Patent ID: 11861049
Assignee: THE GEORGE WASHINGTON UNIVERSITY
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 0:
1. A method for identifying a cache timing channel attack based on cache occupancy, the method comprising:
monitoring cache occupancy for a set of application processes operating in a processor to produce cache occupancy data over a period of time, comprising, during each of a plurality of time windows, reading cache occupancy for each of a plurality of application domains;
performing a pair-wise analysis of the plurality of application domains based on the cache occupancy data, wherein the pair-wise analysis identifies autocorrelations of cache occupancy between pairs of application domains in respective time windows; and
analyzing the pair-wise analysis and the cache occupancy data to identify a potential cache timing channel attack based on observing patterns of cache occupancy mirrored between application domains of one or more application domain pairs of the plurality of application domains over the plurality of time windows, wherein the potential cache timing channel attack is associated with a highest autocorrelation of the autocorrelations of cache occupancy of the pairs of application domains in respective time windows.