Kubernetes has emerged as the de facto standard for container orchestration. However, existing container scheduling strategies prioritize QoS, leading to the co-location of pods with varying permission levels on the same node. This not only introduces risks of privilege escalation but also facilitates the spread of pods with risky permissions across the cluster, exacerbating the potential for attackers to elevate their privileges. In this work, our goal is to mitigate permission disparity among pods on each node, thereby reducing the risk of privilege escalation from co-location attack and curbing the spread of high-risk permissions across the cluster. We introduce a novel metric, Extraneous Risk Privileges (ERP), to quantify additional privileges derived from the combination of RBAC permissions and cluster parameters that are utilized by other pods on the node but not by the target pod itself. The RBAClock scheduling framework is designed to minimize ERP increase during pod placement, prioritizing the aggregation of pods with similar risk profiles and isolation of those with divergent privileges. Experimental evaluations across 24 CNCF applications demonstrate that, compared to the default scheduler, RBAClock alone achieves an average reduction of 41.46% in aggregated privileges in cluster, 64.63% in privilege escalation risk, and 34.59% in high-privilege nodes proportion, with an 8% performance tradeoff. Notably, our investigation uncovered privilege escalation risks in the Kubernetes services of two major cloud providers, Alibaba Cloud and Tencent Cloud, and demonstrated that RBAClock can effectively mitigate these threats.

Intel Software Guard Extensions (SGX) protect sensitive content of applications on the cloud platform by creating an isolated environment on an untrusted operating system. However, resent works have shown that the SGX is vulnerable to a variety of transient execution attacks. Unfortunately, there is a lack of a systematic approach to describing transient execution attacks in the SGX environment. In this paper, we start by exploring the principles of generating transient execution attacks in SGX. Building upon the topological sort graph (TSG) model and incorporating data flow analysis, we propose a security problem description model for transient execution attacks in SGX, named S-TSG (SGX topological sort graph). We propose a new modeling approach that combines formal description characteristics and data flow analysis technology for transient execution attacks in SGX on the basis of TSG model. By applying S-TSG model to transient execution attacks and defense methods in SGX, we prove that the effectiveness of the S-TSG model in analyzing the transient execution attack principles and the evaluation of defense methods in SGX.

With the widespread use of modern browser extensions, user experience has been significantly enhanced via embedding ancillary functionality into the original webpage. The rapid development of Web tracking technology has raised privacy and security concerns, as it generates a unique identifier for users according to the diversity of installed extensions and further prompts the profiling of users. However, due to the ignorance of potential privacy risks, there is no effective method to detect browser extension fingerprinting. In this paper, we propose ExtFPDet, a CNN-based detection framework to recognize browser extension fingerprinting in websites, which fills the gap in this area. Based on the preliminary investigation, the approaches to fingerprint browser extensions can be summarized into 2 categories according to the distinctive behaviors, including resource traversing and side-channel exploring. In order to extract effective features to reflect extensions fingerprinting, ExtFPDet focuses on the structure and content in the program dependency graph of Javascript files. The generated feature vector assists the CNN-based classification model to detect the extension fingerprinting, for which we perform a systematic detection on Tranco top 10K websites. Eventually, the result is evaluated by randomly sampling and manually checking, which shows superior detection capabilities of ExtFPDet.

Contemporary research on cache side-channel attack detection frequently emphasizes accuracy while overlooking crucial factors such as overhead and detection speed. In response to these challenges, we analyze the combined effect of detection speed on system loss and detection accuracy. We find that increasing the hardware event sampling rate not only results in excessive system loss but also decreases the accuracy of constructed cache side-channel attack detection. In this paper, we verify on different hardware platforms that establishing a critical hardware event sampling interval is essential for constructing effective attack detection. This allows for the quick and accurate identification of three cache side-channel attacks while keeping system overhead low. Through experiments, we determined that the critical hardware event sampling interval for the two hardware platforms used in this paper is close to 500 us. The accuracy of the attack detection constructed on the I5-7200U platform finally reaches 97.39

Trusted execution environments based on RISC-V architecture like Keystone remain susceptible to leaking page access patterns of applications via simple demand paging, in which a malicious Operating System (OS) deduces sensitive information from it. To address this issue, Keystone requires protecting sensitive access patterns from being revealed to the malicious OS by implementing oblivious demand paging. In this paper, we use Oblivious RAM (ORAM) techniques that obfuscate access patterns while simultaneously making demand paging oblivious for Keystone. Furthermore, we present customized optimizations to Ring ORAM, aimed at minimizing the performance overhead incurred by applications during both secure and unsecure demand paging in Keystone. These optimizations encompass strategies such as encoding the position map within the page table, utilizing a resizable tree structure and selective eviction of only the root bucket. These improvements collectively contribute to minimizing performance slowdown. We implement and evaluate our optimized Ring ORAM for oblivious demand paging, which shows the average performance slowdown of 7.1x in comparison to the simple Ring ORAM slowdown of 26.2x.

