Search papers, labs, and topics across Lattice.
This paper introduces ANTMAN, a novel RTL-level runtime detection framework specifically designed to identify stealthy branch predictor attacks on BOOM RISC-V architecture. By leveraging offline-extracted association rules embedded in hardware, ANTMAN achieves high detection speed and accuracy without false positives, effectively terminating execution before any sensitive information is disclosed. The results demonstrate its capability to adaptively detect new variants of branch predictor attacks, addressing a critical gap in microarchitectural attack defenses for RISC-V systems.
ANTMAN achieves zero false positives and rapid detection of stealthy branch predictor attacks, redefining runtime security for RISC-V architectures.
Runtime detection of microarchitectural side channel attacks remains significantly underexplored in RISCV compared with x86 and ARM ISAs, posing a serious threat to critical applications. State-of-the-art branch predictor attacks bypass traditional data and instruction caches by directly exploiting the state of internal history tables, making them inherently stealthy. Recent research has explored offline detection of microarchitectural attacks on RISC-V; however, efficient runtime detection of microarchitectural attacks on RISC-V hardware remains significantly unaddressed. State-of-the-art hardware-based runtime detection solutions leverage hardware performance counters (HPCs) but suffer from a restricted set of counter registers and tradeoffs between detection accuracy, detection speed, and sampling granularity, making them impractical for stealthy attacks. Moreover, sampling HPCs after distinct intervals leaves intermediate relationships between different microarchitectural blocks unobserved. Additionally, proprietary x86 and ARM ISAs constrain researchers from modifying processor microarchitectural designs. To address these limitations, we propose the first secure-by-design, highly interpretable, non-intrusive, RTL-level runtime detection solution for stealthy branch predictor attacks on BOOM RISC-V, evaluated under both simplified Next-Line Predictor (NLP) and complex TAGE predictor configurations. The attack detection relies on association rules extracted offline and embedded in hardware as a non-intrusive rule monitor that enables runtime detection. The proposed approach achieves excellent detection speed, terminates execution before secret disclosure, and produces zero false positives while remaining flexible for detecting previously unseen variants within the same family of branch predictor attacks.
