Scholarlink

<p>Modern high-performance processors rely on speculative execution to improve throughput, but this optimization has enabled microarchitectural side-channel attacks that can leak sensitive information, including cryptographic keys and confidential data. Although mitigations such as Indirect Branch Restricted Speculation (IBRS), Retpoline, and microcode updates have reduced exposure to classical Spectre (v1–v3) and Meltdown-style attacks, recent work has highlighted <i>interleaved</i> speculative-execution attacks in which malicious gadgets are injected at extremely low duty cycles into otherwise normal execution. The intermittent nature of such interleaving significantly degrades the sensitivity of Performance Monitoring Counter (PMC)-based detectors that rely on magnitude thresholds or short-window aggregate statistics, thereby complicating reliable detection. We present <i>AISELF</i>, an automated framework for detecting interleaved speculative-execution behaviour using PMC. Building on our prior feasibility study on PMC-based detection for known speculative-execution attacks, AISELF combines LLM-driven automation with statistically principled anomaly testing. Given the user’s workload and system configuration, AISELF recommends a ranked top-<Emphasis Type="BoldItalic">k</Emphasis> set of architecture-valid PMU events (default <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(\varvec{k=5}\)</EquationSource> </InlineEquation>) to monitor on the target platform. The user collects raw PMC traces for these events while executing the workload, and AISELF then applies deterministic, Hartigan’s Dip Test with multiple-testing to identify multimodality indicative of rare interleaving. When the initial event set is not sufficiently discriminative, AISELF invokes an automated refinement loop that iteratively updates the monitored event set to improve detection sensitivity under the same measurement budget. Overall, AISELF provides a practical and reproducible workflow for identifying low-duty-cycle interleaved speculative-execution activity from PMC telemetry while minimizing manual PMU expertise requirements.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

AISELF: An LLM-based Automated Interleaved Speculative-Execution Leakage Detection Framework

  • 期刊论文

  • 发表日期：

    2026年4月7日

查看全文
  • Upasana Mandal,
  • Rupali Kalundia,
  • Nimish Mishra,
  • Shubhi Shukla,
  • Sarani Bhattacharya,
  • Debdeep Mukhopadhyay

摘要

Modern high-performance processors rely on speculative execution to improve throughput, but this optimization has enabled microarchitectural side-channel attacks that can leak sensitive information, including cryptographic keys and confidential data. Although mitigations such as Indirect Branch Restricted Speculation (IBRS), Retpoline, and microcode updates have reduced exposure to classical Spectre (v1–v3) and Meltdown-style attacks, recent work has highlighted interleaved speculative-execution attacks in which malicious gadgets are injected at extremely low duty cycles into otherwise normal execution. The intermittent nature of such interleaving significantly degrades the sensitivity of Performance Monitoring Counter (PMC)-based detectors that rely on magnitude thresholds or short-window aggregate statistics, thereby complicating reliable detection. We present AISELF, an automated framework for detecting interleaved speculative-execution behaviour using PMC. Building on our prior feasibility study on PMC-based detection for known speculative-execution attacks, AISELF combines LLM-driven automation with statistically principled anomaly testing. Given the user’s workload and system configuration, AISELF recommends a ranked top-k set of architecture-valid PMU events (default \(\varvec{k=5}\) ) to monitor on the target platform. The user collects raw PMC traces for these events while executing the workload, and AISELF then applies deterministic, Hartigan’s Dip Test with multiple-testing to identify multimodality indicative of rare interleaving. When the initial event set is not sufficiently discriminative, AISELF invokes an automated refinement loop that iteratively updates the monitored event set to improve detection sensitivity under the same measurement budget. Overall, AISELF provides a practical and reproducible workflow for identifying low-duty-cycle interleaved speculative-execution activity from PMC telemetry while minimizing manual PMU expertise requirements.