The ABCs of PMCs for Attack Detection

Presented by

Nick Gregory, Research Scientist, Capsule8 and Harini Kannan, Data Scientist, Capsule8

About this talk

A deep dive into novel hardware performance counters and how we use ML to sift through them. Hardware Performance Counters constitute a treasure trove of data, which surprisingly remains pretty much untouched by modern research, except for a few well known counters. In recent years, exploits like Spectre and Rowhammer and general techniques like Return Oriented Programming (ROP) were detected using hardware performance counters (HPCs). But to date, only relatively simple and well-understood counters have been used, representing just a tiny fraction of the information we can glean from the system. In this webinar, we’ll show how we used ML to find non-intuitive counters to build much more effective detection models against cache side channel attacks than ones previously tested in the industry. These new models are more accurate than prior cache-miss based models, and harder for attackers to bypass. We’ll also discuss the undocumented performance counters that we found as part of our Blackhat 2020 research, and the various attacks that models built with them could detect.

Related topics:

More from this channel

Upcoming talks (0)
On-demand talks (16)
Subscribers (1060)
Capsule8 provides modern enterprises scalable Linux workload protection. The pioneer behind “ops-friendly” Linux security, Capsule8 Protect is purpose-built to deliver monitoring, detection and response with a single agent that can be deployed across heterogenous production environments. By using Capsule8, security teams have the visibility needed to detect incidents and protect against unwanted behavior, allowing them reduce downtime and avoid costly business disruption.