Self-Organizing Map Detection of CPU Side-Channel Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting side-channel attacks are inadequate for new attacks and adversely impact system performance, while existing detection methods rely on signature detection or side-channel analysis.
Innovation Solution
Utilizing unsupervised machine learning, specifically a self-organizing map (SOM) trained with hardware performance counters to detect co-resident programs in similar program phases, and implement a lightweight detector for both known and unknown attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature detection or side-channel analysis is used to detect side-channel attacks, then detection capability is provided, but system performance is adversely impacted
Solution Approach 1:
The patent replaces conventional mechanical detection methods (signature detection and side-channel analysis) with a machine learning-based approach. The system uses a machine learning model that processes program execution traces and architectural state information to detect side-channel attacks, substituting traditional detection mechanisms with an intelligent system that achieves both high detection accuracy and minimal performance overhead
Solution Approach 2:
The patent changes the detection parameters from traditional signature-based or side-channel measurement approaches to machine learning-based feature extraction. The system transforms detection into a pattern recognition problem by collecting program execution traces and architectural state information, then feeding this data into a machine learning model that learns to distinguish between benign and malicious execution patterns
2Reliability
If conventional detection techniques are used, then known attacks can be detected, but new attacks cannot be detected and adaptability is insufficient
Solution Approach 1:
The patent implements preliminary action by training the machine learning model in advance using a comprehensive dataset that includes both benign program executions and various side-channel attack patterns. The model learns to recognize the architectural state changes and execution trace patterns characteristic of side-channel attacks before they occur, enabling it to detect both known and novel attack variants when they execute
Solution Approach 2:
The system employs self-service through the machine learning model's ability to automatically adapt to new attack patterns. The model processes execution traces and architectural state information in real-time, automatically learning from observed patterns without requiring manual updates or retraining. This enables the system to detect new and evolving side-channel attacks as they emerge
Data Source
AI summary
Methods, apparatus, systems and articles of manufacture to identify a side-channel attack are disclosed. Example instructions cause one or more processors to generate an event vector based on one or more counts corresponding to tasks performed by a central processing unit; determine distances between the event vector and weight vectors of neurons in a self-organizing map; select a neuron of the neurons that results based on a determined distance; identify neurons that neighbor the selected neuron; and update at least one of a weight vector of the selected neuron or weight vectors of the neighboring neurons based on the determined distance of the selected neuron.