A mainstream CPU hidden PMU event search and utilization method based on machine learning

Abstract

The application provides a mainstream CPU hidden PMU event search and utilization method based on machine learning. By traversing the entire event space, recording the event count changes of the CPU when executing all valid instructions, searching for hidden PMU events, and generating a feature matrix. Then, combined with the machine learning clustering algorithm, the data is clustered and analyzed to extract the common features of the hidden events, thereby reducing the number of redundant hidden events. In the selection of clustering algorithm, due to the differences in the hidden PMU feature matrix of different processors, the method adopts two commonly used algorithms of DBSCAN and K-Means++, and adjusts the parameters according to the specific situation to optimize the clustering effect. Then, through the evaluation of the contour coefficient index, the optimal clustering algorithm is selected to obtain the best effect. Finally, in order to further prove the effectiveness of the hidden PMU event, the application uses the hidden PMU to perform transient execution attack detection and construct a micro-architecture side channel attack, which shows the utilization potential and security threat of the hidden PMU event.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer, especially to the method of mainstream CPU hiding PMU event search and utilization based on machine learning in the field of processor hardware. BACKGROUND

[0002] Performance Monitoring Unit (PMU) is an important hardware module in modern high-performance processors. The main function of this module is to record various architecture / micro-architecture related events that occur at the CPU level when the system is running. Because it can monitor various CPU events in detail, developers or system researchers can use PMU to collect various CPU activity data during the running of their programs, and then use these data to evaluate and optimize their software code. This is the original purpose of the design of PMU. Due to the fine-grained monitoring capability of PMU, in addition to being used for performance analysis, PMU is also used to observe the invisible micro-architecture state. Researchers have used PMU to reverse engineer micro-architecture, as a fuzzing oracle, or to detect various micro-architecture attacks. In addition, there are also studies showing that PMU itself may also pose some security threats, such as inferring encryption keys, building covert channels or side-channel attacks, etc.

[0003] Modern CPUs usually have two types of PMU, one is Fixed Performance Counter, which is used to record specific performance events. The other is programmable counter, which is generally composed of a set of one-to-one Event Select Register and Performance Counter. Developers can search for the required monitored events in the official documents of the processor vendor, configure the event code in the event selection register according to their own needs, and then read the event count from the corresponding performance counter. This process can help developers monitor the performance of the target code, identify performance bottlenecks and optimize them.

[0004] Intel's programmable PMU is composed of a pair of Model-Specific Registers (MSRs), namely event selection MSR (IA32_PERFEVTSELx) and performance count MSR (IA32_PMCx). The same is true on AMD processors, except that the names of the MSRs are slightly different, namely PerfEvtSel0 <n>and PerfCtr <n>Their event selection MSR layout is shown in Figure x. On x86 processors, PMU events are configured mainly through the low 16 bits of the event selection register. The low 8 bits determine the basic type of the event, becoming EventSelect (or EventCode). The high 8 bits are the Unit Mask (UMask) field, which determines the selection condition of the event. On ARM processors, the selection of events is determined only by the evtCount field. Moreover, ARM events are not further divided according to event types, but are segmented according to field values, as shown in the following table:

[0005] Table 1: ARM PMUv3 event field allocation

[0006]

[0007] One obvious phenomenon is that the PMU event selection space of these mainstream CPU manufacturers is 2 16 , but the PMU events disclosed in their official documents are only a few hundred. This means that there may be a large number of hidden events. Previous studies have shown that more than 10,000 hidden PMU events were found on six different micro-architecture CPUs of Intel, but they also indicated that these hidden events are likely to be repeated because they found that the code of these hidden events has some repeated patterns. Therefore, we designed a machine learning-based hidden PMU clustering method to extract events with the same characteristics, thereby reducing duplication. SUMMARY

[0008] The present application provides a machine learning-based mainstream CPU hidden PMU event search and utilization method, which can automatically, efficiently, reliably and stably locate the hidden PMU events in mainstream CPUs. The overall architecture diagram of the method is shown in Figure 1 .

