# Real-Time Detection for Cache Side Channel Attack using Performance Counter Monitor
## 6 Evaluation  
In this section, we conduct several experiments and validate the effectiveness of the proposed detection technique. Specifically, we evaluate our detection method by testing whether the machine learning model was able to detect cache side channel attacks in several environments. In order to evaluate the performance of the detection program, we set up two execution environments as described in Section 5.1. In the virtualized environment, we used KVM (Kernel-based Virtual Machine) as a hypervisor and Linux Ubuntu 18.04 LTS (64 bits) as the guest operating systems. In the single OS environment, we set up Ubuntu 18.04 LTS as a host operating system. To validate the wide applicability to various processor models, we performed experiments on six hosts in total with different processor models including Intel Xeon and Core. We also needed to evaluate the detection performance in practical environments where the detection program ran concurrently with other benign applications. In our experiment, we simulated the activities of benign applications by using a _stress-ng_ tool. The stress-ng incurs stress on various system components such as CPU, memory, and I/O. As our program attempted to detect malicious behavior based on cache activities, we used the stress-ng with an option \"-c\" that incurred stress on the CPU cache. The experimental results are presented in Tables 3 and 4, for the virtualized environment and the single OS environment, respectively. The detection rate was measured by counting the number of success in detection within five seconds after mounting the cache side channel attack. In the experiment, we set the time limit of detection to five seconds. This was based on the results of previous work that studied the minimal amount of time to recover target's secret through cache side channel attacks [18]. The time in the tables refers to the elapsed time of successfully detecting the attacks. The detection program was first tested on the Intel Xeon(r) E5-2620 v4, which was used to build the model and run the experiments. The _htop_ tool was used to check the CPU usage in real time of the detection program and to evaluate the program with several applications. According to the experimental results, high detection rates and a low CPU usage were observed in the E5-2620 v4 to detect all of the attacks. In order to verify the performance of the detection program for the different CPUs, we had to learn whether the umask and the event that were used in Table 2 were the same as in the other microarchitectures. The event and umask of the Broadwell, Kaby Lake, and Coffee Lake microarchitectures are found in Intel's Software Developer Manuals. In addition, the values were checked to make sure they were the same as Table 2. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**CPU (Codename)**} & \multicolumn{4}{c}{**Normal (No Stress)**} & \multicolumn{4}{c}{**Cache Stress (stress-ng)**} \\ \cline{2-7}  & **Detection Rate (\%)** & **Time (second)** & **CPU Usage (\%)** & **Detection Rate (\%)** & **Time (second)** & **CPU Usage (\%)** \\ \hline Intel Xeon® E5-2620 v4 2.10 GHz (Broadwell) & 98.4\% & 1.9 & 0.6\% & 92.5\% & 2.1 & 0.9\% \\ \hline Intel Xeon® E3-1275 v6 3.80 GHz (Kaby Lake) & 97.1\% & 1.9 & 0.8\% & 91.9\% & 2.2 & 0.9\% \\ \hline Intel CoreTM i5-7400 3.00 GHz (Kaby Lake) & 96.2\% & 1.8 & 0.7\% & 92.9\% & 2.3 & 0.8\% \\ \hline Intel CoreTM i7-7700 3.60 GHz (Kaby Lake) & 98.7\% & 1.9 & 0.8\% & 92.3\% & 2.2 & 1.1\% \\ \hline Intel CoreTM i7-9700 3.60 GHz (Coffee Lake) & 94.5\% & 1.7 & 0.9\% & 92.9\% & 2.4 & 1.1\% \\ \hline Intel CoreTM i5-5250U 1.6 GHz (Broadwell) & 97\% & 1.8 & 0.9\% & 92.8\% & 2.2 & 0.8\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Experiment results in the virtualized environment. In order to verify the exact attack only, programs were found that could change the counter values used in the detection program, but were not attacked.