Mainstream CPU hidden PMU event search and utilization method based on machine learning

Abstract

The invention provides a mainstream CPU hidden PMU event searching and utilizing method based on machine learning. The method comprises the following steps of: traversing a whole event space, recording event counting change when a CPU executes all effective instructions, searching hidden PMU events, and generating a feature matrix; and then, clustering analysis is performed on the data in combination with a machine learning clustering algorithm, and common characteristics of the hidden events are extracted, so that the number of redundant hidden events is reduced. In the aspect of clustering algorithm selection, due to the fact that hidden PMU feature matrixes of different processors are different, two common algorithms of DBSCAN and K-Means + + are adopted in the method, parameters are adjusted according to specific conditions, and the clustering effect is optimized. And then, through contour coefficient index evaluation, selecting an optimal clustering algorithm to obtain an optimal effect. Finally, in order to further prove the effectiveness of the hidden PMU event, the hidden PMU is used for performing transient attack detection and constructing micro-architecture side channel attack, and the utilization potential and security threat of the hidden PMU event are displayed.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method for searching and utilizing hidden PMU events of mainstream CPUs based on machine learning in the field of processor hardware. Background Art

[0002] Performance Monitoring Unit (PMU) is an important hardware module in modern high-performance processors. The main function of this module is to record various architecture / microarchitecture related events that occur at the CPU level when the system is running. Because it can monitor various CPU events in a fine-grained manner, developers or system researchers can use PMU to collect various CPU activity data when their programs are running, and then use this data to evaluate and optimize their software code. This is the original purpose of PMU design. It is precisely because of the fine-grained monitoring capability of PMU that in addition to performance analysis, PMU is also used to observe invisible microarchitecture states. Some researchers use PMU to reverse engineer microarchitectures, as a fuzz testing oracle, or to detect various microarchitecture attacks. In addition, there are also studies that show that PMU itself may also pose certain security threats, such as inferring encryption keys, building covert channels or side channel attacks, etc.

[0003] Modern CPUs usually have two types of PMUs, one is a Fixed Performance Counter, which is specifically used to record specific performance events. The other is a programmable counter, which is generally composed of a one-to-one Event Select Register and a Performance Counter. Developers can search for the events they want to monitor in the official documentation of the processor vendor, configure the event code in the event select register according to their own needs, and then read the event count from the corresponding performance counter. This process can help developers monitor the performance of the target code, identify performance bottlenecks and optimize.

[0004] Intel's programmable PMU consists of a pair of Model-Specific Registers (MSRs), namely the event selection MSR (IA32_PERFEVTSELx) and the performance counter MSR (IA32_PMCx). The same is true on AMD processors, but the names of the MSRs are slightly different, namely PerfEvtSel <n>and PerfCtr <n>. The layout of their event selection MSR is shown in Figure x. On x86 processors, PMU events are mainly configured through the lower 16 bits of the event selection register. The lower 8 bits determine the basic type of the event, which is called EventSelect (or EventCode). The upper 8 bits are the Unit Mask (UMask) field, which determines the event selection conditions. On ARM processors, event selection is only determined by the evtCount field. In addition, ARM events are not further divided according to event types, but are segmented according to field values, as shown in the following table:

[0005] Table 1 ARMPMUv3 event field allocation

[0006]

[0007] An obvious phenomenon is that the PMU event selection space of these mainstream CPU manufacturers is 2 16 The size of the PMU is very large, but there are only a few hundred PMU events disclosed in its official documents. This means that there may be a large number of hidden events. Previous studies have shown that an average of more than 10,000 hidden PMU events were found on Intel's six different microarchitecture CPUs, but they also said that these hidden events are likely to be repeated because they found that the codes of these hidden events have some repeated patterns. Therefore, based on this problem, we designed a hidden PMU clustering method based on machine learning to extract events with the same characteristics, thereby reducing duplication. Summary of the invention

[0008] The present invention provides a method for searching and utilizing hidden PMU events in mainstream CPUs based on machine learning. The method can automatically, efficiently, reliably and stably locate hidden PMU events in mainstream CPUs. The overall architecture of the method is shown in the figure below: Figure 1 shown.

