MAD-EN: Microarchitectural Attack Detection Through System-Wide Energy Consumption
Published in IEEE Transactions on Information Forensics and Security (IEEE TIFS), 2023
Most dynamic detectors for microarchitectural attacks rely on hardware performance counters, which add significant overhead and can monitor only a few events at once. MAD-EN instead uses system-wide energy consumption traces collected through Intel’s Running Average Power Limit (RAPL) interface. A CNN-based classifier detects 10 attack types spanning 15 variants, including Spectre and Meltdown, with a best F1 score of 0.999. Once an anomaly is flagged, individual attacks are distinguished with 98% accuracy. Compared with performance counter-based detection, MAD-EN reduces performance overhead by 69.3%.
Recommended citation: D. R. Dipta and B. Gulmezoglu, "MAD-EN: Microarchitectural Attack Detection Through System-Wide Energy Consumption," IEEE Transactions on Information Forensics and Security (IEEE TIFS), vol. 18, pp. 3006-3017, 2023.
Download Paper