# Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor
## 7 Conclusions and Future Work  
This article proposed a runtime detection technique for the cache side channel attacks by using the Intel PCM counters and machine learning algorithms. We showed that the proposed detection method was effective at detecting cache side channel attacks by using newly identified hardware counters. These counters included the IPC (Instruction Per Cycle), L3 cache miss, L2 cache miss, L1 cache miss, and the speculative and retired branch counters. By using hardware performance counters, we trained the machine learning model to detect attacks targeting the L3 cache. This study demonstrated that the proposed technique could distinguish all kinds of cache side channel attacks  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**CPU (Codename)**} & \multicolumn{4}{c}{**Normal (No Stress)**} & \multicolumn{4}{c}{**Cache Stress (Stress-ng)**} \\ \cline{2-7}  & **Detection Rate (\%)** & **Time (second)** & **CPU Usage (\%)** & **Detection Rate (\%)** & **Time (second)** & **CPU Usage (\%)** \\ \hline Intel Xeon® E5-2620 v4 2.10 GHz (Broadwell) & 100\% & 1.5 & 0.7\% & 95\% & 1.8 & 0.9\% \\ \hline Intel Xeon® E3-1275 v6 3.80 GHz (Kaby Lake) & 99.8\% & 1.6 & 0.7\% & 94.1\% & 1.9 & 0.9\% \\ \hline Intel CoreTM i5-7400 3.00 GHz (Kaby Lake) & 99.6\% & 1.6 & 0.6\% & 94.2\% & 1.9 & 0.8\% \\ \hline Intel CoreTM i7-7700 3.60 GHz (Kaby Lake) & 99.2\% & 1.7 & 0.7\% & 94.3\% & 1.9 & 0.9\% \\ \hline Intel CoreTM i7-9700 3.60 GHz (Coffee Lake) & 99.5\% & 1.5 & 0.7\% & 95.6\% & 1.8 & 0.9\% \\ \hline Intel CoreTM i5-5250U 1.6 GHz (Broadwell) & 100\% & 1.5 & 0.6\% & 95.4\% & 1.8 & 0.9\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Experiment results in the single OS environment.  
with more than 90% probability in real time. Besides, we showed that a trained model could detect many environments based on rigorous evaluation. By training the machine learning model through a short training process, our method was able to detect all kinds of cache side channel attacks, even in environments where misdetection would occur. This study used other factors, including cache misses, to detect the attack process. Therefore, we expect that our technique may be able to successfully detect any unidentified cache-based side channel attacks. Although our evaluation showed that the proposed method was feasible in an experimental setting, there are some remaining issues to be solved for practical deployment. Concerning security, the proposed method will be vulnerable if an attacker has privileged access to the critical resources (e.g., a CSV file) for running the detection program. Furthermore, from the performance perspective, the latency in reading and parsing the CSV file will be intolerable in the practical system where real-time detection is necessary. In our future work, we will address those remaining problems and continue our study to improve the proposed method.  
[PERSON] mainly wrote this article. [PERSON]. ([PERSON]), [PERSON], [PERSON], and [PERSON] ([PERSON]) contributed to this work by conducting experiments and performance analysis. [PERSON] revised this article and contributed to the performance analysis. All authors have read and agreed to the published version of the manuscript.  
This research was supported by the MIST (Ministry of Science and ICT) under the National Program for Excellence in SW (2017-0-00096) supervised by the IITP (Institute for Information & communications Technology Planning & Evaluation) and was supported by the IITP grant funded by the Korea government (MSIT) (No. 2019-0-00533, Research on CPU vulnerability detection and validation).  
The authors declare no conflict of interest.