Method and system for detecting related interrupt side channel of processor on cloud platform

Abstract

The invention discloses a method and system for detecting a processor related interrupt side channel on a cloud platform, and the system comprises an interrupt monitoring unit which obtains the number of interrupts generated by a calculation instruction in different first periods; the calculation unit is used for calculating the relevancy between the interrupt and the calculation instruction according to the result of the interrupt monitoring unit to obtain the interrupt causing information leakage; and carrying out an attack experiment on interruption causing information leakage, and selecting a verification unit of target attack interruption. According to the method, interruption behaviors of the system under different computing tasks are monitored, interruption types possibly causing information leakage are automatically identified, and an interruption type list is obtained.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a method and system for detecting a processor-related interrupt side channel on a cloud platform. Background Art

[0002] Interrupts are key hardware resources in modern operating systems, allowing the operating system's process scheduler to preempt running processes and execute corresponding interrupt handlers. In cloud computing environments, where multiple virtual machines share physical resources, efficient management of interrupts is particularly important. Specifically, while interrupts enable the system to efficiently respond to user operations, network requests, and hardware events, and achieve multitasking, they also become potential attack surfaces due to their high priority and close association with user behavior. Certain types of interrupts are increasingly being abused as side-channel attacks, threatening the confidentiality of the system.

[0003] Existing research shows that attackers can use keyboard interrupts, graphics interrupts, and network interrupts to infer sensitive information in the system. Compared with other side channel attacks, interrupt side channel attacks have the advantages of more directly reflecting user behavior and having a variety of observation methods.

[0004] For example: 1. Side-channel attacks in cloud computing scenarios In cloud computing scenarios, since multiple tenants share the underlying hardware resources, there are many unprivileged side channel attacks. Attackers residing in the same physical machine as the victim can use these methods to obtain sensitive information from user space without any privileges. These attacks mainly include temperature side channel, power consumption side channel, cache side channel and interrupt side channel attacks.

[0005] First, thermal side-channel attacks exploit the temperature variations that occur when a processor performs different operations. The heat distribution in different parts of a processor varies as it processes different instructions and data. An attacker can use thermal imaging equipment or built-in temperature sensors to monitor these temperature variations and correlate them with specific computing activities. For example, when executing an encryption algorithm, different keys may cause the processor to generate different heat distributions. By analyzing these temperature differences, an attacker may be able to infer encryption keys or other sensitive information.

[0006] Secondly, power consumption side channel attacks are based on the fluctuations in power consumption of the processor when executing instructions. Different operations and data processing will cause slight changes in power consumption. Attackers can use high-precision power consumption measurement equipment to capture the power consumption curve of the processor. By performing statistical analysis on these power consumption signals, attackers can infer the instruction sequence executed or the data processed by the victim. For example, during the encryption process, different bits of the key may cause slight differences in power consumption, which can be used by attackers to reconstruct the key.

[0007] Third, cache side-channel attacks exploit the difference in processor cache and memory access time. Cache is a high-speed storage area used to speed up data access. Attackers can manipulate cache behavior to infer the victim's memory access pattern. Common methods include: (1) Flush+Reload: The attacker first clears the cache line corresponding to a specific memory address and then waits for the victim to access that memory address. Afterwards, the attacker re-accesses the same address and measures the access time. If the access time is shorter, it means that the victim has previously loaded that address. In this way, the attacker can infer the victim's operations, such as key input or encryption keys. (2) Prime+Probe: The attacker first fills the cache and then asks the victim to perform a task. Afterwards, the attacker detects which cache lines are replaced and infers the victim's memory access behavior. This method does not require shared memory and is applicable to a wider range of scenarios.

[0008] Finally, interrupt side-channel attacks exploit the characteristics of the system interrupt mechanism. Interrupts are an important mechanism used by operating systems to respond to hardware events and schedule tasks. An attacker can infer the operating status of the system and the victim's activities by monitoring the frequency and timing of interrupts. For example, different computing tasks may trigger different interrupt modes, and an attacker can infer the operations being performed or the data being processed by the victim by analyzing the changes in the interrupt mode.

