Detector+: an approach for detecting, isolating, and preventing timing attacks

Javeed, Arsalan and Yılmaz, Cemal and Savaş, Erkay (2021) Detector+: an approach for detecting, isolating, and preventing timing attacks. Computers and Security, 110 . ISSN 0167-4048 (Print) 1872-6208 (Online)

Full text not available from this repository. (Request a copy)


In this work, we present a novel approach, called Detector+, to detect, isolate, and prevent timing-based side channel attacks (i.e., timing attacks) at runtime. The proposed approach is based on a simple observation that the time measurements required by the timing attacks differ from those required by the benign applications as these attacks need to measure the execution times of typically quite short-running operations. Detector+, therefore, monitors the time readings made by processes and mark consecutive pairs of readings that are close to each other in time as suspicious. In the presence of suspicious time measurements, Detector+ introduces noise into the measurements to prevent the attacker from extracting information by using these measurements. The sequence of suspicious time measurements are then analyzed by using a sliding window based approach to pinpoint the malicious processes at runtime. We have empirically evaluated the proposed approach by using five well known timing attacks, including Meltdown, together with their variations, representing some of the mechanisms that an attacker can employ to become stealthier. In one evaluation setup, each type of attack was carried out concurrently by multiple processes. In the other setup, multiple types of attacks were carried out concurrently. In all the experiments, Detector+ detected all the malicious time measurements with almost a perfect accuracy, prevented all the attacks, and correctly pinpointed all the malicious processes involved in the attacks without any false positives after they have made a few time measurements with an average runtime overhead of 1.56%.
Item Type: Article
Uncontrolled Keywords: Isolation and prevention; Runtime attack detection; Side channel attacks; Timing attacks
Divisions: Faculty of Engineering and Natural Sciences
Depositing User: Cemal Yılmaz
Date Deposited: 29 Aug 2022 14:48
Last Modified: 29 Aug 2022 14:48

Actions (login required)

View Item
View Item