Performance Counter Monitor를 이용한 머신 러닝 기반 캐시 부채널 공격 탐지
Machine Learning-Based Detection of Cache Side Channel Attack Using Performance Counter Monitor of CPU
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 마이크로 아키텍처의 취약점을 이용하여 내부의 비밀 정보를 노출시키는 캐시 부채널 공격들이 제안되었다. 캐시 부채널 공격 중 Flush+Reload 공격은 높은 해상도와 낮은 노이즈 특성으로 인해 여러 악의적 응용 공격에활용되고 있다. 본 논문에서는 CPU 캐시 활동을 관측할 수 있는 PCM(Performance Counter Monitor) 기능을 이용하여 캐시 기반 부채널 공격을 찾아낼 수 있는 탐지기를 구현하였다. 특히, Spectre 공격과 AES 암호 연산 중 비밀 키 추출 공격이 발생했을 때를 가정하여 PCM 카운터 값의 변화를 관측하였다. 실험 결과, PCM의 4가지 카운터 특성이 캐시 부채널 공격에 크게 반응함을 확인하였고, SVM(Support Vector Machine). RF(Random Forest), MLP(Multi Level Perceptron)와 같은 머신 러닝 기반 검출기를 통해 높은 정확도로캐시 부채널 공격을 탐지할 수 있었다.
Abstract
Recently, several cache side channel attacks have been proposed to extract secret information by exploiting design flaws of the microarchitecture. The Flush+Reload attack, one of the cache side channel attack, can be applied to malicious application attacks due to its properties of high resolution and low noise. In this paper, we proposed a detection system,which detects the cache-based attacks using the PCM(Performance Counter Monitor) for monitoring CPU cache activity. Especially, we observed the variation of each counter value of PCM in case of two kinds of attacks, Spectre attack and secret recovering attack during AES encryption. As a result, we found that four hardware counters were sensitive to cache side channel attacks. Our detector based on machine learning including SVM(Support Vector Machine), RF(Random Forest)and MLP(Multi Level Perceptron) can detect the cache side channel attacks with high detection accuracy.
참고문헌 (17)
- P. Kocher, "Differential power analysis", LNCS, 1666, pp.388~397 (1999)
- "Cache-Timing Attacks on AES" (2005)[URL]
- P. Kocher, "Spectre Attacks : Exploiting Speculative Execution", IEEE Symposium on Security and Privacy, pp.1~19 (2019)
- M. Lipp, "Meltdown : Reading Kernel Memory from User Space", Proceedings of the 27th USENIX Security Symposium, pp.973~990 (2018)
- Y. Yarom, "FLUSH+RELOAD : a high resolution, low noise, L3 cache side-channel attack", Proceedings of the 23rd USENIX Security Symposium, pp.719~732 (2014)
- D. Gruss, "Flush+Flush: A Fast and Stealthy Cache Attack", LNCS, 9721, pp.279~299 (2016)
- D. Osvik, "Cache Attacks and Countermeasure:The Case of AES", LNCS, 3860, pp.1~20 (2006)
- G. Irazoqui, "Wait a minute! A fast, Cross-VM attack on AES", LNCS, 8688, pp.299~319 (2014)
- "Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack" (2014)[URL]
- M. Chiappetta, "Real time detection of cache-based side channel attacks using hardware performance counters", Applied Soft Computing, 49, pp.1162~1174 (2016)
- M. Mushtaq, "Run-time Detection of Prime+Probe Side-Channel Attack on AES Encryption Algorithm", Proceedings of the Global Information Infrastructure and Networking Symposium (GIIS) (2018)
- J. Depoix, "Detecting spectre attacks by identifying cache side-channel attacks using machine learning", Proceedings of Wiesbaden Workshop on Advanced Microkernel Operating Systems(WAMOS’18), pp.75~85 (2018)
- J. Cho, "Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor", Applied Science, 10(3) (2019)
- C. Cortes, "Supportvector networks", Machine Learning, 20(3), pp.273~297 (1995)
- T. Hofmann, "Kernel Methods in Machine Learning", The Annals of Statistics, 36(3), pp.1171~1220 (2008)
- L. Breiman, "Random Forests", Machine Learning, 45, pp.5~32 (2001)
- R. Collobert, "Links between perceptrons, MLPs and SVMs", Proceedings of the twentyfirst international conference on Machine learning, ICML'04, pp.23~ (2004)