# MeMoir: A Software-Driven Covert Channel based on Memory Usage

arXiv: https://arxiv.org/abs/2409.13310 · HTML: https://mlsanity.com/paper/2409.13310/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 6 of its 35 references that are in the map.
- First posted on arXiv 20 Sep 2024.

## Builds on (most cited first, 6 of 6)

- [On the critical path to implant backdoors and the effectiveness of potential mitigation techniques: Early learnings from XZ](https://mlsanity.com/paper/2404.08987/) (2024)
- [Page Cache Attacks](https://mlsanity.com/paper/1901.01161/) (2019)
- [An Insight to Covert Channels](https://mlsanity.com/paper/1306.2252/) (2013)
- [Thermal Covert Channels on Multi-core Platforms](https://mlsanity.com/paper/1503.07000/) (2015)
- [USBee: Air-Gap Covert-Channel via Electromagnetic Emission from USB](https://mlsanity.com/paper/1608.08397/) (2016)
- [MES-Attacks: Software-Controlled Covert Channels based on Mutual Exclusion and Synchronization](https://mlsanity.com/paper/2211.11855/) (2022)

## Abstract (arXiv)

Covert channel attacks have been continuously studied as severe threats to modern computing systems. Software-based covert channels are a typically hard-to-detect branch of these attacks, since they leverage virtual resources to establish illegitimate communication between malicious actors. In this work, we present MeMoir: a novel software-driven covert channel that, for the first time, utilizes memory usage as the medium for the channel. We implemented the new covert channel on two real-world platforms with different architectures: a general-purpose Intel x86-64-based desktop computer and an ARM64-based embedded system. Our results show that our new architecture- and hardware-agnostic covert channel is effective and achieves moderate transmission rates with very low error. Moreover, we present a real use-case for our attack where we were able to communicate information from a Hyper-V virtualized enviroment to a Windows 11 host system. In addition, we implement a machine learning-based detector that can predict whether an attack is present in the system with an accuracy of more than 95% with low false positive and false negative rates by monitoring the use of system memory. Finally, we introduce a noise-based countermeasure that effectively mitigates the attack while inducing a low power overhead in the system compared to other normal applications.