# MAD-EN: Microarchitectural Attack Detection through System-wide Energy Consumption

arXiv: https://arxiv.org/abs/2206.00101 · HTML: https://mlsanity.com/paper/2206.00101/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 57 references that are in the map.
- First posted on arXiv 31 May 2022.

## Builds on (most cited first, 10 of 10)

- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [Flush+Flush: A Fast and Stealthy Cache Attack](https://mlsanity.com/paper/1511.04594/) (2015)
- [Malware Guard Extension: Using SGX to Conceal Cache Attacks](https://mlsanity.com/paper/1702.08719/) (2017)
- [The Spy in the Sandbox -- Practical Cache Attacks in Javascript](https://mlsanity.com/paper/1502.07373/) (2015)
- [A Systematic Evaluation of Transient Execution Attacks and Defenses](https://mlsanity.com/paper/1811.05441/) (2018)
- [ZombieLoad: Cross-Privilege-Boundary Data Sampling](https://mlsanity.com/paper/1905.05726/) (2019)
- [ARMageddon: Cache Attacks on Mobile Devices](https://mlsanity.com/paper/1511.04897/) (2015)
- [FastSpec: Scalable Generation and Detection of Spectre Gadgets Using Neural Embeddings](https://mlsanity.com/paper/2006.14147/) (2020)
- [FortuneTeller: Predicting Microarchitectural Attacks via Unsupervised Deep Learning](https://mlsanity.com/paper/1907.03651/) (2019)
- [Prime+Probe 1, JavaScript 0: Overcoming Browser-based Side-Channel Defenses](https://mlsanity.com/paper/2103.04952/) (2021)

## Abstract (arXiv)

Microarchitectural attacks have become more threatening the hardware security than before with the increasing diversity of attacks such as Spectre and Meltdown. Vendor patches cannot keep up with the pace of the new threats, which makes the dynamic anomaly detection tools more evident than before. Unfortunately, previous studies utilize hardware performance counters that lead to high performance overhead and profile limited number of microarchitectural attacks due to the small number of counters that can be profiled concurrently. This yields those detection tools inefficient in real-world scenarios. In this study, we introduce MAD-EN dynamic detection tool that leverages system-wide energy consumption traces collected from a generic Intel RAPL tool to detect ongoing anomalies in a system. In our experiments, we show that CNN-based MAD-EN can detect 10 different microarchitectural attacks with a total of 15 variants with the highest F1 score of 0.999, which makes our tool the most generic attack detection tool so far. Moreover, individual attacks can be distinguished with a 98% accuracy after an anomaly is detected in a system. We demonstrate that MAD-EN introduces 69.3% less performance overhead compared to performance counter-based detection mechanisms.