[0009] These unprivileged side-channel attacks have the following common features: (1) No need for high privileges: attackers can carry out attacks in user space without administrator privileges. (2) Exploiting microarchitectural features: By monitoring the physical or microarchitectural features of the processor, traditional security mechanisms are bypassed. (3) Information leakage risk: The victim’s sensitive information, such as encryption keys, passwords, and user input, can be inferred.

[0010] 2. Non-privileged interrupt observation technology in cloud computing scenarios Under the x86 architecture, non-privileged interrupt side channel observation technology has been widely studied and applied. Attackers can use the architecture timer to detect the occurrence of interrupts. When a process is interrupted, its execution time will show abnormal jumps or delays. By using high-resolution or low-resolution timers, attackers can monitor these time differences and infer information about the interrupt. Among them, the method based on low-resolution timers is particularly useful because it makes it possible to perform interrupt side channel attacks in a browser environment, and attackers can obtain valuable interrupt data even in a restricted execution environment.

[0011] Secondly, attackers can also rely on the unprivileged procfs interface to detect interrupts. For example, in Linux systems, accessing the / proc / interrupts file can obtain interrupt statistics, including the number of occurrences of each type of interrupt. By analyzing these statistics, attackers may infer the operating status of the system, active hardware devices, and potential sensitive activities.

[0012] Finally, some recent research has shown that an attacker can detect interrupt events by observing certain mechanisms on the x86 CPU through unprivileged instructions. For example, using the mwait instruction, a process can enter a low-power wait state and be awakened when an interrupt or a specific event occurs. By measuring the difference in wake-up time, an attacker can infer the occurrence of the interrupt. In addition, using the segment protection mechanism, an attacker can trigger controlled exceptions. When the exception handling flow is affected by the interrupt, the observed behavioral differences can also provide information related to the interrupt.

[0013] In general, non-privileged interrupt side channel observation technology exploits the characteristics of the system interrupt mechanism, allowing attackers to obtain system interrupt information without having to elevate permissions.

[0014] Current research focuses on interrupts related to specific hardware resources, such as keyboard interrupts, GPU interrupts, and network interrupts. These interrupts are characterized by being portable interrupts, that is, they can be bound to a specific CPU core by setting affinity and are related to a device outside the CPU. However, it is still an unsolved problem whether there are exploitable interrupt side channels in more general CPU computing activities that have not been explored. At the same time, there is a lack of an automated method to systematically mine the types of interrupts that are at risk of information leakage, which makes unknown attack paths hidden in a wider system environment.

[0015] Therefore, the problems existing in the prior art need to be further improved and developed. Summary of the invention

[0016] (I) Purpose of the invention: In order to solve the above-mentioned problems existing in the prior art, the purpose of the present invention is to provide a method and system for detecting processor-related interrupt side channels on a cloud platform.

[0017] (II) Technical Solution: In order to solve the above technical problems, this technical solution provides a method for detecting processor-related interrupt side channels on a cloud platform, which specifically includes the following steps: Step 1, obtaining the number of interrupts generated by the computing instruction in different first cycles; Step 2: According to the result of step 1, the correlation between the interruption and the computing instruction is calculated to obtain the interruption that causes the information leakage; Step three: conduct attack experiments on the interruptions that cause information leakage and select the target attack interruptions.

[0018] Among them, in the step one, the number of interrupts generated by the computing instruction in different first cycles is obtained, specifically including switching the CPU state in different first cycles, that is, switching the CPU state between the computing state and the idle state, and obtaining the number of interrupts generated by the computing instruction in different first cycles.

[0019] Among them, in step 2, according to the number of interruptions generated by the computing instruction in different first cycles, the correlation between the interruption and the computing instruction is calculated, and specifically the correlation between the interruption and the computing instruction is calculated using the point-two column correlation.

[0020] Among them, the correlation between the point-two column relationship calculation interrupt and the calculation instruction is specifically including: Step A2, using the pointbiserialr function of the SciPy library to calculate the point biserial correlation coefficient between the calculation instruction and the interruption; Step B2, according to the point-by-point correlation coefficient between the computing instruction and the interruption, confirm the correlation between each interruption and the computing instruction.