[0009] The present application provides two functional modules and two utilization methods, including a hidden event collection module and a hidden event clustering module, as well as a hidden PMU-based transient execution detection method and a side channel attack method, to realize an automatic mainstream processor hidden PMU search and utilization technical solution:

[0010] An automated hidden PMU search method supporting x86 and ARMv8 architectures. According to the foregoing analysis, the PMU selection space of the current mainstream processor is mostly 2 16 Therefore, the present application searches for possible hidden PMU events by traversing the entire event space. Considering that the PMU event reaction processor behavior is closely related to the instructions it executes, the present application triggers potential PMU events as much as possible by executing all valid instructions. The entire event collection process is divided into the following three steps:

[0011] Instruction set preprocessing: First, the instruction set from the open source database (such as uops.info, ASMJIT) is adapted, adjusting its assembly syntax to conform to the format of GCC inline assembly, especially the differences in operand order and register representation. At the same time, the use of registers is limited to better fill the operands. In addition, for branch instructions, their target addresses need to be adjusted to legal positions to prevent jumping to illegal positions or falling into a dead loop when executing the traversal program.

[0012] Instruction set traversal: When performing instruction set traversal, attention should first be paid to different instruction set extensions. Since different types of CPUs have different support capabilities for instruction set extensions, the instruction set extensions should be adjusted accordingly during the traversal process according to the support capabilities of the target CPU. In addition, due to the large number of instructions and the inability to accurately predict the specific behavior of each instruction, various potential exceptions that may occur during execution must be handled. On the Intel platform, an effective way to handle exceptions is to use Intel Transactional Synchronization Extensions (TSX). However, many new Intel processors no longer support TSX. In addition, ARM and AMD platforms also lack similar extensions. Therefore, we bind all exception signals to an exception handler to prevent program crashes.

[0013] Event differential analysis: By collecting the count changes in the entire PMU event space before and after the execution of each instruction, differential analysis can be performed, and events that can read count changes are defined as potential PMU events. For these events, their counts in the entire instruction space will be used as features for further clustering analysis in the next module.

[0014] A mainstream CPU hidden event clustering method based on machine learning. The present application clusters the count of potential PMU events obtained by executing all valid instructions as a feature matrix to remove redundant PMU events. The present application mainly includes two steps: data dimensionality reduction and event clustering.

[0015] Data dimensionality reduction: First, the high-dimensional feature matrix obtained by executing the valid instruction set is processed to reduce the data dimension and retain key features. The present application uses multiple dimensionality reduction methods for comparison, and finally selects the t-SNE algorithm for data dimensionality reduction. t-SNE can preserve the local structure of the original data as much as possible while reducing the dimension, effectively improving the accuracy of subsequent clustering. Figure 2 The results of using PCA dimension reduction algorithm (left) and t-SNE dimension reduction algorithm (right) on ARM Cortex A76 are shown, and it can be seen that the t-SNE algorithm better preserves the characteristics of high-dimensional data and the difference between data.

[0016] Event clustering: The data after dimension reduction is input into the clustering algorithm for event clustering. To improve the clustering effect, the application adopts two classical clustering algorithms: DBSCAN and K-Means++. DBSCAN does not need to specify the number of clusters in advance, can discover clusters of any shape, and can identify noise points in the data. K-Means++ improves clustering efficiency by optimizing initial cluster center selection. The clustering results are evaluated by the silhouette coefficient, and the application uses the silhouette coefficient as feedback to gradually adjust the algorithm parameters and search for the best parameter combination within the preset parameter range. Finally, based on the silhouette coefficient performance of the two algorithms under the best parameters, the clustering result with better effect is selected as the final output.

[0017] On an x86 machine, the CPU selects events through EventCode and UMask, where EventCode determines the approximate category of the event, which is equivalent to having completed a clustering. Therefore, the events are first divided into subsets with the same EventCode field, and then clustering experiments are performed in the event subsets. This can avoid interference between different types of events, making the clustering result more accurate and greatly speeding up the clustering process. The clustering results of some hidden events on an x86 machine are shown in Figure 3 , where the upper graph is the clustering result of K-Means++, and the lower graph is the clustering result of the DBSCAN algorithm.

[0018] On an ARM machine, according to the background section described above, ARM event selection is only divided according to the field value, so only unified clustering experiments can be performed on all potential PMU events. Similarly, some clustering results are shown in Figure 4 , where the upper graph is the clustering result on Cortex-A72, and the lower graph is the clustering result on Cortex-A76.

