Detecting Microarchitectural Attacks in Hypervisor-Based Mixed-Criticality Systems

Abstract

Microarchitectural side-channel attacks pose a significant threat to mixed-criticality embedded systems by exploiting shared hardware resources to induce information leakage and timing interference. This work presents a lightweight, deterministic run-time detection architecture integrated into a hypervisor environment. The approach leverages hardware performance counters as low-level sensors and employs a compact multi-layer perceptron to identify interference patterns using temporally aggregated features. The detector's execution path is input-independent, has bounded computational cost, and does not allocate dynamic memory, ensuring compatibility with real-time constraints. In addition, we introduce a publicly available dataset for embedded platforms capturing normal execution, cross-core interference, and microarchitectural attack footprints. Online deployment on a modern embedded platform achieves 97.94% overall recall and 2.72% false positives, with per-workload recall up to 99.7%. The solution operates without specialized hardware accelerators, supporting reproducibility and practical deployment in resource-constrained systems.