# Detecting Microarchitectural Side-Channel Attacks via Hardware Security Checkers

Alessandro Palumbo

<figure><img src="image_1.png" /></figure>

## To cite this version:

Alessandro Palumbo. Detecting Microarchitectural Side-Channel Attacks via Hardware Security Checkers. RISC-V Summit Europe 2025, May 2025, Paris, France. pp.1-1, 2025. [hal-05287161](https://hal.science/hal-05287161v1)

HAL Id: hal-05287161

https://hal.science/hal-05287161v1

Submitted on 28 Sep 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Detecting Microarchitectural Side-Channel Attacks via Hardware Security Checkers

<figure><img src="image_3.png" /></figure>

<figure><img src="image_4.png" /></figure>

Alessandro Palumbo

CentraleSupélec, Inria, CNRS, IRISA

alessandro.palumbo@inria.fr

<figure><img src="image_5.png" /></figure>

université
PARIS-SACLAY

<figure><img src="image_6.png" /></figure>

**Abstract**—Two Hardware Security Checkers ISA-independent for real-time anomaly detection in microprocessor-based systems are presented: (1) a hash-based approach that identifies known attack patterns and (2) a Machine Learning-based model trained on system-level simulations to detect emerging threats.

The methodology relies on monitoring the microprocessor's behavior, specifically instruction fetching activity and performance counters, including cache activity and branch mispredictions, to identify malicious activity with minimal overhead. Experimental results demonstrate 100% detection accuracy for known attacks and strong adaptability to novel threats.

<figure><img src="image_7.png" /><figcaption>Fig. 1. The Hardware Security Checker implementation idea</figcaption></figure>

## I. THE HASH-BASED HARDWARE SECURITY CHECKER

Monitoring microprocessor's fetching activity using hash functions. Estimating programmed malicious instruction patterns within user-defined time windows.

<figure><img src="image_8.png" /><figcaption>Fig. 2. The Hash-based Hardware Security Checker structure [1]</figcaption></figure>

<table><caption>TABLE I
BEST RATES AND THE RESOURCE USAGE OF PROPOSED SOLUTIONS</caption><thead><tr><th>Ref.</th><th>Acc.</th><th>FP</th><th>FN</th><th>#LUT</th><th>#FF</th><th>#BRAM</th><th>#LUTRAM</th></tr></thead><tbody><tr><td>[1], Fig 2, 3</td><td>100%</td><td>0%</td><td>0%</td><td>19,063 (3.98%)</td><td>11,552 (6.13%)</td><td>17</td><td>4,536 (0.53%)</td></tr><tr><td>[2], Fig 4</td><td>99.79%</td><td>0.21%</td><td>0%</td><td>45,200 (6.75%)</td><td>6,100 (NA)</td><td>0</td><td>0</td></tr></tbody></table>

<table><caption>TABLE II
BEST ANOMALIES DETECTION RATES AND OVERHEADS</caption><thead><tr><th rowspan="2">Ref.</th><th colspan="4">Considered vulnerabilities</th><th colspan="2">Targeted ISA</th></tr><tr><th>Spectre</th><th>Meltdown</th><th>Orchestration</th><th>RowHammer</th><th>Flush+Reload</th><th>x86 RISC-V</th></tr></thead><tbody><tr><td>[1], Fig 2, 3</td><td>✓</td><td></td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>[2], Fig 4</td><td>✓</td><td>✓</td><td></td><td></td><td></td><td>✓</td></tr></tbody></table>

## REFERENCES

[1] K. A. et al., “Processor security: Detecting microarchitectural attacks via count-min sketches,” *IEEE Transactions on Very Large Scale Integration (VLSI) Systems*, vol. 30, no. 7, pp. 938–951, 2022.

[2] M. Iamundo, “A machine learning-based security architecture to detect microarchitectural side-channel attacks in microprocessors,” 2021.

## II. THE HASH-BASED WORKFLOW

<figure><img src="image_9.png" /><figcaption>Fig. 3. The workflow of the Hash-based Hardware Security Checker [1]</figcaption></figure>

## III. THE ML-BASED WORKFLOW

ML attack detection on system-level simulations, feature selection for generating hardware-ready code.

<figure><img src="image_10.png" /><figcaption>Fig. 4. The workflow of the ML-based Hardware Security Checker [2]</figcaption></figure>