[0019] The following table shows the experimental results of hidden PMU collection and clustering on x86 and ARM machines. Among them, the total number of instructions on x86 is 5492, and the number of ARM instructions is 1049. The size of the entire event selection space is 2 16 , i.e. 65536.

[0020] Table 2: x86 and ARM machine hidden PMU collection and clustering experiment results

[0021]

[0022] A method for detecting transient execution attacks based on hidden PMU. This method uses the hidden PMU events collected by the aforementioned method to detect the existing six types of transient execution attacks and their variants. The specific implementation includes the following steps:

[0023] Data collection: For each hidden event, the invention collects three types of system state counts: CLEAN, NO-ATTACK, and ATTACK. The CLEAN state is a pure environment where only the victim process is running to simulate an environment without malicious attacks. For data collection in the ATTACK environment, we run various transient execution attacks on different logical cores of the same physical core as the victim process, and monitor the program running on the same logical core as the attacker. Each state data collection transient execution attack is independent. Finally, in order to enhance the ability to distinguish false positives (False Positive, FP), data needs to be collected in the NO-ATTACK environment. In this setting, the attacker's process attack primitives are disabled while the rest of the code remains unchanged. Data is collected in the same setting as the attack environment. In addition, this method also simulates real-world scenarios by browsing websites and reading and writing text files. In addition, in order to ensure the robustness of the detection model, the invention uses the following load programs to add system pressure: (1) memory-intensive load running memcpy (using memcpy to copy 2MB of data from a shared region to a buffer, then using memmove to move data in the buffer), (2) CPU-intensive load running complex floating-point operations in a loop. These additional data help improve the accuracy and reliability of the detection model.

[0024] Data processing and model training: Considering that the task of this method involves detecting transient execution attacks using a large number of hidden PMU events, we chose the logistic regression algorithm because of its relatively short training time. Then, data labeling is performed. The PMU count changes collected in the ATTACK environment are assigned a label of 1, indicating that an attack has occurred. Conversely, data collected in other environments is labeled 0, indicating no attack. Each type of attack is recorded separately, and data is collected in multiple independent runs. To ensure fairness and reduce bias, we maintained the same number (2000) of samples for the attack and non-attack categories. After that, the collected data set is divided into training data (70% of the samples) and test data (30% of the samples). Training data is used to train the logistic regression model, while test data is used to evaluate the performance of the model. By analyzing the performance of the model on the test data, we can evaluate the effectiveness of hidden PMU in detecting transient execution attacks.

[0025] The following table shows the effect of using hidden PMU-based detection transient execution attacks on Intel Core i7-6700, while the model performance is shown in Figure 5 From left to right, the evaluation results of the detection model of Meltdown, Spectre-v1, Spectre-v2, Spectre-v4, Zombieload-v1 and Zombieload-v2 are shown.

[0026] Table 3 shows the results of hidden PMU detection transient execution attacks on Intel Core i7-6700

[0027]

[0028] A hidden PMU-based side channel attack method. This method uses the hidden PMU events collected by the aforementioned method to construct a side channel attack to recover the data leaked by the transient execution attack. The invention mainly includes the following contents:

[0029] The present application provides two encoding primitives for encoding the private data leaked by the transient execution attack to the sending end of the side channel. The first is a hidden PMU-cache side channel attack method. The basic principle of this method is similar to the FLUSH+RELOAD side channel attack. The difference is that this method uses hidden PMU events related to Cache hit to infer data, not time, and the pseudo code implementation is as follows Figure 6 The other is a hidden PMU side channel attack. This method constructs different control flows according to the data leaked by the transient execution attack, so that the difference in PMU count is caused by the difference in the execution of instructions on the two control flows, and the leaked data value is inferred. The specific pseudo code implementation is as follows Figure 7 In theory, all instructions that can trigger hidden PMU count and their corresponding hidden PMU event combinations can be used as this side channel.

[0030] The following table shows the attack effect of four transient execution attacks, a total of eight attack variants, on Intel Core i7-6700 using two hidden PMU side channel attack methods.

