# CacheHawkeye: Detecting Cache Side Channel Attacks Based on Memory Events
## 4 Evaluation
### Sampling Frequency Configuration  
In this subsection, we evaluated the performance of _CacheHawkeye_ at different frequencies and determine an appropriate sampling frequency. We tested _CacheHawkeye_ to detect 4 representative attack programs and 4 legit cryptographic programs which may access sensitive addresses. we chose programs that are extremely difficult to detect when configuring the frequency, this can make the configured frequency more universally adaptable. For _CacheHawkeye_, the shorter the execution time of the attack program, the fewer sensitive memory address accesses, and the more difficult it is to detect. We chose 4 programs with very short execution time to configure the sampling frequency. As shown in Table 7, the execution time of these programs is only 7-12 ms. Real-world attacks must be much longer than these times because the attacker cannot synchronize with the victim. Therefore, the frequency configured according to these attack programs far meets the requirements of detecting real-world attacks. We monitored 4 representative attack programs and 4 legit cryptographic programs with sampling frequencies of 2999, 5999, 8999, 11,999 and 14,999. Each attack program is executed 1000 times at each frequency. 4000 attacking samples are generated per frequency. _CacheHawkeye_ also tests legit AES encryption/decryption programs and RSA encryption/decryption programs under different frequencies. Each legit program is executed 1000 times at each frequency. We use accuracy to evaluate the performance of _CacheHawkeye_ at different frequencies and then determine the appropriate sampling frequency configuration. Accuracy refers to the percentage of samples that are judged correctly in the total samples. The formula for accuracy is as follows:  
\[Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{1}\] \begin{table}
\begin{tabular}{c c c} \hline \hline
**Symbol** & **Data Symbol** & **Overhead (\%)** \\ \hline des\_setkey.part.0 & 0\(\times\)00007 ffbc126589 & 6.25 \\ mph\_sqr\_n\_bascase & 0\(\times\)00007f6b27 fac7b8 & 6.25 \\ mph\_addmul\_1 & 0\(\times\)00005638 ece97148 & 6.25 \\ mph\_divern & 0\(\times\)00007 ffbc12686 & 6.25 \\ mph\_mul & 0\(\times\)00007f6b27 fac628 & 6.25 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Legit RSA decryption program detection results of Mem-stores. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Data Symbol** & **Overhead (\%)** & **Data Symbol** & **Overhead (\%)** \\ \hline
0 xff8 afe01 fd5d18 & 100.00 & 0 xffffee000006 fd8 & 25.00 \\  & & 0 xffffee8 afrid1 ah80 & 12.50 \\  & & 0 xffffee7764c & 12.50 \\  & & 0 xffff8b7545 bf7c0 & 12.50 \\  & & 0 xffff8b7545 bf7d08 & 12.50 \\  & & 0 xffffe000006 fe28 & 12.50 \\  & & 0 xffff8b7545 bf7c18 & 12.50 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Legit AES encryption program detection results. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Symbol** & **Data Symbol** & **Overhead (\%)** \\ \hline vma\_interval\_tree\_insert & 0 xff8 afd591d93f0 & 19.83 \\ copy\_page & 0 xffff8 afd710e3 da0 & 16.99 \\ filemap\_fault & 0 xfffde478 cd0f048 & 15.43 \\ filemap\_map\_pages & 0 xfffde478 ef1 ba88 & 15.43 \\ filemap\_map\_pages & 0 xfffde478f2f75c8 & 14.97 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Legit RSA decryption program detection results of Mem-loads. In Equation (1), True Positive(TP) represents that the malignant program is correctly recognized, True Negative(TN) represents that the benign program is correctly recognized, False Positive(FP) represents that the benign program is recognized as a malignant program, and False Negative(FN) represents that the malignant program is recognized as a benign program. The accuracy of malicious and legit programs at different sampling frequencies is shown in Figure 4. The accuracy of the _CacheHawkeye_ is only 82.7% when the sampling frequency is 2999. _CacheHawkeye_'s accuracy improves as the sampling frequency rises. The accuracy rate reaches 100% when the sampling frequency reaches 14,999.