[0009] The present invention provides two functional modules and two utilization methods, including a hidden event collection module and a hidden event clustering module, as well as a transient execution detection method and a side channel attack method based on hidden PMU, to realize automatic mainstream processor hidden PMU search and utilization technical solutions:

[0010] An automated hidden PMU search method that supports x86 and ARMv8 architectures. According to the above analysis, the PMU selection space in current mainstream processors is mostly 2 16 Therefore, the present invention searches for possible hidden PMU events by traversing the entire event space. Considering that PMU events reflect processor behavior, and processor behavior is closely related to the instructions it executes, the present invention triggers potential PMU events as much as possible by executing all valid instructions. The entire event collection process is divided into the following three steps:

[0011] Instruction set preprocessing: First, adapt the instruction set from the open source database (such as uops.info, ASMJIT), adjust its assembly syntax to conform to the format of GCC inline assembly, especially the differences in operand order and register representation. At the same time, limit the use range of registers to better fill the operands. In addition, for branch instructions, its target address needs to be adjusted to a legal location to prevent jumping to an illegal location or falling into an infinite loop when executing the traversal program.

[0012] Instruction set traversal: When performing instruction set traversal, the first thing to pay attention to is the different instruction set extensions. Since different types of CPUs have different support capabilities for instruction set extensions, the instruction set extensions should be adjusted accordingly according to the support of the target CPU during the traversal process. In addition, due to the large number of instructions and the inability to accurately predict the specific behavior of each instruction, various potential exceptions that may occur during the execution process must be handled. On the Intel platform, an effective way to handle exceptions is to use Intel Transactional Synchronization Extensions (TSX). However, many new Intel processors no longer support TSX. In addition, similar extensions are also lacking on ARM and AMD platforms. Therefore, we bind all exception signals to exception handlers to prevent the program from crashing.

[0013] Event differential analysis: By collecting the count changes in the entire PMU event space before and after each instruction is executed, differential analysis is performed, and events that can read count changes are defined as potential PMU events. These events and their counts in the entire instruction space will be used as features for further clustering analysis in the next module.

[0014] A mainstream CPU hidden event clustering method based on machine learning. The present invention uses the counts of potential PMUs obtained by the above method when all valid instructions are executed as a feature matrix to perform clustering experiments to remove redundant PMU events. The present invention mainly includes two steps: data dimensionality reduction and event clustering.

[0015] Data dimensionality reduction: First, the high-dimensional feature matrix obtained by executing an effective instruction set is subjected to dimensionality reduction processing to reduce the data dimension and retain key features. The present invention uses a variety of dimensionality reduction methods for comparison, and finally selects the t-SNE algorithm for data dimensionality reduction. t-SNE can retain the local structure of the original data as much as possible while reducing the dimensionality, effectively improving the accuracy of subsequent clustering. Figure 2 The results of using the PCA dimensionality reduction algorithm (left) and the t-SNE dimensionality reduction algorithm (right) on ARM Cortex A76 are shown. It can be seen that the t-SNE algorithm better retains the characteristics of high-dimensional data and the differences between data.

[0016] Event clustering: The data after dimensionality reduction is input into the clustering algorithm for event clustering. In order to improve the clustering effect, the present invention adopts two classic clustering algorithms: DBSCAN and K-Means++. DBSCAN does not need to pre-specify the number of clusters, can find clusters of any shape, and can identify noise points in the data. K-Means++ improves clustering efficiency by optimizing the initial cluster center selection. The clustering results are evaluated by the silhouette coefficient. The present invention uses the silhouette coefficient as feedback, gradually adjusts the algorithm parameters, and searches for the best parameter combination within the preset parameter range. Finally, based on the silhouette coefficient performance of the two algorithms under the optimal parameters, the clustering result with better effect is selected as the final output.

[0017] On x86 machines, the CPU selects events through EventCode and UMask, where EventCode determines the approximate category of the event. In fact, this is equivalent to having completed a clustering. Therefore, first divide the events into subsets with the same EventCode field, and then perform clustering experiments on the event subsets. This can avoid interference between different types of events, making the clustering results more accurate and greatly speeding up the clustering process. The hidden event clustering results on some x86 machines are shown in Figure 3 In the figure, the upper figure is the clustering result of K-Means++, and the lower figure is the clustering result of DBSCAN algorithm.

[0018] On ARM machines, as mentioned in the previous background section, ARM event selection is only divided according to field values, so we can only perform a unified clustering experiment on all potential PMU events. Some clustering results are also shown in Figure 4 In the figure, the upper figure is the clustering result on Cortex-A72, and the lower figure is the clustering result on Cortex-A76.

