# CacheHawkeye: Detecting Cache Side Channel Attacks Based on Memory Events
## 2 Background and Related Work
### Related Work  
Cache side channel detection technology could be divided into two main categories: signature-based detection [11; 12; 13; 14; 15; 16] and anomaly-based detection [17; 18; 19]. Some detection techniques [20; 21; 22] use a combination of signature and anomaly-based detection techniques.  
Some researchers propose several signature-based detection methods [11; 12; 13; 14; 15; 16]. For example, [PERSON] et al. [11] use L1 hits event in HPCs to detect malware and cache side channel attacks. [PERSON] et al. [12] propose another signature-based detection technique to detect Prime+Probe and Flush+Reload attacks when using machine learning (ML) models and HPCs and running an AES cryptosystem. The hardware events they use are core cycles, reference cycles and core instructions. NIGHTS-WATCH [13] can detect access-driven cache side channel attacks. It consists of various machine learning models that make use of LLC misses and CPU cycles in HPCs. This method trains the model under some preset system loads, and we are not sure whether it still performs well under some unknown system loads. [PERSON] et al. [14] use linear and non-linear ML classifiers to detect variants of Prime+Probe attacks running under the AES cryptosystem. HexPADS [15] uses the values of cache miss rates and page faults to detect Flush+Reload and cache template attacks [16].  
The literature [17; 18; 19] proposes several anomaly-based detection methods. For example, CacheShield [17] is an anomaly-based detection mechanism on legacy software (victim application) that involves monitoring L3 cache misses by HPCs. [PERSON] et al. [18] detect cross-VM cache side channel attacks through using hardware fine-grained information provided by Intel Cache Monitoring Technology (CMT) and HPCs following the Gaussian anomaly detection method. SpyDetector [19] can detect Flush+Reload, Flush+Flush and Prime+Probe attacks running on RSA, AES and ECDSA cryptosystems through monitoring L3 cache and L1 data cache by HPCs.  
Some detection techniques [20; 21; 22] use the combination of signature and anomaly-based detection techniques. [PERSON] et al. [20] propose a machine learning based detection mechanism for Flush+Reload attack on AES and ECDSA cryptosystem. They monitor L3 access to detect attacks. CloudRadar [22] is a signature and anomaly-based detection system. Attacks are detected in two steps. The first step is to detect cryptographic applications by branch instructions and dynamic time warping. The second step is to define a criterion for identifying between benign and malignant programs. CloudRadar believes an attack has occurred when the detected value surpasses this criterion. [PERSON] et al. [21] present a multi-layer detection approach based on machine learning. This approach collects microarchitecture events(e.g. branch misses, LLC accesses and LLC misses) when attacks occur. [PERSON] et al. train some machine learning models based on these events to detect attacks.  
The above work uses microarchitecture events as feature vectors for detection. Because the component capacity of the microarchitecture is very small, it is very susceptible to interference from the system load. This paper, unlike the previous work, detects cache side channel attacks by memory events. The memory capacity is very large, so the interference of the system load can be ignored. We will prove this point through experiments in Section 4.3. Moreover, our approach does not require pre-trained models, which makes it more adaptable to unknown system loads and hardware environments.  
Figure 1: Process of trace-driven attacks.