InstPro: Provenance-Based Transient Execution Attack Detection and Investigation on Instruction Execution Traces

Transient execution attacks (TEAs) are a serious threat to modern computing systems. While software/hardware hardening techniques have been proposed to mitigate the threat, developing detection techniques remains imperative, as they hold promise for flexible extension to address new variants, ease of deployment, and minimal system impact. Existing detection techniques face the following three limitations: unstable information sources, lack of explanation for attack scenarios, and limited training data. To address the limitations, we propose <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">InstPro</small>, a TEA detection system that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">identifies a TEA program while providing an explanation of the attack scenario, based on instruction execution traces</i>. Specifically, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">InstPro</small> first extracts <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">principled clues</i> that represent instruction sequences semantically close to attack abstraction. These clues provide high-level visualizations of TEA steps. Then, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">InstPro</small> correlates the clues into a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">clue provenance graph</i> by reasoning about their causal dependencies, which provides a concise provenance representation. Finally, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">InstPro</small> reconstructs a scenario graph by using the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">InfoSubgraphs</i> that represent the information flows among principled clues. These InfoSubgraphs are more likely to capture a set of crucial principled clues that work together to represent the attack scenario. Our evaluations based on 5 datasets show that <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">InstPro</small> effectively performs TEA detection and investigation.