Paper 2017/245

Cache-Base Application Detection in the Cloud Using Machine Learning

Berk Gulmezoglu, Thomas Eisenbarth, and Berk Sunar


Cross-VM attacks have emerged as a major threat on commercial clouds. These attacks commonly exploit hardware level leakages on shared physical servers. A co-located machine can readily feel the presence of a co-located instance with a heavy computational load through performance degradation due to contention on shared resources. Shared cache architectures such as the last level cache (LLC) have become a popular leakage source to mount cross-VM attack. By exploiting LLC leakages, researchers have already shown that it is possible to recover fine grain information such as cryptographic keys from popular software libraries. This makes it essential to verify implementations that handle sensitive data across the many versions and numerous target platforms, a task too complicated, error prone and costly to be handled by human beings. Here we propose a machine learning based technique to classify applications according to their cache access profiles. We show that with minimal and simple manual processing steps feature vectors can be used to train models using support vector machines to classify the applications with a high degree of success. The profiling and training steps are completely automated and do not require any inspection or study of the code to be classified. In native execution, we achieve a successful classification rate as high as 98\% (L1 cache) and 78\% (LLC) over 40 benchmark applications in the Phoronix suite with mild training. In the cross-VM setting on the noisy Amazon EC2 the success rate drops to 60\% for a suite of 25 applications. With this initial study we demonstrate that it is possible to train meaningful models to successfully predict applications running in co-located instances.

Available format(s)
Publication info
Published elsewhere. ASIACCS 2017
CacheMachine LearningCloud
Contact author(s)
bgulmezoglu @ wpi edu
2017-03-20: received
Short URL
Creative Commons Attribution


      author = {Berk Gulmezoglu and Thomas Eisenbarth and Berk Sunar},
      title = {Cache-Base Application Detection in the Cloud Using Machine Learning},
      howpublished = {Cryptology ePrint Archive, Paper 2017/245},
      year = {2017},
      doi = {10.1145/3052973.3053036},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.