DRsam: Detection of Fault-Based Microarchitectural Side-Channel Attacks in RISC-V Using Statistical Preprocessing and Association Rule Mining
Muhammad Hassan, Maria Mushtaq, Jaan Raik, Tara Ghasempouri
TL;DR
DRsam addresses the challenge of detecting flush+fault microarchitectural attacks on RISC-V by combining statistical preprocessing with association rule mining to yield robust, generalizable, and interpretable detection. The method uses a 3-sigma feature flagging step and Apriori-based rule generation with targeted antecedent sizes and thresholds, enabling detection of new attack variants while maintaining performance. Evaluated on the rv8 benchmark across cryptographic, computational, and memory-intensive workloads, DRsam shows improvements in accuracy, precision, and recall compared to state-of-the-art methods and provides human-readable rules that reveal underlying microarchitectural behavior during attacks. This approach offers a practical, transparent defense with reconfigurability for evolving microarchitectural threat landscapes on RISC-V systems.
Abstract
RISC-V processors are becoming ubiquitous in critical applications, but their susceptibility to microarchitectural side-channel attacks is a serious concern. Detection of microarchitectural attacks in RISC-V is an emerging research topic that is relatively underexplored, compared to x86 and ARM. The first line of work to detect flush+fault-based microarchitectural attacks in RISC-V leverages Machine Learning (ML) models, yet it leaves several practical aspects that need further investigation. To address overlooked issues, we leveraged gem5 and propose a new detection method combining statistical preprocessing and association rule mining having reconfiguration capabilities to generalize the detection method for any microarchitectural attack. The performance comparison with state-of-the-art reveals that the proposed detection method achieves up to 5.15% increase in accuracy, 7% rise in precision, and 3.91% improvement in recall under the cryptographic, computational, and memory-intensive workloads alongside its flexibility to detect new variant of flush+fault attack. Moreover, as the attack detection relies on association rules, their human-interpretable nature provides deep insight to understand microarchitectural behavior during the execution of attack and benign applications.