אירועים והרצאות בפקולטה למדעי המחשב ע"ש הנרי ומרילין טאוב

Hardware performance counters are widely used to detect malicious behaviour. However, they count only microarchitectural events, and the link between those events and a program’s high-level actions is indirect and noisy. Arm and Intel offer only limited forms of software-defined events: Arm provides a single software-increment event tied directly to individual counters with no event routing, and Intel writes software values into a trace stream rather than into its counters. Ratified RISC-V offers no such mechanism.

This thesis introduces security counters, a counter peripheral for the CVA6 core of the open-source Cheshire SoC. Each counter can be switched at run time between microarchitectural events and event lines driven by software, and each has its own on-chip sampling buffer. A kernel profiling engine drives the software lines when a monitored program makes selected system calls, so the program itself needs no changes. We implemented the complete system on an FPGA running Linux, at a small fraction of the device’s resources, and characterised the counters’ fidelity and overhead.

We then evaluated security counters across trojaned authentication modules, file-hiding kernel rootkits, and malicious inputs to library code. Combining software-defined and hardware counters achieved strong detection at low false-alarm rates, outperforming either source alone. Together, the two sources provide complementary coverage across user space and the kernel, demonstrating the advantage of run-time configurable security counters.