[0019] The following table shows the experimental results of hidden PMU collection and clustering on x86 and ARM machines. The total number of instructions for x86 is 5492, and the number of instructions for ARM is 1049. The size of the entire event selection space is 2 16 , that is 65536.

[0020] Table 2 Results of hidden PMU collection and clustering experiments on x86 and ARM machines

[0021]

[0022] A transient execution attack detection method based on hidden PMU. This method uses the hidden PMU events collected by the above method to detect the existing six transient execution attacks and their variants. The specific implementation includes the following steps:

[0023] Data collection: For each hidden event, the present invention collects counts in three system states: CLEAN, NO-ATTACK, ATTACK. The CLEAN state is a pure environment in which only the victim process is running to simulate an environment where there is no malicious attack. For data collection in the ATTACK environment, we run various transient execution attacks on different logical cores of the same physical core as the victim process, and the monitor runs on the same logical core as the attacker. The data collection transient execution attack in each state is independent. Finally, in order to enhance the ability to distinguish false positives (FP), it is necessary to collect data in the NO-ATTACK environment. In this setting, the attack primitives of the attacker process are disabled while keeping the rest of the code unchanged. Collect data under the same settings as the attack environment. In addition, this method also simulates real-world scenarios by browsing websites and reading and writing text files. In addition, to ensure the robustness of the detection model, the present invention uses the following load programs to add system stress: (1) a memory-intensive load that runs memcpy (using memcpy to copy 2MB of data from the shared area to the buffer, and then using memmove to move the data in the buffer), (2) a CPU-intensive load that runs complex floating-point operations in a loop. These additional data help improve the accuracy and reliability of the detection model.

[0024] Data processing and model training: Considering that the task of this method involves detecting transient execution attacks using a large number of hidden PMU events, we chose the logistic regression algorithm because of its relatively short training time. Then, data labeling is performed. The PMU count changes collected in the ATTACK environment are assigned the label 1, indicating that an attack has occurred. In contrast, the data collected in other environments are labeled 0, indicating that there is no attack. Each type of attack is recorded separately, and the data is collected in multiple independent runs. To ensure fairness and reduce bias, we maintain the same number (2000) of samples for attack and non-attack categories. Afterwards, the collected dataset is divided into training data (70% of the samples) and test data (30% of the samples). The training data is used to train the logistic regression model, while the test data is used to evaluate the performance of the model. By analyzing the performance of the model on the test data, we can evaluate the effectiveness of hidden PMU in detecting transient execution attacks.

[0025] The following table shows the effect of using hidden PMU based transient execution attack detection on Intel Core i7-6700, and also shows the performance of the model in Figure 5 In the figure, from left to right are the detection model evaluation results of Meltdown, Spectre-v1, Spectre-v2, Spectre-v4, Zombieload-v1, and Zombieload-v2.

[0026] Table 3 Results of Hidden PMU Detection Transient Execution Attack on Intel Core i7-6700

[0027]

[0028] A side channel attack method based on hidden PMU. This method uses the hidden PMU events collected by the above method to construct a side channel attack through two coding primitives to recover the data leaked by the transient execution attack. The invention mainly includes the following contents:

[0029] The present invention provides two encoding primitives for encoding private data leaked by transient execution to the sending end of the side channel. The first is a hidden PMU-Cache side channel attack method. The basic principle of this method is similar to the FLUSH+RELOAD side channel attack. The difference is that this method uses hidden PMU events related to cache hits to infer data instead of time. The pseudo code implementation is as follows: Figure 6 The other is a hidden PMU side channel attack. This method constructs different control flows based on the data leaked by the transient execution attack, thereby causing PMU count differences through the differences in the execution instructions on the two control flows, and thus inferring the leaked data value. Its specific pseudo code implementation is as follows Figure 7 ,In theory, all instructions that can trigger hidden PMU counting and their corresponding hidden PMU event combinations can be used as the side channel.

[0030] The following table shows the attack effects of four transient execution attacks using two hidden PMU side-channel attack methods, a total of eight attack variants, on the Intel Core i7-6700.

