A Machine Learning Based Monitoring Framework for Side-Channel Information Leaks
Michael Lescisin, Qusay H. Mahmoud · IEEE Open Journal of the Computer Society · 2021
Computer and network security is an ever important field of study as information processed by these systems is of ever increasing value. The state of research on direct attacks, such as exploiting memory safety or shell input errors is well established and a rich set of testing tools are available for these types of attacks. Machine-learning based intrusion detection systems are also available and are commonly deployed in production environments. What is missing, however, is the consideration of implicit information flows, orside-channels. Research has revealed side-channels formed by everything from CPU acoustic noise, to encrypted network traffic patterns, to computer monitor ambient light. Furthermore, no portable method exists for distributing side-channel test cases. This paper introduces a framework for adversary modeling and feedback generation on what the adversary may learn from the various side-channel information sources. The framework operates by monitoringtwodata streams; the first being the stream of side-channel cues, and the second being the stream of private system activity. These streams are used fortrainingandevaluatingamachine learning classifierto determine its performance of private system activity prediction. A prototype has been built to evaluate side-channel effects onfourpopular scenarios.