## 3 Overview of Matana
### Methodology for Designing Attack Detection Algorithms  
Figure 2 describes our iterative methodology to design and implement attack detection using MATANA. The methodology is composed of five steps:  
1. **Signal Selection**. This step aims at selecting the most appropriate monitored signals for attack detection. As the methodology is iterative, this selection may be refined at each iteration. At first, a large number of different signals can be chosen, ranging from some generally useful signals such as the instruction flow (since microarchitectural attacks are based on relatively small instruction patterns) to some attack specific signals such as cache and memory events. For the following iterations, the selection of monitored signals may be adjusted according to the experimentation results in step 4 by removing some less-efficient signals or adding some related signals. 2. **Probe Connection**. The probe connection step consists in choosing a proper clock domain crossing technique used for connecting each selected signal to the Detection Module, with consideration of information quantity, area overhead, and detection accuracy. This step is only required if the Detection Module is not running at the same frequency as the processor. This distinction is important since, in the case of a reconfigurable Detection Module, the frequency may be much smaller that the processor's core. We illustrate the detection method at low frequency in Section 5.2. For more information regarding transmission techniques, the reader can refer to Section 4.3. 3. **Detection Logic Design**. This step aims at designing the detection algorithm intended to be implemented into the Detection Module. The inputs of the algorithm are the signals selected in step 1, and the output is an alert when an attack occurs. The algorithm itself can be designed based on the expected behavior of target components, the properties of target attacks, or be adapted from any previously known detection algorithms. Thanks to the fast reconfigurability offered by MATANA, a \"trial and error\" methodology is possible to investigate different detection methods for a given attack. Since no assumption is required on the type of algorithm, simple techniques  
Figure 1: Design flow for integrating MATANA into a target system. such as heuristic-based pattern matching to more sophisticated ones based on state machine or machine learning can also be evaluated. 4. **Benchmarking. ** This step aims at carrying out some experiments to assess the relevance of the attack detector (with signals, connections, and algorithms defined in previous steps) by means of some appropriate benchmarks. For this purpose, MATANA is equipped with an Operating System (OS) aimed at running sufficient benchmarks to evaluate the accuracy of the detection. In our approach, we chose one benchmark that represents an effective attack, and the others were picked from state of the art benchmarks to cover the majority of applications, i.e., mainly CoreMark and Embedn. Let us note that without any benchmark, MATANA can also evaluate the stability of the detector since the OS is always running in background. If the detection logic implemented exhibits too many false positives or false negatives, it is necessary to go back to step 1 or 3 and to improve either the selection of signals or the design of the detection logic itself. 5. **Deployment**. When the detection logic exhibits a good detection rate, a final step consists in optimizing the solution for its deployment in final products. To our viewpoint, the best choice for the final product is a reconfigurable Detection Module for detection flexibility, with fixed monitored signals integrated into the target component in order to reduce performance impact. For a Detection Module that is supposed to detect multiple attacks, the size of reconfigurable fabric should be sufficient to contain at least each algorithm and ideally multiple algorithms at the same time.