In the relentless pursuit of bolstering processor performance, computer architects have harnessed a gamut of sophisticated optimization techniques. However, this pursuit of performance enhancements has inadvertently laid bare an underbelly of concealed security vulnerabilities, exemplified by notorious instances such as Meltdown and Spectre attacks. These attacks adeptly exploit optimization techniques, coupled with cache side-channel attacks, to expose protected data. The ripple effects of these vulnerabilities are indeed seismic, owing to their pervasive presence across existing and forthcoming processors. Regrettably, Meltdown and Spectre have remained elusive to satisfactory mitigation to date; instead, Spectre and Meltdown attack variations have sprung forth from them. In response to this challenge, this paper posits an approach. It proposes the optimization of four distinctive hardware performance events through feature selection, subsequently harnessing the prowess of machine learning algorithms to forge a real-time detection mechanism. This mechanism is primed to combat Spectre V1, V2, V4, and Meltdown attack variations, culminating in a robust accuracy rate exceeding 99%. This resounding success demonstrates that this paper’s framework not only confronts original attacks but also grapples effectively with diverse attack variants, a scenario that might manifest in everyday contexts.

Processors are an important component of computer systems, but resource sharing in space and time, as well as performance first design concepts, result in a series of security issues for processors. On the one hand, processor security evaluation can systematically analyze and verify the security of the processor, deduce the key reasons for security risks, and on the other hand, it can assist in processor design, verifying processor security at a lower cost at the beginning of the design, compared to later software and hardware protection.This paper proposes a module level security evaluation method based on model checking, modeling the module as a mealy finite state machine to analyze the relationship between its outputs, inputs and states. Computational Logic Tree (CTL) is used to represent possible execution paths, and all paths are traversed to derive counterexample paths to represent possible attack paths and information leakage processes. We use the Common Vulnerability Scoring System(CVSS) to score each counterexample path. Based on these counterexample paths and CVSS scores, we ultimately obtained a total risk score to represent the security of the module. We conduct a case study on Cache to verify the effectiveness of our proposed method.

Microarchitectural side-channel attacks (SCAs) have gained increasing attention in the security community and cache timing is one of the most popular microarchitectural side-channels. However, most researches have focused on proposing novel cache attacks and defenses and there is limited work in understanding and analyzing the vulnerabilities of cache itself. This paper proposes a novel three-step model to analyze cache timing-based side channel vulnerabilities. In our model, the states and state transition relationships of cache lines are modeled through valid bits, dirty bits and replacement control bits in cache line composition. Our model distinguishes the different impacts of read access and write access through dirty bits, further considering the observable timing differences caused by write-back strategies. The model comprehensively covers cache timing-based attack surface and derive all possible exploitable cache timing-based vulnerabilities. As a result, we have derived in total 336 exploitable cache vulnerabilities, of which 248 are new.

The disclosure of Spectre and Meltdown vulnerabilities has significantly challenged processor security, exposing inherent flaws in microarchitectural design and revealing the limitations of existing countermeasures. Despite extensive mitigation efforts, completely preventing information leakage resulting from speculative execution continues to pose a significant challenge. A significant gap remains in the lack of a quantitative evaluation framework that rigorously assesses the effectiveness of these mitigation strategies. In this research, the SPECTECTOR analytical framework is utilized to introduce two novel quantitative metrics: Relative Leakage Entropy (RLE) and Normalized Conditional Entropy (NCE). These metrics are designed to evaluate the relative information leakage between speculative and non-speculative execution traces, providing distinct insights on leakage quantification. By utilizing these metrics to assess 15 example programs compiled with Intel ICC and CLANG compilers across different optimization levels and mitigation strategies, the analysis reveals that compiler optimization strategies markedly affect the magnitude of information leakage. The results indicate that, despite advanced mitigation techniques, substantial information leakage persists, highlighting the need for more effective security architectures in future processors and software systems.

Several deep neural networks are vulnerable to adversarial samples that are imperceptible to humans. To address this challenge, a range of techniques have been proposed to design more robust model architectures. However, previous research has primarily focused on identifying atomic structures that are more resilient, while our work focuses on adapting the model in two spatial dimensions: width and depth. In this paper, we present a multi-objective neural architecture search (NAS) method that searches for optimal widths for different layers in spatial dimensions, referred to as DW-Net. We also propose a novel adversarial sample generation technique for one-shot that enhances search space diversity and promotes search efficiency. Our experimental results demonstrate that the proposed optimal neural architecture outperforms state-of-the-art NAS-based networks widely used in the literature in terms of adversarial accuracy, under different adversarial attacks and for different-sized tasks.

Intel Software Guard Extensions (SGX) protect sensitive content of applications on the cloud platform by creating an isolated environment on an untrusted operating system. However, resent works have shown that the SGX is vulnerable to a variety of side channel attacks which could be severely damage the data confidentiality provided by SGX, such as the cache side channel attack. Unfortunately, existing defense mechanisms either provide an incomplete protection or incur too much performance costs. In this paper, we propose a defense countermeasure against cache side channel attacks for SGX by detecting abnormal each level cache use behaviors. We create auxiliary threads for each enclave thread and detect when asynchronous enclave exits (AEX) occur, which defeats the condition of L1/L2 cache side channel attacks that attacker and victim threads execute in the same physical core. We put some guard data to the cache lines and inspect access time, which detects last level cache eviction set behaviors. More importantly, we utilize optimizations to reduce the performance overhead caused by AEX detection. In comparison to existing approaches, our design is secure against any cache level side channel attacks and its performance loss increases less.

