Abstract: A hardware framework for cyber-deception operations provides flexibility in formulating counterattacks and leverages hardware support for efficiency. Hardware-assisted deception primitives are provided at kernel crossing boundaries to privileged system features that propel the security defenses to dynamically manipulate the malware execution and present a deceptive view of the system state to the attackers. Malware may be in the form of various attack vectors including ransomware, infostealers, buffer overflow, and side-channels.

Abstract: A system and method for defense against cache timing channel attacks using cache management hardware is provided. Sensitive information leakage is a growing security concern exacerbated by shared hardware structures in computer processors. Recent studies have shown how adversaries can exploit cache timing channel attacks to exfiltrate secret information. To effectively guard computing systems against such attacks, embodiments disclosed herein provide practical defense techniques that are readily deployable and introduce only minimal performance overhead. In this regard, a new protection framework against cache timing channel attacks is provided herein by leveraging commercial off-the-shelf (COTS) hardware support in processor caches, including last level caches (LLC), for cache monitoring and partitioning. This framework applies signal processing techniques on per-domain cache occupancy data to identify suspicious application contexts.

Abstract: A system and method for defense against cache timing channel attacks using cache management hardware is provided. Sensitive information leakage is a growing security concern exacerbated by shared hardware structures in computer processors. Recent studies have shown how adversaries can exploit cache timing channel attacks to exfiltrate secret information. To effectively guard computing systems against such attacks, embodiments disclosed herein provide practical defense techniques that are readily deployable and introduce only minimal performance overhead. In this regard, a new protection framework against cache timing channel attacks is provided herein by leveraging commercial off-the-shelf (COTS) hardware support in processor caches, including last level caches (LLC), for cache monitoring and partitioning. This framework applies signal processing techniques on per-domain cache occupancy data to identify suspicious application contexts.

Abstract: A system detects a covert timing channel on a combinational structure or a memory structure. The system identifies the events behind conflicts, and constructs an event train based on those events. For combinational structures, the system detects recurrent burst patterns in the event train. The system determines that a covert timing channel exists on the combinational structure if a recurrent burst pattern is detected. For memory structures, the system detects oscillatory patterns in the event train. The system determines that a covert timing channel exists on the memory structure if an oscillatory pattern is detected.

Abstract: Techniques described herein improve processor performance in situations where a large number of system service requests are being received from other devices. More specifically, upon detecting that certain operating conditions that indicate a processor slowdown are present, the processor performs one or more system service adjustment techniques. These techniques include throttling (reducing the rate of handling) of such requests, coalescing (grouping multiple requests into a single group) the requests, disabling microarchitctural structures (such as caches or branch prediction units) or updates to those structures, and prefetching data for or pre-performing these requests. Each of these adjustment techniques helps to reduce the number of and/or workload associated with servicing requests for system services.

Abstract: A system detects a covert timing channel on a combinational structure or a memory structure. The system identifies the events behind conflicts, and constructs an event train based on those events. For combinational structures, the system detects recurrent burst patterns in the event train. The system determines that a covert timing channel exists on the combinational structure if a recurrent burst pattern is detected. For memory structures, the system detects oscillatory patterns in the event train. The system determines that a covert timing channel exists on the memory structure if an oscillatory pattern is detected.