CloudRadar: A Real Time Side Channel Attack Detection System in Clouds
We present CloudRadar, a system to detect, and hence mitigate, cache based side channel attacks in multi tenant cloud systems. CloudRadar operates by correlating two events: first, it exploits signature based detection to identify when the protected virtual machine (VM) executes a cryptographic application; at the same time, it uses anomaly based detection techniques to monitor the co located VMs to identify abnormal cache behaviors that are typical during cache based side channel attacks. We show that correlation in the occurrence of these two events offer strong evidence of side channel attacks. Compared to other work on side channel defenses, CloudRadar has the following advantages: first, CloudRadar focuses on the root causes of cache based side channel attacks and hence is hard to evade using metamorphic attack code, while maintaining a low false positive rate. Second, CloudRadar is designed as a lightweight patch to existing cloud systems, which does not require new hardware support, or any hypervisor, operating system, application modifications. Third, CloudRadar provides real time protection and can detect side channel attacks within the order of milliseconds. We demonstrate a prototype implementation of CloudRadar in the OpenStack cloud framework. Our evaluation suggests CloudRadar achieves negligible performance overhead with high detection accuracy.
RAID