[0021] The specific calculation formula of step A2 is: , : Point biserial correlation coefficient; : When the categorical variable is 1, the mean value of the continuous variable; : When the categorical variable is 0, the mean value of the continuous variable; : Standard deviation of continuous variables; : The number of samples where the categorical variable is 1; : The number of samples where the categorical variable is 0; : The total number of samples, that is .

[0022] Among them, when the point-two-column correlation coefficient between the calculation instruction and the interruption is in the first standard, the interruption is an interruption that causes information leakage; the first standard is that the point-two-column correlation coefficient value is close to 1 or -1, and its specific range is greater than 0.8 and less than -0.8.

[0023] Wherein, in said step three, the following steps are specifically included: Step A3, simulating the attacked environment to obtain the target device; Step B3, triggering the operation of the target device and collecting interruption data; Step C3, using the collected interruption data to train a classifier of the target device and identify a model architecture of the target device; Step D3, selecting a target attack interruption based on the accuracy of identifying the target device model architecture.

[0024] Wherein, the step C3 includes using the interruption data to train four classifiers of the target device respectively, and using the trained four classifiers to respectively identify the model architecture of the target device operation.

[0025] Wherein, in step D3, when the accuracy of identifying the target device model architecture is more than 10 times higher than the accuracy of random guessing, the interruption is a target attack interruption, and all target attack interruptions constitute an interruption list.

[0026] A detection system for a processor-related interrupt side channel on a cloud platform, comprising an interrupt monitoring unit, a calculation unit and a verification unit; The interrupt monitoring unit obtains the number of interrupts generated by the computing instruction in different first cycles; the computing unit calculates the correlation between the interrupt and the computing instruction based on the result of the interrupt monitoring unit to obtain the interrupt that causes information leakage; the verification unit performs an attack experiment on the interrupt that causes information leakage and selects the target attack interrupt.

[0027] (III) Beneficial effects: The present invention provides a method and system for detecting processor-related interrupt side channels on a cloud platform. By monitoring the interrupt behavior of the system under different computing tasks, the interrupt types that may cause information leakage are automatically identified, and a list of interrupt types is obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of the steps of a method for detecting a processor-related interrupt side channel on a cloud platform of the present invention; Figure 2 It is a schematic diagram of specific steps of step three in a method for detecting a processor-related interrupt side channel on a cloud platform of the present invention; Figure 3 It is a flowchart of step three in a method for detecting a processor-related interrupt side channel on a cloud platform of the present invention. DETAILED DESCRIPTION

[0029] The present invention is further described in detail below in conjunction with preferred embodiments. More details are elaborated in the following description to facilitate a full understanding of the present invention. However, the present invention can obviously be implemented in a variety of other ways different from the description. Those skilled in the art can make similar generalizations and deductions based on actual application situations without violating the connotation of the present invention. Therefore, the protection scope of the present invention should not be limited by the content of this specific embodiment.

[0030] The accompanying drawings are schematic diagrams of embodiments of the present invention. It should be noted that the drawings are only examples and are not drawn to scale, and should not be used to limit the actual protection scope of the present invention.

[0031] Due to the high priority of interrupts and their close association with user behavior, certain types of interrupts have been abused as a means of side-channel attacks, threatening the confidentiality of the system. Therefore, a method and system for detecting processor-related interrupt side channels on a cloud platform is proposed. A method combined with dynamic analysis can automatically identify the types of interrupts that may cause information leakage in the target system. This is a method and system for detecting processor-related interrupt side channels.

[0032] A method for detecting a processor-related interrupt side channel on a cloud platform is applied to a detection system for a processor-related interrupt side channel on the cloud platform.

[0033] A detection system for processor-related interrupt side channels on a cloud platform includes an interrupt monitoring unit, a calculation unit, and a verification unit. The interrupt monitoring unit obtains the number of interrupts generated by a calculation instruction in different first cycles; the calculation unit calculates the correlation between the interrupt and the calculation instruction based on the result of the interrupt monitoring unit to obtain the interrupt that causes information leakage; the verification unit performs an attack experiment on the interrupt that causes information leakage and selects the target attack interrupt.

