Detection of side channel attacks between virtual machines

摘要

Technologies are directed to a detector to identify a side channel attack between virtual machines. According to some examples, an inter-processor interrupt (IPI) rate of a first virtual machine (VM), a time stamp counter (TSC) rate of a second VM, and a cache miss ratio (CMR) of a third VM may be monitored. A side channel attack may then be detected based on the IPI rate, the TSC rate, and the CMR.

主权项

1. A method to detect a side channel attack between virtual machines, the method comprising:
monitoring an inter-processor interrupt (IPI) rate of a first virtual machine (VM); monitoring a time stamp counter (TSC) rate of a second VM; monitoring a cache miss ratio (CMR) of a third VM; detecting the side channel attack based on the IPI rate, the TSC rate, and the CMR; and labeling the third VM as a victim candidate in response to a detection that the CMR exceeds a predetermined CMR threshold.