In our experiments with real-world ROP exploits, DROPSYS successfully detected ROP code execution in all tested programs. Evaluation results show that DROPSYS effectively captures the behaviors and effects of ROP attacks and can detect the attacks with a 0.028% false positive rate. The accuracy of DROPSYS is 95.3%, and its F1 score is 94.9%—a figure much higher than those of existing techniques that utilize only HPC data.

Profiling with trust: system monitoring from trusted execution environments

AbstractLarge-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Multi-Modal Side Channel Data Driven Golden-Free Detection of Software and Firmware Trojans

This study explores data-driven detection of firmware/software Trojans in embedded systems <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">without</i> golden models. We consider embedded systems such as single board computers and industrial controllers. While prior literature considers side channel based anomaly detection, this study addresses the following central question: is anomaly detection feasible when using low-fidelity simulated data without using data from a known-good (golden) system? To study this question, we use data from a simulator-based proxy as a stand-in for unavailable golden data from a known-good system. Using data generated from the simulator, one-class classifier machine learning models are applied to detect discrepancies against expected side channel signal patterns and their inter-relationships. Side channels fused for Trojan detection include multi-modal <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">side channel</i> measurement data (such as Hardware Performance Counters, processor load, temperature, and power consumption). Additionally, fuzzing is introduced to increase detectability of Trojans. To experimentally evaluate the approach, we generate low-fidelity data using a simulator implemented with a component-based model and an information bottleneck based on Gaussian stochastic models. We consider example Trojans and show that fuzzing-aided golden-free Trojan detection is feasible using simulated data as a baseline.

HiPeR - Early Detection of a Ransomware Attack using Hardware Performance Counters

Ransomware has been one of the most prevalent forms of malware over the previous decade, and it continues to be one of the most significant threats today. Recently, ransomware strategies such as double extortion and rapid encryption have encouraged attacker communities to consider ransomware as a business model. With the advent of Ransomware as a Service (RaaS) models, ransomware spread and operations continue to increase. Even though machine learning and signature-based detection methods for ransomware have been proposed, they often fail to achieve very accurate detection. Ransomware that evades detection moves to the execution phase after initial access and installation. Due to the catastrophic nature of a ransomware attack, it is crucial to detect in its early stages of execution. If there is a method to detect ransomware in its execution phase early enough, then one can kill the processes to stop the ransomware attack. However, early detection with dynamic API call analysis is not an ideal solution, as the contemporary ransomware variants use low-level system calls to circumvent the detection methods. In this work, we use hardware performance counters (HPC) as features to detect the ransomware within 3-4 seconds - which may be sufficient, at least in the case of ransomware that takes longer to complete its full execution.

PReFeR : P hysically Re lated F unction bas e d R emote Attestation Protocol

Remote attestation is a request-response based security service that permits a trusted entity (verifier) to check the current state of an untrusted remote device (prover). The verifier initiates the attestation process by sending an attestation challenge to the prover; the prover responds with its current state, which establishes its trustworthiness. Physically Unclonable Function (PUF) offers an attractive choice for hybrid attestation schemes owing to its low overhead security guarantees. However, this comes with the limitation of secure storage of the PUF model or large challenge-response database on the verifier end. To address these issues, in this work, we propose a hybrid attestation framework, named PReFeR , that leverages a new class of hardware primitive known as Physically Related Function (PReF) to remotely attest low-end devices without the requirement of secure storage or heavy cryptographic operations. It comprises a static attestation scheme that validates the memory state of the remote device prior to code execution, followed by a dynamic run-time attestation scheme that asserts the correct code execution by evaluating the content of special registers present in embedded systems, known as hardware performance counters (HPC). The use of HPCs in the dynamic attestation scheme mitigates the popular class of attack known as the time-of-check-time-of-use (TOCTOU) attack, which has broken several state-of-the-art hybrid attestation schemes. We demonstrate our protocol and present our experimental results using a prototype implementation on Digilent Cora Z7 board, a low-cost embedded platform, specially designed for IoT applications.

