Transport Layer Security attack detection using hardware performance counters side-channel

Cryptographic protocols form the backbone of secure communication in various environments, including the Internet of Things (IoT) and non-IoT settings. One of the most popular and widely used cryptographic protocols is Transport Layer Security (TLS). However, TLS implementations remain vulnerable to implementation flaws, such as the Heartbleed bug, which affected a significant proportion of deployed TLS 1.2 servers. Many detection approaches rely on network traffic inspection, which is ineffective in encrypted environments. In this paper, we present a non-intrusive detection framework that collects hardware performance counter (HPC) side-channel data from a TLS server process without modifying the application or requiring access to network packets. To the best of our knowledge, no prior work has combined HPC data with a deep neural network (DNN) in a zero-modification testbed for TLS attack detection. The training dataset was collected in a simplified single-machine setup, while evaluation was conducted on physically separated machines to simulate real-world deployment. Recall ranges from 0.590 to 0.753, and Specificity from 0.698 to 0.850 across six evaluation configurations, confirming the feasibility of detection while identifying generalization as the key challenge for future work. To validate the choice of DNN architecture, it was additionally compared against classical machine learning baselines such as Logistic Regression, Random Forest, and Extreme Gradient Boosting (XGBoost), achieving the highest combined Recall and Specificity in all six configurations.