Leveraging Processor Performance Counters for Security and Performance
Jakub M. Szefer · 2015
Modern processors come equipped with hundreds of hardware performance counters, which count variety of events in the processor, anything from floating point operations retired to cache misses. In recent years researchers have begun to use these performance counters to characterize and detect malicious software. In parallel, researchers have also explored using the performance counter data for performance and energy usage optimizations. Prior research has done quite well at detecting malware, but most of the efforts have not explored proactive schemes where the system is actually able to react to the potentially suspicious behavior in real time. Also, security and performance work has been done separately. In this talk we introduce our recent research project dealing with leveraging processor performance counters to characterize program behavior, predict upcoming program phases, and schedule applications based on the predicted behavior in order to improve both security and performance. The project leverages machine learning and resulting prototype runs in real-time on commodity hardware in a modified Linux scheduler. This is joint work with Junaid Nomani.