[0031]

[0032] This invention uses throughput and accuracy to evaluate the effectiveness of side-channel attacks, which are the two most important metrics. Throughput is mainly affected by the execution time of the attack primitives, the number of iterations, anomaly handling time, or PMU read time. The execution time of the attack primitives and the PMU read time are fixed. This invention uses the Intel TSX extension for anomaly handling, which can quickly suppress anomalies, nearly 10 times faster than using Linux anomaly signals. The remaining major factor is the number of iterations per attack round, and side-channel attacks typically require multiple iterations to improve accuracy; these two metrics are usually inversely related. Therefore, this invention does not consider throughput initially, but only accuracy. Accuracy is improved by iterating as many times as possible to identify PMU events that can be used to construct the side channel. Then, these events are used to gradually reduce the number of iterations to improve throughput while ensuring that accuracy remains within an acceptable range. The results are presented in [the following text is missing from the original extract]. Figure 8 middle. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some examples of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0034] Figure 1 Flowchart of mainstream CPU hidden PMU event search and exploitation method based on machine learning

[0035] Figure 2 A comparison chart of the results of PCA dimensionality reduction algorithm and t-SNE dimensionality reduction algorithm on ARM Cortex A76;

[0036] Figure 3 This represents partial clustering results on an x86 machine;

[0037] Figure 4 This represents partial clustering results on an ARM machine;

[0038] Figure 5 Evaluation results of a transient execution attack detection model based on a hidden PMU on an Intel Core i7-6700 machine;

[0039] Figure 6 This is a pseudocode representation for encoding private data into a hidden PMU-Cache side channel;

[0040] Figure 7 This is a pseudocode representation for encoding private data into a hidden PMU side channel;

[0041] Figure 8 to the results of the side-channel attack based on the hidden PMU; DETAILED DESCRIPTION

[0042] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0043] Figure 2 The results after feature dimension reduction of the hidden PMU feature matrix of ARM Cortex A76 using PCA dimension reduction algorithm (left) and t-SNE dimension reduction algorithm (right) respectively are shown. It is obvious that the PCA dimension reduction algorithm compresses the high-dimensional data features, resulting in the loss of the difference between the data, while the t-SNE dimension reduction algorithm better preserves the high-dimensional data features, so the present application selects the t-SNE algorithm to ensure that the original features of the data are preserved to the maximum extent during the dimension reduction process.

[0044] Figure 3 The clustering results of part of the hidden PMU events on the x86 machine are shown. The upper graph is the clustering result of K-Means++, and the lower graph is the clustering result of DBSCAN algorithm. As can be seen from the graph, whether it is DBSCAN or K-Means++ algorithm, different hidden PMU events can be effectively divided into multiple categories, and the events in each cluster show similar features. Through the analysis of these clustering results, we can further verify the correlation between the hidden events, and according to these clustering characteristics, infer the potential physical implementation mechanism of different PMU events.

[0045] Figure 4 The clustering results of hidden PMU events on ARM machines are shown. The upper graph is the clustering result on Cortex-A72, and the lower graph is the clustering result on Cortex-A76. Unlike x86, DBSCAN algorithm performs much worse on ARM machines than K-Means++, so only K-Means++ algorithm is used on ARM machines, which also successfully divides the hidden PMU events into multiple clusters.

[0046] Figure 5 The results of the hidden PMU detection transient execution attack on an Intel Core i7-6700 machine are shown. From left to right, the detection model evaluation results of Meltdown, Spectre-vl, Spectre-v2, Spectre-v4, Zombieload-vl, and Zombieload-v2 are shown. The closer the FNR and FPR indicators are to 0, the better the model detection effect, and the closer the Accuracy and F1-Score are to 1, the better the model detection effect.

[0047] Figure 6 and Figure 7 Two ways of encoding private data into side channels are shown. Figure 6 The pseudo code shown encodes data by replacing the RELOAD step in the FLUSH+RELOAD side channel attack, i.e., directly reading the Cache-related hidden event count instead of reading the time to determine the Cache hit situation. Figure 7 By controlling the variable V and performing a transient comparison with the private data, two different control flows are created. If the private data is equal to V, insl is executed, otherwise it is not executed. This causes the hidden PMU event count related to insl to be triggered, so that according to the PMU count value, it can be inferred whether the private data is equal to the controllable variable V.

