Jose A. Gutierrez del Arroyo

Prior work has shown that Translation Lookaside Buffer (TLB) data contains valuable behavioral information. Many existing methodologies rely on timing features or focus solely on workload classification. In this study, we propose a novel approach to malware classification using only TLB-related Hardware Performance Counters (HPCs), explicitly excluding any dependence on timing features such as task execution duration or memory access timing. Our methodology evaluates whether TLB data alone, without any timing information, can effectively distinguish between malicious and benign programs. We test this across three classification scenarios: (1) A binary classification problem involving distinguishing malicious from benign tasks, (2) a 4-way classification problem designed to improve separability, and (3) a 10-way classification problem with classes of individual benign and malware tasks. Our results demonstrate that even without execution time or memory access timing, TLB events achieve up to 81% accuracy for the binary, and 72% accuracy for the 4-class grouping, and 61% accuracy for the 10-class grouping. These findings demonstrate that time-independent TLB patterns can serve as robust behavioral signatures. This work expands the understanding of microarchitectural side effects by demonstrating that TLB-only features, independent of timing-based techniques, can be effectively used for real-world malware detection.

The primary focus of modern Central Processing Unit (CPU) technologies is performance improvement, with security often considered a secondary concern. As a result, vulnerabilities within the system are overlooked. While significant research, both offensive and defensive, has been conducted on CPU caches, relatively little attention has been given to the Translation Lookaside Buffer (TLB) due to its perceived lack of data granularity. Prior studies have typically combined multiple Hardware Performance Counters (HPCs) or relied on timing analysis to extract meaningful insights. In contrast, this study introduces a novel methodology that leverages only TLB related HPCs for multi-task classification, without incorporating data from other microarchitectural components such as caches or branch predictors, and without relying on timing memory accesses. In the proposed methodology, an attacker uses HPCs to collect TLB based data while a victim executes tasks. We demonstrate that statistical learning models, including Random Forest (RF) and Logistic Regression (LR), achieve classification accuracy of up to 87%, surpassing the next best TLB only method (based on timing analysis) by 11%. Furthermore, neural networks, such as Artificial Neural Network (ANN) and Convolution Neural Network (CNN), achieve 88% accuracy, improving prior TLB based approaches by 12%. These findings demonstrate the potential of TLB based methodologies for task classification, victim monitoring, and future security enhancements in microarchitectural design.

Radio Frequency Fingerprinting (RFF) is the attribution of uniquely identifiable signal distortions to emitters via Machine Learning (ML) classifiers. RFF approaches relying on pre-determined expert features lack generalizability, and state-of-the-art approaches based on Convolutional Neural Networks (CNNs) can be too demanding for endpoint devices to train. This work presents Fingerprint Extraction through Distortion Reconstruction (FEDR), a best-of-both-worlds technique which employs a pre-trained CNN to identify and extract a small, salient set of unique features, amenable for use in lightweight machine learning models. Given a received distorted signal, the FEDR network encodes signal distortions into “fingerprints,” which can be used by lightweight ML classifiers to perform RFF with minimal resource consumption at the endpoint. FEDR learns by transforming generated signals into reconstructions of received signals, relying solely on the fingerprints as representations of the distortions – as the reconstructions improve, the fingerprints better encode the distortions. The FEDR technique was evaluated on synthetic IQ-imbalanced IEEE 802.11a/g data, where FEDR fingerprints were shown to encode actual IQ imbalance parameters, signifying successful isolation of distortion information and validating the FEDR technique. FEDR was further evaluated on a representative real-world WiFi dataset, where extracted fingerprints were coupled with a lightweight two-layer dense network. When compared against two common RFF techniques, the FEDR-based approach achieved state-of-the-art performance with Matthews Correlation Coefficient ranging from 0.984 (5 classes) to 0.851 (100 classes), using nearly 73% fewer training parameters than the next-best technique.

Radio Frequency Fingerprinting (RFF) is often proposed as an authentication mechanism for wireless device security, but application of existing techniques in multi-channel scenarios is limited because prior models were created and evaluated using bursts from a single frequency channel without considering the effects of multi-channel operation. Our research evaluated the multi-channel performance of four single-channel models with increasing complexity, to include a simple discriminant analysis model and three neural networks. Performance characterization using the multi-class Matthews Correlation Coefficient (MCC) revealed that using frequency channels other than those used to train the models can lead to a deterioration in performance from MCC > 0.9 (excellent) down to MCC < 0.05 (random guess), indicating that single-channel models may not maintain performance across all channels used by the transmitter in realistic operation. We proposed a training data selection technique to create multi-channel models which outperform single-channel models, improving the cross-channel average MCC from 0.657 to 0.957 and achieving frequency channel-agnostic performance. When evaluated in the presence of noise, multi-channel discriminant analysis models showed reduced performance, but multi-channel neural networks maintained or surpassed single-channel neural network model performance, indicating additional robustness of multi-channel neural networks in the presence of noise.