# Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor
## 5 Real-Time Detection Using PCM
### The proposed Detection Method  
Now, we describe the proposed detection method to cache side channel attacks in detail. Intel provides a PCM tool that extracts a wide variety of counters value and stores the results with a CSV file format. Although the PCM tool is easy to use, it has several unnecessary counters and consumes many  
Figure 4: Architecture of the proposed detection method and its execution environment. system resources [15]. Therefore, we modified the PCM tool to make it faster and more lightweight so that was suitable for real-time detection. The modified tool could extract the counter value with the given umask and event by using less CPU than the original PCM tool. In our experimental environment, we used an Intel Xeon(r) E5-2620 v4 processor with the Haswell-EP microarchitecture. The software developer's manual for Intel processors describes in detail all the performance counters available for users including their umasks and event numbers. Among them, we identified four performance counters suitable to our side channel detection method. Table 2 shows the counter names, umasks, and events of the four counter values that were used in our environment. In addition to these counters, we also used a counter for IPC, which is internally provided by the PCM-core, for our detection algorithm. Note that all the identified counters were not specific to the Xeon E5-2620 v4 processor, but were applicable to any Intel processors. In order to detect the attack by using the identified performance counter, we used a machine learning technique. In particular, we used a softmax classification algorithm for the proposed method. The softmax classification allowed us to detect the attack and further to classify it according to several known attacks. For the purpose of classification, we labelled each known attack to a specific constant number. More specifically, we labelled the Flush+Reload attack, the Flush+Flush attack, and the Prime+Probe attack A1, A2, and A3, respectively. For a normal situation without any attacks, we labelled it A0. Figure 5 illustrates the overall architecture of our machine learning model for the attack detection. The model consisted of a single-layer perceptron without hidden layer with five units in the input layer and one unit in the output layer. Units in the input layer (i.e., \(x_{1}\sim x_{5}\)) corresponded to the collected values from performance counters listed in Table 2 along with the IPC counter. The output unit \(y_{1}\) referred to one of the labels A0-A3 based on the classification. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Counter Name** & **Umask** & **Event** \\ \hline MEM\_LOAD\_UOPS\_RETIRED.L1\_MISS & \(0\times 08\) & \(0\times 01\) \\ MEM\_LOAD\_UOPS\_RETIRED.L2\_MISS & \(0\times 10\) & \(0\times 01\) \\ MEM\_LOAD\_UOPS\_RETIRED.L3\_MISS & \(0\times 20\) & \(0\times 01\) \\ BR\_INST\_EXEC\_ALL\_BRANCHES & \(0\times\text{ff}\) & \(0\times 88\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Performance counters used in the proposed detection method. Figure 5: The machine learning model used in the proposed detection method. We performed training by using the performance counters obtained from our PCM tool. Since the performance counters were likely to be influenced by other benign applications running on the host, we obtained the training data not only from the normal condition (i.e., no applications running), but also from certain conditions where various applications were running concurrently such as web browsers and media players. After training, we obtained 3500 samples of performance counters from our PCM tool. The training data were gathered according to various scenarios. That is, we gathered the data with or without mounting side channel attacks while also simultaneously running several background applications. As a result, we obtained the softmax classification model, which was trained with specified labels.