Strategies and software support for the management of hardware performance counters

AbstractHardware performance counters (HPCs) are facilities offered by most off‐the‐shelf CPU architectures. They are a vital support to post‐mortem performance profiling and are exploited by standard tools such as Linux or Intel V‐Tune. Nevertheless, an increasing number of application domains (e.g., simulation, task‐based high‐performance computing, or cybersecurity) are exploiting them to perform different activities, such as self‐tuning, autonomic optimization, and/or system inspection. This repurposing of HPCs can be difficult, for example, because of the overhead for extracting relevant information. This overhead might render any online or self‐tuning activity ineffective. This article discusses various practical strategies to exploit HPCs beyond post‐mortem profiling, suitable for different application contexts. The presented strategies are accompanied by a general primer on HPCs usage on Linux. We also provide reference x86 (both Intel and AMD) implementations targeting the Linux kernel, upon which we present an experimental assessment of the viability of our proposals.

Fuzzing+Hardware Performance Counters-Based Detection of Algorithm Subversion Attacks on Postquantum Signature Schemes

NIST is standardizing Post Quantum Cryptography (PQC) algorithms that are resilient to the computational capability of quantum computers. Past works show malicious subversion with cryptographic software (algorithm subversion attacks) that weaken the implementations. We show that PQC digital signature codes can be subverted in line with previously reported flawed implementations that generate verifiable, but less-secure signatures, demonstrating the risk of such attacks. Since, all processors have built-in Hardware Performance Counters (HPCs), there exists a body of work proposing a low-cost Machine Learning (ML)-based integrity checking of software using HPC fingerprints. However, such HPC-based approaches may not detect subversion of PQC codes. A miniscule percentage of qualitative inputs when applied to the PQC codes improve this accuracy to 98%. We propose grey-box fuzzing as a pre-processing step to obtain inputs to aid the HPC-based method.

MAD-EN: Microarchitectural Attack Detection Through System-Wide Energy Consumption

Microarchitectural attacks have become increasingly threatening the society with diverse set of attacks such as Spectre and Meltdown. Vendor patches cannot keep up with the pace of the new threats, which makes the dynamic anomaly detection tools more evident than before. Unfortunately, hardware performance counters (HPCs) utilized in previous works can detect a few microarchitectural attacks due to the small number of counters that can be profiled concurrently while introducing high performance overhead. These challenges consequently yield to inefficient detection tools in real-world security-critical systems. In this study, we introduce MAD-EN dynamic detection tool that leverages system-wide energy consumption traces collected from a generic Intel RAPL tool to detect ongoing anomalies in two different microarchitectures, namely Intel Comet Lake and Intel Tiger Lake. In the first phase of MAD-EN, we can distinguish 16 variants from 11 different micro-architectural attacks from benign applications by utilizing a binary-class CNN-based model with an F1 score of 0.998, which makes our tool the most generic attack detection tool so far. In the second phase, MAD-EN can recognize the respective attack types with a 95% accuracy by utilizing a multi-class CNN-based classification technique after the anomaly is detected. We demonstrate that MAD-EN introduces 69.3% less performance overhead compared to performance counter-based detection mechanisms, allowing more feasible real-time detection tool for generic purpose systems.

Explainable Machine Learning for Intrusion Detection via Hardware Performance Counters

The exponential proliferation of Malware over the past decade has threatened system security across a plethora of Internet of Things (IoT) devices. Furthermore, the improvements in computer architectures to include speculative branching and out-of-order executions have engendered new opportunities for adversaries to carry out microarchitectural attacks in these devices. Both Malware and microarchitectural attacks are imperative threats to computing systems, as their behaviors range from stealing sensitive data to total system failure. With the cat-and-mouse game between Anti-Virus Software (AVS) and attackers, the frequent bolstering of AVS induces large computational overhead. Consequently, hardware performance counter (HPC)-based detection strategies augmented with machine learning (ML) classifiers have gained popularity as a low overhead solution in identifying these malicious threats. However, ML models are operated as black boxes, which results in decisions that are not human understandable. Clarity of the models’ results facilitates the development of more robust systems. Existing explainable frameworks are only capable of determining each feature’s impact on a prediction which does not provide meaningful interpretable outcomes for HPC-based intrusion detection. In this article, we address this issue by proposing an explainable HPC-based double regression (HPCDR) ML framework. Our proposed technique provides relevant transparency through isolation of the most malevolent transient window of an application, thereby allowing a user to efficiently locate the pernicious instructions within the program. We evaluated HPCDR on five microarchitectural attacks and two Malware. HPCDR was successfully able to identify the most malicious function manifested in each intrusive application.

