## 4 MATANA Detailed Architecture
### Hardware Architecture  
Probes are integrated on target components that are supposed to be monitored in order to extract their internal signals' values (called probed signals in the following). The target components must allow additional connections. The presence and placement of these probes is crucial in the architecture because the quality of the detection highly depends on the analysis of these signals. If the different probes are adequately placed on the target components, they can provide a large cycle-accurate data set that gives a precise view of the system state, which is essential to build appropriate detection logic. The Detection Module is a combination of hardware and software, and is the core component in which the detection algorithms are implemented. It has been designed as a stand-alone module at both the hardware and software level, for better modularity of the system. The hardware part of the Detection Module (called hardware Detection Module in the following) is implemented in a fully reconfigurable fabric to perform different custom runtime analyses on probed signals. It is equipped with a set of Memory-Mapped I/O (MMIO) registers and memory zone, and provides its intermediate results to the software part of the module (called software Detection Module in the following) located in the system kernel. Additionally, the hardware Detection Module can send interruptions to the processor by means of the interrupt link, in case the hardware requires an immediate intervention of the software--for example, when an attack is detected. It is up to the software Detection Module to decide whether it is a real attack and what action to take, as it benefits from a more global and accurate view of the execution environment. We did not add any other signal from the Detection Module to the target components, because this would require modification of the target components so that they can handle these signals. By default, the probed signals are directly connected to the hardware Detection Module. This dedicated Probe Connection (which does not require any shared bus) guarantees high throughput and low-latency data transfer that is unaffected by other system activities. However, when the hardware Detection Module is configured in a slower clock domain, other Probe Connections are needed, as presented in Section 4.3. For the flexibility in the design phase, i.e., to allow the evaluation of different detection algorithms based on different probed signals, as described in Section 3.3, the target components, hardware Detection Module, and its connections are located on a reconfigurable fabric such as an FPGA. Other parts of the target system may be outside of it, as long as the synchronization is properly configured. Let us underline that this framework is independent of the ISA, which means that many systems are compliant with MATANA as long as (1) the target components can output some internal signals and (2) access to a system bus and an interrupt link are provided to the reconfigurable part. Figure 3: MATANA architecture. The design phase is intended to easily assess different detection algorithms. At the end of this phase, i.e., when some relevant detection algorithms are identified and adopted, the integration of these algorithms into final products (manufacturing phase, as described in Figure 2) only necessitates that the hardware Detection Module and some specific required I/O are located in the reconfigurable fabric to preserve flexibility (as shown in dotted rectangle in Figure 3). This configuration allows the integration of probes into high-frequency target components, thus providing a balance between design effort, SoC performance, and detection flexibility for future attacks. The experiments we carried out seem to confirm this choice, as we show in Section 5 that we are able to design efficient detectors with few and standard signals for two completely different classes of attacks.