Research Article

Leveraging KVM Events to Detect Cache-Based Side Channel Attacks in a Virtualization Environment

Table 4

Fisher score for the evaluation on another host with different microarchitecture.

ā€‰Sequence Fisher score

Regular loadHLT:kvm_inj_virq:26.74
EXCEPTION_NMI:kvm_page_fault: kvm_inj_exception:26.18
MSR_WRITE:kvm_apic:kvm_msr: kvm_apic_accept_irq:24.43
HLT:kvm_eoi:kvm_pv_eoi:kvm_inj_virq:20.65
CR_ACCESS:kvm_cr:18.79

CPU-intensive load EXCEPTION_NMI:kvm_fpu:9.13
EXTERNAL_INTERRUPT:kvm_fpu:6.76
EXTERNAL_INTERRUPT: kvm_apic_accept_irq: kvm_inj_virq:0.52
EXTERNAL_INTERRUPT: kvm_apic_accept_irq:0.51
PENDING_INTERRUPT:kvm_inj_virq:0.29

Memory intensive loadEXCEPTION_NMI:kvm_page_fault: kvm_inj_exception:91.42
EXCEPTION_NMI:kvm_page_fault: kvm_emulate_insn:75.46
EXCEPTION_NMI:kvm_page_fault:43.69
EXCEPTION_NMI:kvm_page_fault: kvm_inj_exception:kvm_apic_accept_irq: kvm_inj_exception:15.31
EXCEPTION_NMI:kvm_page_fault: kvm_apic_accept_irq:kvm_inj_virq:12.84