Time series-based detection and impact analysis of firmware attacks in microgrids

Distributed generation (DG) and microgrids (MG) are critical components of future power systems. However, the reliance of DGs and MG on resource-constrained embedded controllers for their operation renders them potential cyberattack targets. In this paper, we analyze the adversarial objectives of attackers attempting switching and control input modification attacks by manipulating controller firmware. We demonstrate the attack impact in the simulated Canadian urban distribution feeder system consisting of four DGs. To detect malicious firmware within the inverter controllers, we propose utilizing custom-built Hardware Performance Counters (HPCs) in conjunction with Time Series Classifiers (TSCs). TSCs respect the sequential order and attributes of the utilized custom-built HPCs sampling the controller’s firmware. Our experimental results demonstrate that malicious firmware can be successfully identified with 97.22% accuracy using a TSC trained on a single custom-built HPC.

CBA-Detector: A Self-Feedback Detector Against Cache-Based Attacks

Cloud computing is convenient to provide adequate resources for tenants. However, since multiple tenants share the underlying hardware resources, malicious tenants can use the shared processor to launch cache-based attacks. Such attacks can help malicious tenants steal private data of other tenants bypassing isolation mechanisms provided by the system, resulting in information leakage. Moreover, Spectre and Meltdown vulnerabilities can even extract memory contents arbitrarily with the help of cache attacks. Therefore, cache-based attacks pose a serious threat to the security of cloud platforms. To defeat such attacks, many detection methods have been proposed. However, most methods induce high false positives because they completely rely on the hardware performance counters (HPCs) and detect attacks with static criteria. To solve this problem, this article proposes a self-feedback detector named CBA-Detector to detect cache-based attacks in real time. Specifically, CBA-Detector first uses machine learning technologies to create models for identifying suspicious programs with abnormal hardware behaviors, then analyzes suspicious programs from the instruction level to identify real attacks and provide feedback. Based on the feedback, the models can be updated to further improve their detection accuracy. As our experiments show, CBA-Detector can accurately identify cache-based attacks in real time and introduces a little overhead. Besides, the misjudgment rate decreases with the running time.

Accurate and Robust Malware Detection: Running XGBoost on Runtime Data From Performance Counters

Malware applications are one of the major threats that computing systems face today. While security researchers develop new defense mechanisms to detect malware, attackers continue to release new malware families that evade detection. New defense mechanisms must therefore be developed to effectively counter malware. Hardware performance counters (HPCs) have been recently proposed as a means to detect malware. However, recent work has also shown that malware detection is not effective when performance counters are sampled in realistic scenarios. We show how proper data preprocessing and the use of the XGBoost classifier can be used to improve the performance of malware detection using HPCs by at least 15%. We also show that the proposed method can detect malware early (shortly after its launch) by classifying HPC datastreams at short time intervals. In addition, we propose a multitemporal classification model that ensures the early detection of a high percentage of malware while maintaining overall low false positive rates. Finally, we show that through robust training, the XGBoost classifier shows up to 50x less vulnerability to adversarial attacks that are intended to undermine its malware detection performance.

Detecting Hardware Trojans in PCBs Using Side Channel Loopbacks

Malicious modifications to printed circuit boards (PCBs) are known as hardware Trojans. These may arise when malafide third parties alter PCBs premanufacturing or postmanufacturing and are a concern in safety-critical applications, such as industrial control systems. In this research, we examine how data-driven detection can be utilized to detect such Trojans at run-time. We develop a flexible and reconfigurable PCB test bed derived from the popular open-source programmable logic controller (PLC) platform “OpenPLC.” We then develop a Trojan detection framework, which utilizes and analyzes multimodal side channels (e.g., timing, magnetic signals, power, and hardware performance counters). We consider defender-configurable input/output (I/O) loopback test, comparison with design-document baselines, and magnetometer-aided monitoring of system behavior under defender-chosen excitations. Our approach can extend to golden-free environments. Golden (known-good) versions of the PCBs are assumed not available, but design information, datasheets, and component-level data are available. We demonstrate the efficacy of our approach on a range of Trojans instantiated in the test bed.

