# Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor
## 3 Background  
### Cache Side Channel Attacks  
#### 3.1.1 Flush+Reload Attack  
Flush+Reload [1] is a cache side channel attack that aims at L3 or the Last Level Cache (LLC). For a modern Intel x86 multi-core architecture, each core has a separate L1 and L2 cache and an LLC shared by all of the cores. Owing to the cache inclusive property, the LLC can possibly allow information to be leaked through the cache to any malicious users or Virtual Machines (VMs). A virtualized environment, such as cloud services, sometimes uses memory sharing (i.e., content-based sharing, memory deduplication) to reduce the duplicated memory usage. In a general environment without using virtualization, the operating systems use content-aware sharing to share shared libraries and a shared code section. Despite the benefits of memory sharing, it can be used as a target of the cache side channel by sharing a physical page with a spy. By monitoring the shared LLC line, a spy knows whether the victim accesses the sensitive data in sharing pages. The Flush+Reload attack consists of three steps as follows. 1. FLUSH: A spy flushes the specific shared cache line by using a clflush instruction. 2. IDLE: Then, the spy waits for a predetermined amount of time while the victim executes sensitive operations. 3. RELOAD: The spy reloads the cache line from the shared memory. If it takes too long to reload the cache line, it means that the victim did not access the sensitive data in the shared page. However, if the reload time is short, the shared cache line is filled with the victim's data, which means that the victim accesses sensitive data. By using this reload time difference, the spy is able to infer the victim's access pattern for some sensitive data from the LLC cache line. Since Flush+Reload  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multicolumn{1}{c}{**Method**} & \multicolumn{1}{c}{**Tool**} & \begin{tabular}{c} **Performance** \\ **Counters** \\ \end{tabular} & \begin{tabular}{c} **Detected** \\ **Attacks** \\ \end{tabular} & \begin{tabular}{c} **Can Detect** \\ **Stealth Attack?** \\ \end{tabular} \\ \hline [PERSON] et al. [9] & Linux perf & LLC\_MISS & \begin{tabular}{c} Flush+Reload \\ Prime+Probe \\ \end{tabular} & No \\ \hline [PERSON] et al. [10] & Intel CMT & \begin{tabular}{c} L1\_MISS \\ LLC\_MISS \\ \end{tabular} & \begin{tabular}{c} Flush+Reload \\ Prime+Probe \\ \end{tabular} & No \\ \hline [PERSON] et al. [11] & Intel CMT & \begin{tabular}{c} L1\_MISS \\ LLC\_MISS \\ \end{tabular} & \begin{tabular}{c} Flush+Reload \\ Prime+Probe \\ \end{tabular} & No \\ \hline [PERSON] et al. [12] & Intel PCM & \begin{tabular}{c} L1\_INST\_MISS \\ L1\_INST\_HIT \\ LLC\_MISS \\ \end{tabular} & \
\begin{tabular}{c} Flush+Reload \\ Prime+Probe \\ \end{tabular} & No \\ \hline The proposed method & Intel PCM &
\begin{tabular}{c} IPC \\ L1\_MISS \\ L2\_MISS \\ LLC\_MISS \\ RETIRED\_BRANCH \\ \end{tabular} & Yes \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison to related works.  
has the highest resolution of cache side channel attacks, it is used not only to extract the secret key of various encryption algorithms, but it also obtains the victim's keystroke information. Because the attack uses the clflush instruction for the flush specific cache line iteratively, an increase in the L1, L2, and LLC miss occurs whenever the victim accesses the cache lines.