# Short Paper: Static and Microarchitectural ML-Based Approaches For Detecting Spectre Vulnerabilities and Attacks

arXiv: https://arxiv.org/abs/2210.14452 · HTML: https://mlsanity.com/paper/2210.14452/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 38 references that are in the map.
- First posted on arXiv 26 Oct 2022.

## Builds on (most cited first, 13 of 13)

- [Generative Adversarial Networks](https://mlsanity.com/paper/2203.00667/) (2022)
- [word2vec Explained: deriving Mikolov et al.'s negative-sampling word-embedding method](https://mlsanity.com/paper/1402.3722/) (2014)
- [Spectre Attacks: Exploiting Speculative Execution](https://mlsanity.com/paper/1801.01203/) (2018)
- [Effects of padding on LSTMs and CNNs](https://mlsanity.com/paper/1903.07288/) (2019)
- [oo7: Low-overhead Defense against Spectre Attacks via Program Analysis](https://mlsanity.com/paper/1807.05843/) (2018)
- [SpecFuzz: Bringing Spectre-type vulnerabilities to the surface](https://mlsanity.com/paper/1905.10311/) (2019)
- [Speculative Buffer Overflows: Attacks and Defenses](https://mlsanity.com/paper/1807.03757/) (2018)
- [SPECTECTOR: Principled Detection of Speculative Information Flows](https://mlsanity.com/paper/1812.08639/) (2018)
- [KLEESPECTRE: Detecting Information Leakage through Speculative Cache Attacks via Symbolic Execution](https://mlsanity.com/paper/1909.00647/) (2019)
- [SpecuSym: Speculative Symbolic Execution for Cache Timing Leak Detection](https://mlsanity.com/paper/1911.00507/) (2019)
- [Hardware-Software Contracts for Secure Speculation](https://mlsanity.com/paper/2006.03841/) (2020)
- [FastSpec: Scalable Generation and Detection of Spectre Gadgets Using Neural Embeddings](https://mlsanity.com/paper/2006.14147/) (2020)
- [Osiris: Automated Discovery of Microarchitectural Side Channels](https://mlsanity.com/paper/2106.03470/) (2021)

## Built on by (most cited first, 1 of 1)

- [PACE: A Program Analysis Framework for Continuous Performance Prediction](https://mlsanity.com/paper/2312.00918/) (2023)

## Abstract (arXiv)

Spectre intrusions exploit speculative execution design vulnerabilities in modern processors. The attacks violate the principles of isolation in programs to gain unauthorized private user information. Current state-of-the-art detection techniques utilize micro-architectural features or vulnerable speculative code to detect these threats. However, these techniques are insufficient as Spectre attacks have proven to be more stealthy with recently discovered variants that bypass current mitigation mechanisms. Side-channels generate distinct patterns in processor cache, and sensitive information leakage is dependent on source code vulnerable to Spectre attacks, where an adversary uses these vulnerabilities, such as branch prediction, which causes a data breach. Previous studies predominantly approach the detection of Spectre attacks using the microarchitectural analysis, a reactive approach. Hence, in this paper, we present the first comprehensive evaluation of static and microarchitectural analysis-assisted machine learning approaches to detect Spectre vulnerable code snippets (preventive) and Spectre attacks (reactive). We evaluate the performance trade-offs in employing classifiers for detecting Spectre vulnerabilities and attacks.