Pengfei Qiu

The Performance Monitoring Unit (PMU) is a significant hardware module of modern processors. Previous studies have disclosed numerous hidden PMU events. However, their underlying microarchitectural semantics remain unexplored, which largely limit their utilization. This paper proposes a reverse engineering framework for deeply understanding the microarchitectural semantics of hidden PMU events. For demonstration, we successfully utilize the framework to reveal microarchitectural behaviors of branch-related events and discover a hidden pattern of UMask Combination in Intel CPUs. Based on the reverse-engineering results, we implement a PMU-based covert channel for Spectre-v1 in SGX and enable a high-precision website fingerprinting attack under resource-constrained conditions.

ARM CPUs are widely used in both embedded systems and personal computers where security considerations are becoming important. Evidently, vulnerabilities on hardware components such as cache and translation look-aside buffer are well-documented. But there are much less studies on other components, especially those in the CPU backend, largely due to the unavailability of their design and implementation details. To address this gap, we present the first in-depth reverse engineering analysis of the memory disambiguation unit (MDU) in the backend of ARM CPUs. Across four microarchitectures from ARM and Apple CPUs, we identify two different MDU designs, switch-based and counter-based. We then analyze the state machine, selection mechanism, and organization of these MDU designs. We further propose new side channels and covert channels, which we call ARMeD channels, that exploit ARM MDU to leak information. We demonstrate with three attacks using ARMeD channels: 1) a cross-process covert channel; 2) website fingerprinting; and 3) a new implementation of the spectre attack. Finally, we present a defense strategy against ARMeD Channels with less than 3% degradation on the MDU’s prediction accuracy.

Simulating human mobility realistically and generating large-scale, high-quality trajectories are crucial for various location-based applications such as traffic management, epidemic spreading analysis, and location privacy protection. While the most popular model-free methods succeed by directly learning distribution of real-world data, they struggle to produce high-quality mobility data without leveraging the domain knowledge of human mobility. Moreover, such model-free methods primarily rely on auto-regressive paradigms, usually accompanied by error accumulation problem. To address the issues, we propose a model-free Domain-Knowledge Enhanced Generative Adversarial Network (DKE-GAN), which efficiently combines domain knowledge of urban context with model-free learning paradigm to generate high-quality mobility data. In addition, we incorporate reinforcement learning into the training process, thereby effectively alleviating the error accumulation. Furthermore, we introduce Trajectory Representation Learning (TRL) to convert noise-carrying raw trajectories into low-dimensional representation vectors for fully mining human mobility patterns. Extensive experiments conducted on two representative real-world mobility datasets demonstrate that our proposed method outperforms six state-of-the-art baselines, significantly achieving performance improvements in simulating human mobility.

With the rapid proliferation of crowd mobility data produced by ubiquitous mobile devices equipped with spatial positioning modules, deep neural networks (DNNs) have become widely applied in spatio-temporal trajectory modeling. However, recent studies have shown that DNNs are vulnerable to adversarial examples with strong transferability, which are crafted by introducing small perturbations to original examples but can cause catastrophic mistakes. To mitigate this vulnerability and enhance model robustness, we propose a novel self-supervised collaborative learning framework named Auto-GAN that consists of a generator for automatically learning robust latent features and a discriminator for providing comprehensive guidance to the generator. By leveraging the collaboration between the generator and discriminator, our proposed method significantly improves the denoising performance. Moreover, we combine point-level and feature-level constraints into training processes between original example reconstruction and adversarial example denoising, thereby effectively suppressing the potential “error amplification effect". Extensive experiments conducted on two representative real-world mobility datasets show that our proposed method can significantly enhance the model’s robustness against various adversarial attacks, while preserving the model’s prediction accuracy on original examples.

Recent research has unveiled numerous cache-timing side-channel attacks exploiting the side effects of fine-grained cache features, such as coherence protocol and prefetch, among others. Traditional modeling methods and verification techniques are insufficient for verifying caches with fine-grained features and detecting cache timing vulnerabilities. There is a necessity for comprehensive verification of such complex cache designs. This paper presents SCAFinder, a verification framework targeting the cache designs with fine-grained features; it identifies cache side-channel attacks through model checking techniques. Specifically, it proposes a modeling methodology for cache designs that enables us to abstract the cache’s behavior and latency characteristics. We implement a search algorithm for finding all counterexamples based on open-source model checking software. Subsequently, we add an attack scenario analysis module to discover attacks applicable to specific scenarios. We evaluate SCAFinder on Intel Skylake-X microarchitecture, demonstrating its capability to generate 7 new attack sequences exploiting coherence protocol and prefetch, and 12 new replacement policy-based side channels. As a case study, we successfully built a covert channel for one of the sequences on the real-world processor. To the best of our knowledge, we are the first to implement cross-core replacement policy-based attacks on non-inclusive caches.