[0031]

[0032] The present invention uses throughput and accuracy to evaluate the effect of side channel attacks, which are the two most important indicators. Throughput is mainly affected by the execution time of the attack primitive, the number of iterations, the exception handling time or the PMU reading time. The attack primitive execution time and the PMU reading time are fixed. The present invention uses the Intel TSX extension for exception handling, which can quickly suppress exceptions, nearly 10 times faster than using the Linux exception signal function. The remaining main factor is the number of iterations per round of attack, and side channel attacks usually require multiple iterations to improve accuracy. There is usually an inverse relationship between these two indicators. Therefore, the present invention does not consider throughput first, but only considers accuracy. Improve accuracy by iterating as much as possible to find PMU events that can be used to build a side channel. Then use these events to gradually reduce the number of iterations to improve throughput, while ensuring that the accuracy is within an acceptable range. The results are shown in the following figure. Figure 8 middle. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some example drawings of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 Flowchart of the method for searching and exploiting hidden PMU events for mainstream CPUs based on machine learning

[0035] Figure 2 This is a comparison chart of the PCA dimensionality reduction algorithm and the t-SNE dimensionality reduction algorithm results on ARM Cortex A76;

[0036] Figure 3 This is a partial clustering result on an x86 machine;

[0037] Figure 4 This is a partial clustering result on an ARM machine;

[0038] Figure 5 Evaluation results of a transient execution attack detection model based on hidden PMU on Intel Core i7-6700 machines;

[0039] Figure 6 Pseudocode representation for encoding private data into hidden PMU-Cache side channel;

[0040] Figure 7 Pseudocode representation for encoding private data into a hidden PMU side channel;

[0041] Figure 8 The side channel attack results based on hidden PMU; DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Figure 2 The results of using the PCA dimensionality reduction algorithm (left figure) and the t-SNE dimensionality reduction algorithm (right figure) to reduce the feature dimensionality of the hidden PMU feature matrix on ARM Cortex A76 are compared. It is obvious that the PCA dimensionality reduction algorithm compresses the high-dimensional data features, resulting in the loss of differences between the data, while the t-SNE dimensionality reduction algorithm better retains the high-dimensional data features. Therefore, the present invention selects the t-SNE algorithm to ensure that the original features of the data are retained to the maximum extent during the dimensionality reduction process.

[0044] Figure 3 The clustering results of some hidden PMU events on the x86 machine are shown. The upper figure is the clustering result of K-Means++, and the lower figure is the clustering result of the DBSCAN algorithm. It can be seen from the figure that both the DBSCAN and K-Means++ algorithms can effectively divide different hidden PMU events into multiple categories, and the events in each cluster show similar characteristics. By analyzing these clustering results, we can further verify the correlation between hidden events and infer the potential physical implementation mechanism of different PMU events based on these clustering characteristics.

[0045] Figure 4 The clustering results of hidden PMU events on ARM machines are shown. The upper figure is the clustering result on Cortex-A72, and the lower figure is the clustering result on Cortex-A76. Unlike x86, the performance of the DBSCAN algorithm on ARM machines is far worse than K-Means++, so only the K-Means++ algorithm is used on ARM machines, which also successfully divides the hidden PMU events into multiple clusters.

[0046] Figure 5 The results of transient execution attack on hidden PMU detection on Intel Core i7-6700 machine are shown. From left to right, they are the evaluation results of the detection models of Meltdown, Spectre-v1, Spectre-v2, Spectre-v4, Zombieload-v1, and Zombieload-v2. The closer the FNR and FPR indicators are to 0, the better the model detection effect is, and the closer the Accuracy and F1-Score are to 1, the better the model detection effect is.

[0047] Figure 6 and Figure 7 Two methods of encoding private data into the side channel are shown separately. Figure 6 The pseudocode shown encodes data by replacing the RELOAD step in the FLUSH+RELOAD side channel attack, that is, directly reading the cache-related hidden event count instead of reading the time to determine the cache hit situation. Figure 7 By performing a transient comparison between the controllable variable V and the private data, two different control flows are created. When the private data is equal to V, ins1 is executed, otherwise it is not executed. This causes the hidden PMU event count associated with ins1 to be triggered, so that the PMU count value can be used to infer whether the private data is equal to the controllable variable V.

