Vulnerability Assessment for the Rowhammer Attack Using Hardware Performance Counters and Machine Learning
Abstract
Numerous machines using DRAM chips as main memory are vulnerable to the Rowhammer attack, which can be used as a tool for privilege escalation. The existing mitigation techniques either require complex hardware implementation or have a high performance cost. A potential improvement would be to implement a detection mechanism and trigger performance-costly mitigation only in the case of attack detection. In this paper, we study this defence method on three systems using Intel Skylake, Tiger Lake and Alder Lake processors, and DDR4 and DDR5 DRAM chips as main memory. We execute four variants of the attack code on these machines and observe their traces in the hardware. We use the PAPI library and perf to periodically read the generated traces from the machines' hardware performance counters. Finally, we train machine learning models such as logistic regression and decision trees to distinguish attack and no-attack behaviour. Our best models achieve accuracy above 99.6% and perform the classification of both 50µs and 1ms samples in software fast enough (less than 0.5µs per sample) to detect the attack before completion.
Domains
Computer Science [cs]Origin | Files produced by the author(s) |
---|