## 1 Introduction  
With the emergence of attacks targeting hardware microarchitecture, including Cache Side-Channel Attacks (CSCAs) such as Flush + Reload [1] and Prime + Probe [2], and transient execution attacks such as Spectre [3] and Meltdown [4], a deep understanding of the system's microarchitecture and the study of how the microarchitecture is affected by the software execution has become a very important research issue. Microarchitectural information describes the inner state of the hardware, which is supposed to be transparent to the software. This microarchitectural information includes both storage information, such as a register indicating whether the current execution is a speculative execution, and timing information, such as the execution time of one access to the cache. Many microarchitectural attacks consist in collecting and analyzing microarchitectural information in order to gain knowledge about other processes sharing the same hardware. For example, in Flush + Reload, the attacker measures the access time to a specific memory address, they can then infer whether this address is in the cache and deduce whether the victim process accessed the same address or not. This use of microarchitectural information breaksthe hypothesis of interprocess isolation and can be used by an attacker to discover and exploit vulnerabilities. Different prevention mechanisms, from pure hardware to pure software solutions, have already been proposed in the literature [5; 6]. They mainly involve disabling the optimizations, enforcing resources isolation, or enforcing constant-time execution. However, these mechanisms are not sufficient for several reasons. As microarchitectural attacks often rely on hardware-level optimization, an always-active prevention mechanism may impede the performances of the processor or the software, which may be unacceptable in some situations. Furthermore, hardware modifications, such as the partitioning of hardware resources, also require privileged software to identify the nature of different software and manage the use of these partitions, which may be quite complicated in complex environments. Finally, it is very difficult to design prevention mechanisms that cover all the attack surface at the microarchitecture level, mainly because this attack surface is not clearly identified currently. As a consequence, it is important to design and implement detection mechanisms that complement the prevention mechanisms. From the attack detection point of view, the fact that the microarchitectural information is hardly accessible to software makes it difficult to implement efficient and easy-to-use countermeasures against the microarchitectural attacks, and more generally, to characterize the footprint of attacks on the microarchitecture. Existing runtime analysis and detection of microarchitectural attacks mainly rely on Hardware Performance Counters (HPCs) [7]. Available on most modern processors, HPCs store counts of microarchitectural events of the processor using a set of special-purpose registers. These HPCs can be analyzed by software in order to build some behavior model of either malicious or legitimate processes. Even if HPCs have been used to successfully detect some cache attacks on cryptographic algorithms (RSA, AES,...), they suffer from inherent limitations: First, almost all of the proposed detection algorithms are based on software detection. Compared with dedicated hardware solutions, the cost can be prohibitive in a complex environment composed of numerous processes running in parallel. Second, proposed techniques usually lack generality and adaptability. In particular, they use a limited set of attacks to validate their proposals. Overall, none of these solutions are sufficient to address the multiplicity of the attacks and their mutation capabilities. In this paper, we propose a reconfigurable framework based on the analysis of microarchitectural signals for the detection of several classes of attacks, especially microarchitectural attacks, called MATANA.