Using Network Traffic to Infer Hardware State: A Kernel-Level Investigation

【Author】 Watkins, Lanier; Robinson, William H.; Beyah, Raheem

【Source】ACM TRANSACTIONS ON EMBEDDED COMPUTING SYSTEMS

【影响因子】1.886

【Abstract】In this article, we illustrate that the boundary of a general-purpose node can be extended into the network by extracting information from network traffic generated by that general-purpose node to infer the state of its hardware components. This information is represented in a delay signature latent within the network traffic. In contrast, the traditional approach to determine the internal state of a node's resources meant that a software application with internal processes had to be resident on the node. The aforementioned delay signature is the keystone that provides a correlation between network traffic and the internal state of the source node. We characterize this delay signature by (1) identifying the different types of assembly language instructions that source this delay and (2) describing how architectural techniques, such as instruction pipelining and caching, give rise to this delay signature. In theory, highly utilized nodes (due to multiple threads) will contain excessive context switching and contention for shared resources. One important shared resource is main memory, and excessive use of this resource by applications and internal processes eventually leads to a decrease in cache efficiency that eventually stalls the instruction pipeline. Our results support this theory; specifically, we have observed that excessive context switching in active applications increases the effective memory access time and wastes precious CPU cycles, thus adding additional delay to the execution of load, store, and other instructions. Because the operating system (OS) kernel accesses memory to send network packets, the delay signature is induced into network traffic in situations where user-level utilization is high. We demonstrate this theory in two case studies: (1) resource discovery in cluster grids and (2) network-based detection of bitcoin mining on compromised nodes.

【Keywords】Experimentation; Measurement; Performance; Security; Theory; Verification; LEON4 processor; passive resource discovery; grid computing; clusters assembly language instructions

【发表时间】2015 MAY

【收录时间】2022-01-02

【文献类型】

【主题类别】

--