Hardware performance counters are widely used to detect malicious behaviour. However, they count only microarchitectural events, and the link between those events and a program’s high-level actions is indirect and noisy. Arm and Intel offer only limited forms of software-defined events: Arm provides a single software-increment event tied directly to individual counters with no event routing, and Intel writes software values into a trace stream rather than into its counters. Ratified RISC-V offers no such mechanism.
This thesis introduces security counters, a counter peripheral for the CVA6 core of the open-source Cheshire SoC. Each counter can be switched at run time between microarchitectural events and event lines driven by software, and each has its own on-chip sampling buffer. A kernel profiling engine drives the software lines when a monitored program makes selected system calls, so the program itself needs no changes. We implemented the complete system on an FPGA running Linux, at a small fraction of the device’s resources, and characterised the counters’ fidelity and overhead.
We then evaluated security counters across trojaned authentication modules, file-hiding kernel rootkits, and malicious inputs to library code. Combining software-defined and hardware counters achieved strong detection at low false-alarm rates, outperforming either source alone. Together, the two sources provide complementary coverage across user space and the kernel, demonstrating the advantage of run-time configurable security counters.