Anomaly-Based Detection of Microarchitectural Attacks for IoT Devices

With the rapid growth of Internet of Things (IoT) technology, the number of connected devices and information processed through the Internet has significantly risen. As a result, cyber-attacks targeting vulnerable IoT devices have also dramatically increased. Microarchitectural attacks pose a serious threat to IoT security because they can not only leak confidential information to adversaries through shared processor resources such as caches, branch predictors and various functional units but also fully compromise the embedded system devices themselves. Traditional signature-based antivirus software cannot effectively detect microarchitectural attacks, particularly zero-day attacks. In this paper, an anomaly-based detector for IoT devices is developed to demonstrate the feasibility of detecting unknown microarchitectural attacks for resource-constrained devices using features collected from hardware performance counters with unsupervised machine learning and feature selection methods. Our experiments show promising detection results for the tested devices. The methodology will be used to guide the development of such detectors for similar IoT devices.