MAPPER: Managing Application Performance via Parallel Efficiency Regulation

State-of-the-art systems, whether in servers or desktops, provide ample computational and storage resources to allow multiple simultaneously executing potentially parallel applications. However, performance tends to be unpredictable, being a function of algorithmic design, resource allocation choices, and hardware resource limitations. In this article, we introduce MAPPER, a manager of application performance via parallel efficiency regulation. MAPPER uses a privileged daemon to monitor (using hardware performance counters) and coordinate all participating applications by making two coupled decisions: the degree of parallelism to allow each application to improve system efficiency while guaranteeing quality of service (QoS), and which specific CPU cores to schedule applications on. The QoS metric may be chosen by the application and could be in terms of execution time, throughput, or tail latency, relative to the maximum performance achievable on the machine. We demonstrate that using a normalized parallel efficiency metric allows comparison across and cooperation among applications to guarantee their required QoS. While MAPPER may be used without application or runtime modification, use of a simple interface to communicate application-level knowledge improves MAPPER’s efficacy. Using a QoS guarantee of 85% of the IPC achieved with a fair share of resources on the machine, MAPPER achieves up to 3.3 \( \times \) speedup relative to unmodified Linux and runtime systems, with an average improvement of 17% in our test cases. At the same time, MAPPER violates QoS for only 2% of the applications (compared to 23% for Linux), while placing much tighter bounds on the worst case. MAPPER relieves hardware bottlenecks via task-to-CPU placement and allocates more CPU contexts to applications that exhibit higher parallel efficiency while guaranteeing QoS, resulting in both individual application performance predictability and overall system efficiency.

MATANA: A Reconfigurable Framework for Runtime Attack Detection Based on the Analysis of Microarchitectural Signals

Microarchitectural attacks exploit target hardware properties to break software isolation techniques used by the processor. These attacks are extremely powerful and hard to detect since the determination of the program execution’s impact on the microarchitecture is at the same time not precisely understood and not easily observable at the software layer. Some approaches have attempted to benefit from existing hardware to better understand and detect the microarchitectural attacks (i.e., Hardware Performance Counters or Arm CoreSight), but such hardware was not meant to be used for cybersecurity, with reduced choice on observable signals and limited throughput of information. In this paper, we propose MATANA, an open and adaptive reconfigurable hardware/software co-designed framework. Combining fine-grained analysis of microarchitectural signals and software support, MATANA allows to design and assess detection mechanisms for attacks by characterizing their microarchitectural effects—in particular, microarchitectural attacks, but also some high-level attacks such as return-oriented programming attacks. The paper also describes a prototype implementation, built with a RISC-V softcore processor Rocket running Linux 4.15 on a Virtex-6 FPGA. We successfully used MATANA to analyze cache side-channel attacks and build attack detection logic from two different perspectives: instruction-based and memory-access-based. We also successfully detected return-oriented programming attacks by exhibiting a specific behavioral pattern on the microarchitecture.

CacheHawkeye: Detecting Cache Side Channel Attacks Based on Memory Events

Cache side channel attacks, as a type of cryptanalysis, seriously threaten the security of the cryptosystem. These attacks continuously monitor the memory addresses associated with the victim’s secret information, which cause frequent memory access on these addresses. This paper proposes CacheHawkeye, which uses the frequent memory access characteristic of the attacker to detect attacks. CacheHawkeye monitors memory events by CPU hardware performance counters. We proved the effectiveness of CacheHawkeye on Flush+Reload and Flush+Flush attacks. In addition, we evaluated the accuracy of CacheHawkeye under different system loads. Experiments demonstrate that CacheHawkeye not only has good accuracy but can also adapt to various system loads.

Investigating Black-Box Function Recognition Using Hardware Performance Counters

This paper presents new methods and results for recognising black-box program functions using hardware performance counters (HPC), where an investigator can invoke and measure function calls. Important use cases include analysing compiled libraries, e.g. static and dynamic link libraries, and trusted execution environment (TEE) applications. We develop a generic approach to classify a comprehensive set of hardware events, e.g. branch mis-predictions and instruction retirements, to recognise standard benchmarking and cryptographic library functions. This includes various signing, verification and hash functions, and ciphers in numerous modes of operation. Three architectures are evaluated using off-the-shelf Intel/X86-64, ARM, and RISC-V CPUs. Next, we show that several known CVE-numbered OpenSSL vulnerabilities can be detected using HPC differences between patched and unpatched library versions. Further, we demonstrate that standardised cryptographic functions within ARM TrustZone TEE applications can be recognised using non-secure world HPC measurements, applying to platforms that insecurely perturb the performance monitoring unit (PMU) during TEE execution. High accuracy was achieved in all cases (86.22–99.83%) depending on the application, architectural, and compilation assumptions. Lastly, we discuss mitigations, outstanding challenges, and directions for future research.