# Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor
## 1 Introduction  
Cache side channel attacks have become a major security threat for PC and cloud environments. This attack exploits the measured access time for the shared cache memory and then extracts sensitive information from the victim. There are a variety of well-known cache side channel attacks such as Flush+Reload [1], Flush+Flush [2], and Prime+Probe [3].  
In Flush+Reload and Flush+Flush attacks, a spy infers the cache usage of a victim by measuring the access time of the cache line that is shared with the victim. On the other hand, the Prime+Probe attack targets a cache set that is shared with the victim to infer the cache usage. Since all of those attacks target the L3 cache, it is stealthy and unnoticeable to the victim. These attacks are also used to recover secret data from transient execution attacks such as Meltdown [4], Spectre [5], Foreshadow [6], and ZombieLoad [7]. To mitigate these transient execution attacks, CPU vendors have proposed several countermeasures that can significantly affect the performance. However, if it is possible to detect the cache side channel attack, it can provide a fundamental countermeasure against transient execution attacks. Therefore, it is necessary to study the detection of cache side channel attacks.  
There are several techniques that can detect and block cache side channel attacks. While a spy executes an attack, these techniques measure the cache miss by using hardware performance counters while attempting to detect the cache side channel attacks based on the cache measurements. However,these techniques have limitations since they are unable to detect attacks in real time and they depend on the cache miss.  
To sum up, the previous detection methods have two limitations: (1) inability to detect attacks in real time and (2) lacking the detection of stealthy side channel attacks such as Flush+Flush, which incur no cache miss. In order to deploy the detection method in practice, we need to overcome these limitations.  
In this article, we propose a novel technique to detect cache side channel attacks. The detection techniques are constructed upon classification-based machine learning algorithms and the Intel PCM (Performance Counter Monitor) [8]. This allows us to detect cache side channel attacks in real time without depending on the cache miss. The Intel PCM enables the measurement of the cache state during the attack in real-time. Machine learning algorithms detect anomalies based on the measured cache state. The experimental results show that the proposed technique successfully detects in real time all the cache side channel attacks including Flush+Flush attack with an average accuracy of 95%. This result proves that the proposed detection technique can be used as a useful tool to protect the security in a PC or cloud environment.  
Contribution: This article has the following contributions. First, we propose a novel method that enables real-time detection for all kinds of cache side channel attacks. Second, we identify new available performance counters in the Intel PCM through extensive experiments and analysis, which allows us to detect stealth attacks. Third, we evaluate the effectiveness of the proposed detection method by conducting experiments in various execution environments including the virtualized environment and the single OS environment.  
Outline: In Section 2, we present related work. In Section 3, we describe some background information about cache side channel attacks, Intel PCM, and the softmax classification algorithm. In Section 4, the experimental results are presented to identify new useful CPU counters for detection in the Intel PCM. In Section 5, we propose a detection method of the cache side channel attacks based on a machine learning algorithm. In Section 6, we evaluate the effectiveness of the detection program. Finally, we conclude by summarizing our work in Section 6.