Cyber attackers have constantly updated their attack techniques to evade antivirus software detection in recent years. One popular evasion method is to execute malicious code and perform malicious actions only in memory. Malicious programs that use this attack method are called memory-resident malware, with excellent evasion capability, and have posed huge threats to cyber security. Traditional static and dynamic methods are not effective in detecting memory-resident malware. In addition, existing memory forensics detection solutions perform unsatisfactorily in detection rate and depend on massive expert knowledge in memory analysis. This paper proposes MRm-DLDet, a state-of-the-art memory-resident malware detection framework, to overcome these drawbacks. MRm-DLDet first builds a virtual machine environment and captures memory dumps, then creatively processes the memory dumps into RGB images using a pre-processing technique that combines deduplication and ultra-high resolution image cropping, followed by our neural network MRmNet in MRm-DLDet to fully extract high-dimensional features from memory dump files and detect them. MRmNet receives the labeled sub-images of the cropped high-resolution RGB images as input of ResNet-18, which extracts the features of the sub-images. Then trains a network of gated recurrent units with an attention mechanism. Finally, it determines whether a program is memory-resident malware based on the detection results of each sub-image through a specially designed voting layer. We created a high-quality dataset consisting of 2,060 benign and memory-resident programs. In other words, the dataset contains 1,287,500 labeled sub-images cut from the MRm-DLDet transformed ultra-high resolution RGB images. We implement MRm-DLDet for Windows 10, and it performs better than the latest methods, with a detection accuracy of up to 98.34 $$\%$$ . Moreover, we measured the effects of mimicry and adversarial attacks on MRm-DLDet, and the experimental results demonstrated the robustness of MRm-DLDet.

Shared resources facilitate both side and covert channels and greatly endanger information security even in cloud environments. In cloud computing environments, multiple tenants often reside on the same multi-processor system. Therefore, it is important to prevent information leakage between tenants. Shared memory between tenants is usually disabled for security reasons. In addition, tenants typically do not share physical CPUs. In this case, cache attacks do not work. As a common shared resource, DRAM memory can also be exploited as a source of side and covert channels. In this paper, Computation Tree Logic (CTL) is used to model the behaviors of row buffer logic in DRAM and derive all possible timing-based vulnerabilities. The problem of state space explosion is alleviated by using bounded model checking in this method. In total, our method derives 24 kinds of DRAM timing-based vulnerabilities. Furthermore, we analyze DRAM vulnerabilities to help engineers understand them and take corresponding measures in the design according to derived security specifications.

To improve the overall performance of processors, computer architects use various performance optimization techniques in modern processors, such as speculative execution, branch prediction, and chaotic execution. Both now and in the future, these optimization techniques are critical for improving the execution speed of processor instructions. However, researchers have discovered that these techniques introduce hidden inherent security flaws, such as meltdown and ghost attacks in recent years. They exploit techniques such as chaotic execution or speculative execution combined with cache-based side-channel attacks to leak protected data. The impact of these vulnerabilities is enormous because they are prevalent in existing or future processors. However, until today, meltdown and ghost have not been effectively addressed, but instead, multiple attack variants and different attack implementations have evolved from them. This paper proposes to optimize four different hardware performance events through feature selection and use machine learning algorithms to build a real-time detection mechanism for Spectre v1,v2,v4, and different implementations of meltdown attacks, ultimately achieving an accuracy rate of over 99%. In order to verify the practicality of the attack detection model, this paper is tested with a variety of benign programs and different implementations of Spectre attacks different from the modeling process, and the absolute accuracy also exceeds 99%, showing that this paper can cope with different attack variants and different implementations of the same attack that may occur daily.

Security has always been one of the main concerns in the field of computer architecture and cloud computing. Cache-based side-channel attacks pose a threat to almost all existing architectures and cloud computing. Especially in the public cloud, the cache is shared among multiple tenants, and cache attacks can make good use of this to extract information. Cache side-channel attacks are a problem to be solved for security, in which how to accurately detect cache side-channel attacks has been a research hotspot. Because the cache side-channel attack does not require the attacker to physically contact the target device and does not need additional devices to obtain the side channel information, the cache-side channel attack is efficient and hidden, which poses a great threat to the security of cryptographic algorithms. Based on the AES algorithm, this paper uses hardware performance counters to obtain the features of different cache events under Flush + Reload, Prime + Probe, and Flush + Flush attacks. Firstly, the random forest algorithm is used to filter the cache features, and then the support vector machine algorithm is used to model the system. Finally, high detection accuracy is achieved under different system loads. The detection accuracy of the system is 99.92% when there is no load, the detection accuracy is 99.85% under the average load, and the detection accuracy under full load is 96.57%.