[0048] Figure 8 The results of using PMU side channel attacks on Intel Core i7-6700 are shown. From left to right, they are the relationship between attack throughput and success rate of Meltdown-PMU, Spectre-v2-PMU, Zombieload-PMU, Foreshadow-PMU, Meltdown-PMU-Cache, Spectre-v2-PMU-Cache, Zombieload-PMU-Cache, and Foreshadow-PMU-Cache. Hidden PMU events with an accuracy greater than 90% are obtained by continuously increasing the number of iterations. At the same time, as the number of iterations of each round of attack increases, the throughput will gradually decrease.

[0049] Those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.< / n> < / n>

Claims

1. An automated hidden PMU search method supporting x86 and ARMv8 architectures, characterized in that: By traversing all PMU event spaces supported by the processor and combining the PMU event count changes when the processor executes all valid instructions, the PMU events whose count changes can be read are automatically searched. The content of this method includes: The present invention completes the collection and processing of existing x86 and ARMv8 instruction sets based on two open source data sets, namely uops.info and ASMJIT. It mainly includes the adjustment of the instruction format, operand filling, jump instruction processing, and the use of exception signal processing functions to handle exceptions that may occur during instruction traversal. In addition, the present invention defines hidden PMU events as events that are not recorded in official documents but can be configured according to normal processes, and whose counts change with the execution of instructions. Hidden PMU events that meet this definition are located by recording the count changes of the entire PMU event space when the CPU executes the valid instructions completed by the aforementioned processing.

2. A mainstream CPU hidden event clustering method based on machine learning. It is characterized in that By using the event count changes recorded in the method of claim 1 when the CPU executes all valid instructions as a feature matrix, the common features of hidden events are extracted, thereby reducing the number of redundant hidden events. The content of the method includes: The present invention uses the count of hidden PMU execution in each valid instruction in the method described in claim 2 as the feature of hidden PMU events, extracts common features between events through a clustering algorithm, and regards events with similar feature vectors as the same category, thereby removing redundant hidden PMU events. The present invention attempts to use data dimension reduction counting to reduce the dimension of high-dimensional features. After multiple comparisons, it is found that the t-Distributed Stochastic Neighbor Embedding (t-SNE) algorithm can better retain the differences in data. Therefore, the present invention chooses to use the t-SNE algorithm to reduce the feature dimension. In addition, the present invention considers the two most common clustering algorithms, namely Density-Based Spatial Clustering of Applications with Noise (DBSCAN) and K-Means++ algorithm. The optimal parameters are searched by comparing the silhouette coefficients of their clustering results, and then the optimal clustering algorithm is selected to complete the clustering.

3. A transient execution attack detection method based on hidden PMU events. It is characterized in that The method of claim 2 is used to obtain hidden PMU events after removing redundant results to detect transient execution attacks. The method includes: The present invention uses the hidden PMU events obtained in the aforementioned claim 2 to detect transient execution attacks. The present invention considers three typical transient execution attacks, including Meltdown, Spectre, Zombieload, and their variants, a total of six types of transient execution attacks. The present invention checks each hidden PMU event and monitors its relationship with the transient execution attack. For each attack, we collect the count changes of each PMU event in the CLEAN, NO-ATTACK, and ATTACK states. The classifier is trained offline using a machine learning (ML) algorithm, and then the model training results are analyzed. This can evaluate whether specific hidden PMU events can be effectively used to detect specific transient execution attacks. At the same time, in order to ensure the robustness of the detection model, the present invention considers the performance of the model under different loads, including CPU-intensive loads and memory-intensive loads.

4. A side channel attack method based on hidden PMU events. Characterized by: Using the hidden PMU events obtained by the method of claim 2 after removing redundant results, a side channel is constructed to leak data leaked by transient execution attacks. The content of the method includes: The present invention proposes two methods for encoding side channel data using hidden PMU events. The first method constructs a side channel through hidden PMU events related to cache hits or misses. The basic principle is to use hidden PMU events to replace the access time-based cache hit measurement method commonly used in transient execution attacks, and directly read the hidden PMU events related to the cache state, thereby constructing a PMU-Cache side channel. The second method is more general and is not limited to hidden PMU events related to cache. This method constructs different control flows based on the data leaked by the transient execution attack, and triggers different counts by executing different instructions, thereby constructing a PMU side channel attack. The events applicable to this method are directly related to the instructions that trigger the count difference. In theory, all instructions that can trigger the hidden PMU count and their corresponding hidden PMU event combinations can be used as this side channel.

Images