PerSpectron: Detecting Invariant Footprints of Microarchitectural Attacks with Perceptron

2026-10-05

AI Summary

This work addresses the challenges of difficult detection, high false-positive rates, and delayed response in microarchitectural attacks that lead to data leakage. We propose a real-time detection and defense framework based on hardware neural networks. By performing correlation analysis on performance monitoring counters (PMCs) to extract microarchitectural statistical features, we construct a lightweight hardware predictor using a perceptron algorithm to identify and classify attacks. Furthermore, we introduce an invariant footprint-based early detection mechanism that balances evasion resistance with interpretability. Experimental results demonstrate that the proposed approach successfully detects various attacks, including Spectre, triggering zero-latency mitigation before any data leakage occurs while incurring minimal runtime overhead.

Abstract

Detecting microarchitectural attacks is critical given their proliferation in recent years. Many of these attacks exhibit intrinsic behaviors essential to the nature of their operation, such as creating contention or misspeculation. This study systematically investigates the microarchitectural footprints of hardware-based attacks and shows how they can be detected and classified using an efficient hardware predictor. We present a methodology to use correlated microarchitectural statistics to design a hardware-based neural predictor capable of detecting and classifying microarchitectural attacks before data is leaked. Once a potential attack is detected, it can be proactively mitigated by triggering appropriate countermeasures. Our hardware-based detector, PerSpectron, uses perceptron learning to identify and classify attacks. Perceptron-based prediction has been successfully used in branch prediction and other hardware-based applications. PerSpectron has minimal performance overhead. The statistics being monitored have similar overhead to already existing performance monitoring counters. Additionally, PerSpectron operates outside the processor's critical paths, offering security without added computation delay. Our system achieves a usable detection rate for detecting attacks such as SpectreV1, SpectreV2, SpectreRSB, Meltdown, breakingKSLR, Flush+Flush, Flush+Reload, Prime+Probe as well as cache-attack calibration programs. We also believe that the large number of diverse microarchitectural features offers both evasion resilience and interpretability---features not present in previous hardware security detectors. We detect these attacks early enough to avoid any data leakage, unlike previous work that triggers countermeasures only after data has been exposed.

Problem

• Microarchitectural attacks
• Attack detection
• Hardware security
• Side-channel attacks
• Data leakage prevention

Innovation

• Microarchitectural attacks
• Perceptron learning
• Hardware predictor
• Side-channel detection
• Proactive mitigation