[0034] A detection method for processor-related interrupt side channels on a cloud platform, such as Figure 1 As shown, the specific steps include: Step 1, obtaining the number of interrupts generated by the computing instruction in different first cycles; Step 2: According to the result of step 1, the correlation between the interruption and the computing instruction is calculated to obtain the interruption that causes the information leakage; Step three: conduct attack experiments on the interruptions that cause information leakage and select the target attack interruptions.

[0035] In the step one, the number of interrupts generated by the computing instruction in different first cycles is obtained, specifically including switching the CPU state in different first cycles, that is, switching the CPU state between the computing state and the idle state, and obtaining the number of interrupts generated by the computing instruction in different first cycles.

[0036] The first period is greater than or equal to 5 seconds and less than or equal to 20 seconds. When the first period is too long, the whole process is too long. When the first period is too short, the accuracy of the result cannot be guaranteed. Therefore, 10 seconds is taken as an example here. The first period is a preset period and can be modified as needed. The first period uses the architecture-level timer rdtsc to set a fixed period switch.

[0037] When the CPU is switched between the computing state and the idle state, the processor calculation causes the system state to change.

[0038] The states in the state switching include the computing state and the idle state. Specifically, the CPU switches between the computing state and the idle state in different first cycles. When the first cycle is in the computing state, the current first cycle is the computing cycle; when the first cycle is in the idle state, the current first cycle is the idle cycle.

[0039] When the CPU is in the computing state, different computing instructions can be used for computing, and different computing instructions correspond to different processor (CPU) power consumption. The computing instructions include all instructions related to computing, for example, bottom-level assembly instructions, and bottom-level assembly instructions include mov, add, mul, etc.

[0040] The number of interrupts generated by the calculation instruction in different first cycles can be obtained through an interface. For example, the / proc / interrupts interface of the Linux system records the number of interrupts generated in different first cycles, thereby obtaining the number of interrupts generated by the calculation instruction in different first cycles.

[0041] In the step 2, the correlation between the interrupt and the computing instruction is calculated according to the number of interrupts generated in different first cycles of the computing instruction. At this time, the first cycle, i.e., the computing cycle, is taken as 1, and the idle cycle is taken as 0. When the number of interrupts in the computing cycle of the computing instruction is always higher than the idle cycle, the interrupt is related to the current computing instruction.

[0042] In step 2, the correlation between the interrupt and the computing instruction is calculated, that is, the correlation between the number of interrupt triggers and the computing activity of the computing instruction, or the correlation between the number of interrupt triggers and the processor calculation caused by the computing activity of the computing instruction. Specifically, the correlation between each interrupt and the computing instruction can be determined by the point-by-point correlation coefficient. In different first cycles, the computing activity is a binary variable (computation or idle), and the number of interrupts is a continuous variable. The point-by-point correlation coefficient is suitable for evaluating the linear correlation between binary variables and continuous variables. Therefore, the point-by-point correlation coefficient can accurately reflect the correlation between each interrupt and the computing instruction, and can accurately reflect the correlation between the number of interrupt triggers and the processor calculation.

[0043] In the step 2, the correlation between the point-to-point relationship and the calculation instruction is calculated, specifically including: Step A2, use the pointbiserialr function of the SciPy library to calculate the point biserial correlation coefficient between the calculation instruction and the interrupt. The specific calculation formula is as follows: , : Point biserial correlation coefficient; : When the categorical variable is 1, the mean value of the continuous variable; : When the categorical variable is 0, the mean value of the continuous variable; : Standard deviation of continuous variables; : The number of samples where the categorical variable is 1; : The number of samples where the categorical variable is 0; : Total sample size (i.e. ).

[0044] Step B2, according to the point-by-point correlation coefficient between the computing instruction and the interrupt, confirm the correlation between each interrupt and the computing instruction. The closer the point-by-point correlation coefficient value is to 1 or -1, the stronger the correlation between the interrupt and the computing instruction. At this time, the possibility of the interrupt being used for a side channel attack increases. Therefore, when the point-by-point correlation coefficient between the computing instruction and the interrupt is in the first standard, the interrupt is an interrupt that causes information leakage. The first standard is the range where the point-by-point correlation coefficient value is close to 1 or -1, and the specific range is selected here to be greater than 0.8 and less than -0.8 as the range of the first standard.

