A Survey of Cyber Security Countermeasures Using Hardware Performance Counters
This is a survey paper, so it is incremental, summarizing existing approaches for cybersecurity practitioners and researchers.
The paper surveys recent techniques that use hardware performance counters in modern processors for cyber attack detection, highlighting their promise for effective countermeasures with minimal overhead and resistance to sabotage.
Cyber attacks and malware are now more prevalent than ever and the trend is ever upward. There have been several approaches to attack detection including resident software applications at the root or user level, e.g., virus detection, and modifications to the OS, e.g., encryption, application signing, etc. Some approaches have moved to lower level detection and preven- tion, e.g., Data Execution Prevention. An emerging approach in countermeasure development is the use of hardware performance counters existing in the micro-architecture of modern processors. These are at the lowest level, implemented in processor hardware, and the wealth of data collected by these counters affords some very promising countermeasures with minimal overhead as well as protection from being sabotaged themselves by attackers. Here, we conduct a survey of recent techniques in realizing effective countermeasures for cyber attack detection from these hardware performance counters.