# Beat the Heat: Syscall Attack Detection via Thermal Side Channel
## 1 Introduction  
Monitoring the temperature of a CPU is a very important detail in order to provide a reliable computing environment, execute at an optimal performance and preserve the health of the hardware. Temperature monitoring prevents overheating and thus a reduced lifespan for the hardware, maintains the performance by optimizing the cooling process, ensures the stability of the system to avoid crashes and unexpected shutdowns, improves the energy efficiency by dynamically adjust the power consumption, and improves the user experience by reducing fan noise. However, the spotlight of the benefits introduced by temperature monitoring is diminished by an interface that can be accessed by anyone, providing an attack opening as well as a detection tool. A user process can use any of the existing system calls in an operation system while executing varied programs. If any of the executed programs interacts with a jeopardized syscall, it could breach the kernel space, potentially resulting in unauthorized data access, privilege escalation, system crashes, the leakage of internal kernel information, and other issues. These consequences can ultimately lead to the unauthorized acquisition of valuable and sensitive data. Moreover, there is a correlation between the temperature of a CPU and the applied current and voltage, which means that one can detect the differences in temperature for the identical set of instructions but different operands [1]. The above statement leads to the main idea of this study, that monitoring the temperature of a CPU while an original application and one that contains additional compromised code are running, must bring differences in temperature, but not in the pattern of the execution. Hot-and-Cold [2] is a technique that detects anomalies using the _ls_ and _chmod_ Linux commands, which shows a correlation up to 0.8 between an original and an augmented command, the second having a higher temperature due to the additional code. However, this technique was employed in a controlled environment, with zero noise, which in fact could not lead to a strong conclusion about the application of the technique in real-life scenarios. Therefore, this research introduces _BeatTheHeat_ technique, which builds upon the Hot-n-Cold anomaly detection technique, with the objective of making it work in more realistic computational environments. This is achieved by monitoring the CPU temperature to detect irregularities in the Linux command behavior. The innovative aspect of this approach is the inclusion of five types of noise during the operation of the attack detector. These noise types encompass user-specific activities such as moving files, performing extended mathematical computations, playing songs, and browsing the web. This added complexity simulates real-world conditions more accurately, boosting the robustness and practicality of the anomaly detection method. _BeatTheHeat_ has the objective of identifying an attack created using crafted system calls that are added in the original code, in scenarios similar to real life. The hypothesis of the work is that an augmented command, containing additional code, will dissipate more heat; however, the pattern of the original and the modified command will be very similar. The temperature monitoring is performed via Intel digital sensors, which are integrated within Intel processors to monitor the temperature of the CPU. These sensors provide accurate and real-time temperature readings through the _hwmon_ interface [3], which allows both users and system administrators to monitor and manage hardware health. The augmentation is performed based on the information from the Common Vulnerability and Exposures (CVE) database [4]. To process and compare the two temperature vectors of the original and augmented with code commands, we used the method of correlation thermal analysis, which is a variation of the well-known correlation power analysis (CPA) technique, together with the Pearson correlation.