论文标题

基于机器学习算法的攻击检测,用于幽灵攻击的不同变体和不同的崩溃攻击实现

Attack detection based on machine learning algorithms for different variants of Spectre attacks and different Meltdown attack implementations

论文作者

Tong, Zhongkai, Zhu, Ziyuan, Zhang, Yusha, Liu, Yuxin, Meng, Dan

论文摘要

为了提高处理器的整体性能,计算机架构师在现代处理器中使用各种性能优化技术,例如投机执行,分支预测和混乱执行。现在和将来,这些优化技术对于提高处理器指令的执行速度至关重要。但是,研究人员发现,这些技术引入了隐藏的固有安全缺陷,例如近年来崩溃和鬼魂攻击。他们利用混乱执行或投机性执行等技术结合基于缓存的侧通道攻击来泄漏受保护的数据。这些漏洞的影响是巨大的,因为它们在现有或将来的处理器中很普遍。但是,直到今天,崩溃和鬼魂尚未有效地解决,而是从中进化了多次攻击变体和不同的攻击实现。本文建议通过选择功能选择和使用机器学习算法来优化四个不同的硬件性能事件,以构建Specter V1,V2,V4的实时检测机制,以及熔融攻击的不同实现,最终实现了超过99 \%的准确率。为了验证攻击检测模型的实用性,本文通过各种良性程序和与建模过程不同的幽灵攻击的不同实现进行了测试,并且绝对准确性也超过了99 \%,表明本文可以应对不同攻击变体和可能每天发生的相同攻击的不同实现。

To improve the overall performance of processors, computer architects use various performance optimization techniques in modern processors, such as speculative execution, branch prediction, and chaotic execution. Both now and in the future, these optimization techniques are critical for improving the execution speed of processor instructions. However, researchers have discovered that these techniques introduce hidden inherent security flaws, such as meltdown and ghost attacks in recent years. They exploit techniques such as chaotic execution or speculative execution combined with cache-based side-channel attacks to leak protected data. The impact of these vulnerabilities is enormous because they are prevalent in existing or future processors. However, until today, meltdown and ghost have not been effectively addressed, but instead, multiple attack variants and different attack implementations have evolved from them. This paper proposes to optimize four different hardware performance events through feature selection and use machine learning algorithms to build a real-time detection mechanism for Spectre v1,v2,v4, and different implementations of meltdown attacks, ultimately achieving an accuracy rate of over 99\%. In order to verify the practicality of the attack detection model, this paper is tested with a variety of benign programs and different implementations of Spectre attacks different from the modeling process, and the absolute accuracy also exceeds 99\%, showing that this paper can cope with different attack variants and different implementations of the same attack that may occur daily.

扫码加入交流群

加入微信交流群

微信交流群二维码

扫码加入学术交流群,获取更多资源