[0045] In step three, an attack experiment is used to verify the interruption that causes information leakage. The attack experiment uses deep learning model fingerprint recognition and / or covert channels for attack verification. When verifying the interruption that causes information leakage, the attack verification can be performed in the order of the point-to-point correlation coefficient of the interruption from large to small or from small to large, or in other specified orders. There is no specific restriction here. It should be noted that it is necessary to verify the attack for all interruptions whose point-to-point correlation coefficient between the calculation instruction and the interruption is in the first standard, that is, all interruptions that cause information leakage.

[0046] In step three, if Figure 2 , Figure 3 As shown, the specific steps include: Step A3, simulating the attacked environment to obtain the target device; Step B3, triggering the operation of the target device and collecting interruption data; Step C3, using the collected interruption data to train a classifier of the target device and identify a model architecture of the target device; Step D3, selecting a target attack interruption based on the accuracy of identifying the target device model architecture.

[0047] The step A3 is an offline preparation stage, including: collecting a deep neural network (DNN) model on the target device, and building a classifier for model architecture identification based on the interruption trace generated when the deep neural network model is running.

[0048] The target device is used to simulate the operation of the attacked. Since the collected deep neural network models used by the attacker at this stage are unknown, the deep neural network models collected on the target device include all existing deep neural network models. Specifically, they include 36 known deep neural network models. The 36 deep neural network models include 9 model families, such as ResNet, VGG, DenseNet, etc.

[0049] The classifiers include random forest classifier, k nearest neighbor classifier, support vector machine classifier, and logistic regression classifier.

[0050] The step B3 is an online classification stage, which specifically includes running the unknown deep neural network model run by the attacker on the target device, at which time the target device collects interrupt data of the unknown deep neural network model during the reasoning process. The collection of the interrupt data is achieved through the system interface of the target device, such as the / proc / interrupts interface.

[0051] After completing the collection of the interruption data, step B3 further divides the collected interruption data into an interruption training set and an interruption test set.

[0052] In step B3, when dividing the interruption data, the interruption data can be divided into 10 subsets. When training the classifier, 9 of the subsets are used as interruption training sets, and the remaining 1 subset is used as an interruption test set to identify the model architecture of the target device operation.

[0053] The step C3 includes using the interruption data to train four classifiers of the target device respectively, and using the trained four classifiers to respectively identify the model architecture of the target device.

[0054] In step D3, when the accuracy of identifying the target device model architecture is more than 10 times higher than the accuracy of random guessing, specifically when the accuracy is greater than 30%, the interruption is a target attack interruption. All target attack interruptions form an interruption list.

[0055] The interrupt list provided in the thermal event terminal and clock interrupt of the present invention is particularly effective, and is described here by taking an embodiment of the thermal event interrupt as an example.

[0056] When checking the interrupt channel related to the processor, the specific steps are as follows: Use the first cycle 10S as a fixed cycle, use the architecture-level timer rdtsc to set the fixed cycle switching, switch the processor state in different first cycles, and make the CPU switch between the computing state and the idle state to induce CPU state changes, such as: computing state, idle state, computing state, idle state... In this process, the computing state CPU can use different computing instructions, specifically sqrt to solve the square operation of a random number, so that the processor state changes (such as temperature rise). At this time, due to different computing instructions, the computing behavior and the power consumption of the processor are also different. In the idle cycle (marked as 0), sleep is executed on all cores at the same time, so that the CPU is in an idle state (its temperature will gradually decrease).

[0057] For each computing instruction, at the beginning and end of each cycle, the / proc / interrupts interface is used to record the number of interrupts generated in different cycles. During this stage, the CPU switches between high load and idle states to observe the changes in interrupts in different states. The number of interrupts generated is recorded at the beginning and end of each cycle.

[0058] The correlation between the calculation interrupt and the calculation instruction, that is, the correlation between the number of calculation interrupt triggers and the processor state changes caused by the calculation activity of the calculation instruction. Specifically, the correlation between each interrupt and the calculation instruction is determined by the point-by-point correlation coefficient, and the correlation between the number of interrupt triggers and the processor calculation is reflected by the point-by-point correlation coefficient. According to the calculated point-by-point correlation coefficient, the interrupts that are highly correlated with the processor calculation state (that is, the point-by-point correlation coefficient is greater than 0.8 and less than -0.8) are identified. Highly correlated interrupts (interrupts that cause information leakage) may be affected by the processor calculation and there is a risk of being exploited for side channel attacks. Focus on analyzing these interrupts, that is, take the next step for these interrupts to evaluate the degree of information leakage that may be caused.

