L1 Instruction Cache Malicious Code Detection via L2 Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to detect malicious code hiding in the first-level instruction cache, as it can bypass the second-level cache, making it difficult to distinguish from innocuous code and evade detection.
Innovation Solution
An integrated circuit with a first-level instruction cache and a second-level cache that executes a detection routine with instructions larger than the first-level cache capacity, fetching from the second-level cache and monitoring execution time to detect malicious code, utilizing benevolent code that forces cache misses and longer execution times for malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If code is stored only in L1 cache to improve execution speed, then instruction access time is reduced, but detection of malicious code becomes impossible
Solution Approach 1:
The L2 cache serves as an intermediary between L1 cache and external memory, enabling detection of code that bypasses L2. The detection routine uses L2 cache access patterns as a mediator to identify malicious code that attempts to hide in L1 cache by forcing cache misses and observing abnormal access behavior to L2.
Solution Approach 2:
The system implements feedback by monitoring execution time and cache access patterns of the detection routine. When the detection routine executes code that forces L1 cache misses and observes abnormal L2 cache behavior or execution time deviations, it provides feedback indicating the presence of malicious code in L1 cache.
2Measurement precision
If detection routine instructions are larger than L1 cache capacity to ensure malicious code is detected, then detection accuracy improves, but execution time increases due to cache misses
Solution Approach 1:
The detection routine dynamically adapts its behavior based on cache state. It uses conditional logic to determine whether to execute detection code that forces cache misses (when L1 is suspected of containing malicious code) versus normal execution paths, optimizing the balance between detection accuracy and execution time based on runtime conditions.
3Productivity
If the inner loop executes fewer instructions than L1 cache capacity to maintain fast execution, then productivity is improved, but the ability to detect malicious code is reduced
Solution Approach 1:
The detection routine is segmented into an inner loop and outer loop components. The inner loop executes a small number of instructions optimized for speed and productivity, while the outer loop periodically executes the full detection routine with larger instruction sets that force cache misses. This segmentation allows the system to maintain high productivity during normal operation while periodically performing comprehensive security checks.
Data Source
AI summary
An integrated circuit may comprise a processor, a first level instruction cache having a first storage capacity, and a second level cache having a second storage capacity that is larger than the first storage capacity. The first level instruction cache is configured to store a subset of instructions stored in the second level cache. The second level cache is configured to store a subset of data and instructions stored in an external memory. The processor executes an inner loop of a detection routine and monitors an execution time of the inner loop to detect malicious code in the first level instruction cache. A total number of detection routine instructions is larger than the first storage capacity. The inner loop requires fetching of detection routine instructions from the second level cache, and an execution number of instructions executed during execution of the inner loop is smaller than the first storage capacity.