MaDMAN: Detection of Software Attacks Targeting Hardware Vulnerabilities - Archive ouverte HAL
Communication Dans Un Congrès Année : 2021

MaDMAN: Detection of Software Attacks Targeting Hardware Vulnerabilities

Résumé

The increasing complexity of modern microprocessors created new attack areas. Attackers exploit these areas using Software Attacks Targeting Hardware Vulnerabilities (SATHV) such as Cache Side-Channel, Spectre, and Rowhammer attacks. These attacks target the microarchitecture to extract privileged information. As their target is the hardware, antivirus programs cannot detect them. But, they modify the normal behavior of the microarchitecture. Modern systems are equipped with hardware performance counters (HPCs), which measure events related to hardware components. Designers can take advantage of these counters to monitor and protect the system. In the literature, there exist many solutions that use HPCs to detect SATHV. But, due to the limited number of counters, proposed solutions only protect the microprocessor against a limited set of SATHV. In contrast, we propose MaDMAN, a Malware Detector, which gathers information from HPCs to detect a large set of SATHV. MaDMAN uses a Logistic Regression classifier. In our threat model, we include Cache Side-Channel, Rowhammer, and Spectre SATHV. Our detection mechanism succeeds to detect these attacks with 98.96% accuracy, 96.3% F-score, and 0% false positive rate. In addition, MaDMAN works in noisy environments and can detect successfully evasive malware.
Fichier principal
Vignette du fichier
MaDMAN_DetectionofSoftwareAttacksTargeting_IEEE_check.pdf (9.35 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03601312 , version 1 (08-03-2022)

Identifiants

Citer

Nikolaos Foivos Polychronou, Pierre-Henri Thevenon, Maxime Puys, Vincent Beroulle. MaDMAN: Detection of Software Attacks Targeting Hardware Vulnerabilities. 2021 24th Euromicro Conference on Digital System Design (DSD), Sep 2021, Palermo, France. pp.355-362, ⟨10.1109/DSD53832.2021.00060⟩. ⟨hal-03601312⟩
40 Consultations
72 Téléchargements

Altmetric

Partager

More