# CacheHawkeye: Detecting Cache Side Channel Attacks Based on Memory Events
## 4 Evaluation
### Performance under Different System Loads  
In this subsection, we evaluated _CacheHawkeye_ under different system loads. We used _unixbench_ and _sysbench_ to generate system load. We used the default configuration of _unixbench_. The configuration settings of _sysbench_ are listed in Table 8. During the execution of _sysbench_, we randomly picked one of the five routines. The system loads are divided into three categories: no-load, average-load, and full-load. No-load means that there is no system load when _CacheHawkeye_ is running. The average-load has two workloads, one runs _sysbench_, the other runs _unixbench_. The full-load has four workloads, two of which run _sysbench_, and the other two run _unixbench_.  
We tested _CacheHawkeye_ to detect 4 representative attack programs and 4 legit cryptographic programs which may access sensitive addresses under different system loads. Each program is executed 1000 times. 4000 benign samples and 4000 malignant samples are generated under each system load. The experimental results are listed in Table 9. We discovered that _CacheHawkeye_ is 100% accurate under no-load and full-load, and 99.99% accurate under average-load. Because _CacheHawkeye_ has not been pre-trained under different system loads, it can be expected that _CacheHawkeye_ still performs excellently under unknown system loads. As a result, it can be inferred that the performance of _CacheHawkeye_ performance is unaffected by system load. Because the memory capacity is substantially more than the capacity of the microarchitecture components (such as the branch instruction buffer and cache), memory events are very little affected by system loads.  
Table 10 summarizes some limitations of the above work. CacheRadar and [PERSON] et al.'s methods cannot detect Flush+Flush attacks. These two strategies, however, do not take system loads into account. We believe that these strategies are extremely sensitive to system loads because hardware events such as cache hits and misses are highly susceptible to interference from system loads. NIGHTs-WATCH has a good performance in known system loads and can detect Flush+Flush attacks. However, system loads still bring an accuracy loss of 4.97% [13] and this pre-trained model may perform poorly under unknown system load. Microarchitecture events are used as feature vectors for detection in all of the approaches listed above. Our approach detects cache side channel attacks using memory events. Compared with the above methods, our method has a very strong ability to adapt to the system loads and close to 100% accuracy.  
\begin{table}
\begin{tabular}{c c} \hline
**Test** & **Setting** \\ \hline cpu & cpu-max-prime = 2000 \\ threads & num-threads = 500 thread-yields = 100 \\ thread-locks = 4 \\ fileio & num-threads = 16 file-total-size = 2G \\ file-test-mode = rndrw \\ memory & memory-block-size = 8k \\ memory & memory-total-size = 1G \\ mutex & num-threads = 100 mutex-num = 1000 mutex-locks = 100,000 –mutex-loops = 10,000 \\ \hline \end{tabular}
\end{table}
Table 8: Configuration settings of _sysbench_.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline  & \multicolumn{2}{c}{**No Load**} & \multicolumn{2}{c}{**Average Load**} & \multicolumn{2}{c}{**Full Load**} \\  & **Positive** & **Negative** & **Positive** & **Negative** & **Positive** & **Negative** \\ \hline True & 4000 & 4000 & 3999 & 4000 & 4000 & 4000 \\ False & 0 & 0 & 1 & 0 & 0 & 0 \\ \hline \end{tabular}
\end{table}
Table 9: Detection results under different load conditions.