[0048] Figure 8 The results of the PMU side channel attack on an Intel Core i7-6700 are shown. From left to right, the relationship between the attack throughput and success rate of Meltdown-PMU, Spectre-v2-PMU, Zombieload-PMU, Foreshadow-PMU, Meltdown-PMU-Cache, Spectre-v2-PMU-Cache, Zombieload-PMU-Cache, and Foreshadow-PMU-Cache is shown. By continuously increasing the number of iterations, the hidden PMU event with an accuracy greater than 90% is obtained. At the same time, as the number of attack iterations increases in each round, the throughput gradually decreases.

[0049] Various modifications and changes can be made to the present application by those of ordinary skill in the art without departing from the spirit and scope of the application. Accordingly, it is intended that all such modifications and changes be included within the scope of the application as claimed.< / n> < / n>

Claims

1. An automated hidden PMU search method supporting x86 and ARMv8 architectures, characterized in that, The method includes the following steps: automatically searching for PMU events that can read the count change by traversing all PMU event spaces supported by the processor and combining the PMU event count change when the processor executes all valid instructions, the content of the method including: The instruction set preprocessing is performed to adapt the instruction set from the open source database, adjust the assembly syntax to conform to the format of the inline assembly, limit the use range of the registers to fill the operands, and adjust the target address of the branch instruction to a legal position; the instruction set traversal is performed to make corresponding adjustments to the instruction set extension according to the support condition of the target central processing unit (CPU), and use an exception signal processing function to process the exception that may be generated during the instruction traversal, thereby completing the execution of all valid instructions; the event difference analysis and positioning is performed to record the count change of the entire PMU event space before and after the CPU executes the valid instructions, and define the PMU events with a count change of zero as potential PMU events to locate the hidden PMU events.

2. A method for clustering of mainstream CPU hiding events based on machine learning, characterized in that, The event count change of the CPU recorded in the method of claim 1 when executing all valid instructions is used as a feature matrix to extract the common features of the hidden events and reduce the number of redundant hidden events, the content of the method including: The count of the hidden PMU during the execution of each valid instruction is used as a feature thereof, the common features between events are extracted through a clustering algorithm, events with similar feature vectors are regarded as the same class, thereby removing redundant hidden PMU events; a t-Distributed Stochastic Neighbor Embedding data dimension reduction algorithm is used to reduce the feature dimension; at least one of a Density-Based Spatial Clustering of Applications with Noise and a K-Means++ algorithm is used to cluster algorithm, events with similar feature vectors are regarded as the same class; and parameter optimization is performed by comparing the silhouette coefficients of the clustering results to search for the best parameters, and then the best clustering algorithm is selected to complete the clustering.

3. A method for detecting transient execution attacks based on hidden PMU events, the method comprising: The hidden PMU events obtained by the method of claim 2 after removing the redundant results are used to detect transient execution attacks, the content of the method including: Data collection is performed to check the hidden PMU events, monitor the relationship between the hidden PMU events and the transient execution attacks, and collect the count change of each PMU event in the CLEAN, NO-ATTACK and ATTACK states for each attack; system stress is added by using a memory-intensive load running memcpy and a CPU-intensive load running complex floating-point operations in a loop; a model is trained by using a machine learning algorithm to train a classifier offline using the count change of the hidden PMU events under different loads; and robustness evaluation is performed to analyze the model training result to evaluate whether the hidden PMU events can be effectively used to detect specific transient execution attacks.

4. A side-channel attack method based on hidden PMU events, characterized in that, The hidden PMU events obtained by the method of claim 2 are used to construct a side channel to leak data leaked by transient execution attacks, and the method includes the following steps: A PMU-cache side channel directly reads the hidden PMU events related to the Cache state by replacing the Cache hit measurement based on access time commonly used in transient execution attacks with the hidden PMU events; and a PMU side channel, which constructs different control flows according to the data leaked by the transient execution attacks, triggers different counts by executing different instructions, thereby constructing a side channel attack, and the events suitable for the method are directly related to the instructions that cause the difference in the counts; in theory, all instructions that can trigger the hidden PMU counts and the corresponding hidden PMU event combinations can be used as the side channel.

Images