MAD-EN: Microarchitectural Attack Detection through System-wide Energy Consumption
Microarchitectural attacks have become more threatening the hardware security
than before with the increasing diversity of attacks such as Spectre and
Meltdown. Vendor patches cannot keep up with the pace of the new threats, which
makes the dynamic anomaly detection tools more evident than before.
Unfortunately, previous studies utilize hardware performance counters that lead
to high performance overhead and profile limited number of microarchitectural
attacks due to the small number of counters that can be profiled concurrently.
This yields those detection tools inefficient in real-world scenarios.
  In this study, we introduce MAD-EN dynamic detection tool that leverages
system-wide energy consumption traces collected from a generic Intel RAPL tool
to detect ongoing anomalies in a system. In our experiments, we show that
CNN-based MAD-EN can detect 10 different microarchitectural attacks with a
total of 15 variants with the highest F1 score of 0.999, which makes our tool
the most generic attack detection tool so far. Moreover, individual attacks can
be distinguished with a 98% accuracy after an anomaly is detected in a system.
We demonstrate that MAD-EN introduces 69.3% less performance overhead compared
to performance counter-based detection mechanisms.