[0059] Attack experiments using deep learning model fingerprinting and / or covert channels to verify the disruptions that lead to information leakage: Collect deep neural network models on the target device, and build a classifier for model architecture identification based on the interrupt traces generated during the operation of the deep neural network model; run the unknown deep neural network model run by the attacker on the target device, and collect the interrupt data of the running unknown deep neural network model during the reasoning process through the / proc / interrupts interface.

[0060] Using the target device with Intel CPU, we run different deep neural network models alternately, collect relevant interrupt information, use the interrupt information to perform fingerprint recognition tasks, and evaluate the classification effect of interrupts in this task. According to the classification accuracy of fingerprint recognition, we judge the information leakage risk of processor-related interrupts in potential attacks, that is, we get the target attack interrupts, and all the target attack interrupts form an interrupt list.

[0061] The following is a description of a preferred embodiment of step three.

[0062] Use pytorch's torchvision library to deploy 36 deep neural network models to the CPU for inference, using a random image from imagenet as input.

[0063] Control these 36 deep neural network models to continuously reason for 15 seconds, collect the thermal event interruption traces generated during the runtime, and use the collected interruption traces to build a dataset for model architecture identification; The collected interruption trajectories are divided into interruption training set and interruption test set by 10-fold cross validation. The 10-fold cross validation requires ten experiments to be repeated. First, the data set is divided into 10 subsets, and nine subsets are used as interruption training sets for training each time, and the remaining subset is used as interruption test set to avoid randomness caused by data set division.

[0064] The classifiers were trained using the Scipy library, including random forest classifier, k-nearest neighbor classifier, support vector machine classifier, and logistic regression classifier.

[0065] The interrupt data of the interrupt test set is input into the offline trained classifier to analyze and identify the architecture information of the target model. Based on the identification results, the effectiveness and information leakage risk of the processor-related interrupt side channel in actual attacks are evaluated, so as to select the target attack interrupts from the interrupts that cause information leakage. All target attack interrupts constitute the interrupt list.

[0066] When users purchase or assemble a computer based on the x86 architecture, they can use the above method to identify possible interrupt side channel leaks during the initial system construction, so as to decide whether to implement real-time monitoring and early warning measures for high-risk interrupt types, thereby improving the security of the system.

[0067] The present invention identifies potential leakage sources of interrupt side channels related to the processor in the target device, continuously monitors them, obtains the correlation between different computing instructions and interrupts, selects interrupts that cause information leakage, conducts attack experiments, and selects target attack interrupts from the interrupts that cause information leakage.

[0068] In the attack experiment, 36 deep neural network model fingerprint recognition attacks were used as actual attack cases to test the side channel leakage of interrupts that lead to information leakage. In three different test platforms and two independent scenarios, the experiment achieved a success rate of more than 80%, proving the universality of processor-related interrupt side channels in different hardware environments, and also demonstrating its efficiency and potential threats in actual attacks.

[0069] Table 1 shows the correlation between interrupts and CPU calculations detected in the Lenovo Savior R9000 test platform; Table 2 shows the success rate of model fingerprint recognition using thermal event interrupts in the three test platforms.

[0070]

[0071] Table 1

[0072] Table 2 A method and system for detecting processor-related interrupt side channels on a cloud platform is a method and system for detecting processor-related interrupt side channels. Due to the high priority of interrupts and their close association with user behavior, certain types of interrupts have been abused as a means of side channel attacks, threatening the confidentiality of the system. The present invention proposes a method combined with dynamic analysis, which can automatically identify the types of interrupts that may cause information leakage in the target system, and accurately select the target attack interrupts from the interrupts with a high correlation with the computing instructions (i.e., the interrupts that cause information leakage), efficiently obtain the target attack interrupts, and activate the interrupt list at the fastest speed.

[0073] The above content is an explanation of the preferred embodiments of the present invention, which can help those skilled in the art to more fully understand the technical solution of the present invention. However, these embodiments are merely illustrative, and it cannot be determined that the specific implementation methods of the present invention are limited to the description of these embodiments. For ordinary technicians in the technical field to which the present invention belongs, without departing from the concept of the present invention, several simple deductions and transformations can be made, which should be regarded as belonging to the protection scope of the present invention.

Claims

1. A method for detecting processor-related interrupt side channels on a cloud platform, characterized in that: The specific steps include: Step 1, obtaining the number of interrupts generated by the computing instruction in different first cycles; Step 2: According to the result of step 1, the correlation between the interruption and the computing instruction is calculated by using the point-two column correlation coefficient to obtain the interruption that causes information leakage; Step 3: Conduct attack experiments on interrupts that cause information leakage and select target interrupts for attack; The correlation between the interrupt and the calculation instruction is calculated using the point-by-point correlation coefficient, including: Step A2, using the pointbiserialr function of the SciPy library to calculate the point biserial correlation coefficient between the calculation instruction and the interruption; Step B2, according to the point-by-point correlation coefficient between the computing instruction and the interruption, confirm the correlation between each interruption and the computing instruction.

2. According to claim 1, a method for detecting processor-related interrupt side channels on a cloud platform is characterized in that: In the step one, the number of interrupts generated by the computing instruction in different first cycles is obtained, specifically including switching the CPU state in different first cycles, that is, switching the CPU state between the computing state and the idle state, and obtaining the number of interrupts generated by the computing instruction in different first cycles.

3. According to claim 1, a method for detecting processor-related interrupt side channels on a cloud platform is characterized in that: The specific calculation formula of step A2 is: ， : Point-biserial correlation coefficient; : When the categorical variable is 1, the mean value of the continuous variable; : When the categorical variable is 0, the mean value of the continuous variable; : Standard deviation of continuous variables; : The number of samples where the categorical variable is 1; : The number of samples where the categorical variable is 0; : The total number of samples, i.e. .

4. According to claim 1, a method for detecting processor-related interrupt side channels on a cloud platform is characterized in that: When the point-two-column correlation coefficient between the calculation instruction and the interruption is in the first standard, the interruption is an interruption that causes information leakage; the first standard is that the point-two-column correlation coefficient value is close to 1 or -1, and its specific range is greater than 0.8 and less than -0.

8.

5. According to claim 1, a method for detecting processor-related interrupt side channels on a cloud platform is characterized in that: In the step three, the following steps are specifically included: Step A3, simulating the attacked environment to obtain the target device; Step B3, triggering the operation of the target device and collecting interruption data; Step C3, using the collected interruption data to train a classifier of the target device and identify a model architecture of the target device; Step D3, selecting a target attack interruption based on the accuracy of identifying the target device model architecture.

6. According to claim 5, a method for detecting processor-related interrupt side channels on a cloud platform is characterized in that: The step C3 includes using the interruption data to train four classifiers of the target device respectively, and using the trained four classifiers to respectively identify the model architecture of the target device.

7. According to claim 5, a method for detecting processor-related interrupt side channels on a cloud platform is characterized in that: In step D3, when the accuracy of identifying the target device model architecture is more than 10 times higher than the accuracy of random guessing, the interruption is a target attack interruption, and all target attack interruptions constitute an interruption list.

8. A detection system for processor-related interrupt side channels on a cloud platform, characterized in that: It includes an interruption monitoring unit, a calculation unit and a verification unit; The interrupt monitoring unit obtains the number of interrupts generated by the computing instruction in different first cycles; the computing unit calculates the correlation between the interrupt and the computing instruction using the point-by-point correlation coefficient according to the result of the interrupt monitoring unit, and obtains the interrupt that causes information leakage; the verification unit performs an attack experiment on the interrupt that causes information leakage, and selects the target attack interrupt; The calculation unit uses the point-two-column correlation coefficient to calculate the correlation between the interruption and the calculation instruction, specifically including: Step A2, using the pointbiserialr function of the SciPy library to calculate the point biserial correlation coefficient between the calculation instruction and the interruption; Step B2, according to the point-by-point correlation coefficient between the computing instruction and the interruption, confirm the correlation between each interruption and the computing instruction.

Images