SoCurity: Enhancing SoC Security with Anomalous Activity Detection and Localization

As systems-on-a-chip (SoCs) that power our devices become increasingly heterogeneous to meet low-power, high-performance computational requirements, they also become more vulnerable to the possible impacts of an on-chip resource availability attack. In this article, we present SoCurity, the first network-on-chip (NoC) counter-based hardware monitoring approach for enhancing heterogeneous SoC security. With this monitoring approach, we develop a fast, lightweight anomalous activity detection and localization system at the hardware level. The presented detection system uses semi-supervised machine learning models, and requires no prior attack knowledge for detecting anomalous activity. This design choice provides protection against existing and novel future attacks impacting on-chip resource availability. Our localization engine leverages the inherent interpretability of SoCurity’s NoC counters to locate detected anomalous activity in the SoC for focused recovery. We demonstrate our techniques with a case study on a real SoC implementation for a connected autonomous vehicle system and find up to 96% detection accuracy and fast detection (∼30µs for prediction on an ASIC) in online experiments. Furthermore, we show that the flagged anomalous activity can be reliably localized for up to 99% of detected anomalous activity in our experiments.

• Publication year

  2025

• Venue

  ACM Transactions on Architecture and Code Optimization (TACO)

• Publication date

  2025-11-11

• Fields of study

  Not labeled

• Identifiers
  DOI 10.1145/3776585
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Cohort: Software-Oriented Acceleration for Heterogeneous SoCs

  2023cited by this paper
• TrustSoC: Light and Efficient Heterogeneous SoC Architecture, Secure-by-design

  2023cited by this paper
• PR-ESP: An Open-Source Platform for Design and Programming of Partially Reconfigurable SoCs

  2023cited by this paper
• DECADES: A 67mm2, 1.46TOPS, 55 Giga Cache-Coherent 64-bit RISC-V Instructions per second, Heterogeneous Manycore SoC with 109 Tiles including Accelerators, Intelligent Storage, and eFPGA in 12nm FinFET

  2023cited by this paper
• Efficient Hardware Malware Detectors That are Resilient to Adversarial Evasion

  2022cited by this paper
• A 12nm Agile-Designed SoC for Swarm-Based Perception with Heterogeneous IP Blocks, a Reconfigurable Memory Hierarchy, and an 800MHz Multi-Plane NoC

  2022cited by this paper
• Time Series-Based Malware Detection Using Hardware Performance Counters

  2021cited by this paper
• AutoSVA: Democratizing Formal Verification of RTL Module Interactions

  2021cited by this paper
• A comprehensive review study of cyber-attacks and cyber security; Emerging trends and recent developments

  2021cited by this paper
• TokenSmart: Distributed, Scalable Power Management in the Many-Core Era

  2021cited by this paper
• Denial-of-Service Attack Detection using Machine Learning in Network-on-Chip Architectures

  2021cited by this paper
• Cohmeleon: Learning-Based Orchestration of Accelerator Coherence in Heterogeneous SoCs

  2021cited by this paper
• Hardware-Assisted Malware Detection using Machine Learning

  2021influential reference
• Network-on-Chip Attack Detection using Machine Learning

  2021cited by this paper
• Analyzing Machine Learning Approaches for Online Malware Detection in Cloud

  2021cited by this paper
• Silent Data Corruptions at Scale

  2021cited by this paper
• Hardware-Performance-Counters-based anomaly detection in massively deployed smart industrial devices

  2020cited by this paper
• A Simulator and Compiler Framework for Agile Hardware-Software Co-design Evaluation and Exploration

  2020cited by this paper
• Agile SoC Development with Open ESP : Invited Paper

  2020influential reference
• Scission: Context-aware and Performance-driven Edge-based Distributed Deep Neural Networks

  2020cited by this paper
• Real-Time Detection and Localization of Distributed DoS Attacks in NoC-Based SoCs

  2020cited by this paper
• The rise of machine learning for detection and classification of malware: Research developments, trends and challenges

  2020cited by this paper
• Anomaly Detection in Real-Time Multi-Threaded Processes Using Hardware Performance Counters

  2020cited by this paper
• Adversarial Attack on Microarchitectural Events based Malware Detectors

  2019cited by this paper
• Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI

  2019cited by this paper
• Rule Extraction in Unsupervised Anomaly Detection for Model Explainability: Application to OneClass SVM

  2019cited by this paper
• Analysis of Black Hole Router Attack in Network-on-Chip

  2019cited by this paper
• The Cost of Application-Class Processing: Energy and Performance Analysis of a Linux-Ready 1.7-GHz 64-Bit RISC-V Core in 22-nm FDSOI Technology

  2019cited by this paper
• Computer and Redundancy Solution for the Full Self-Driving Computer

  2019cited by this paper
• Unsupervised Machine Learning-Based Detection of Covert Data Integrity Assault in Smart Grid Networks Utilizing Isolation Forest

  2019cited by this paper
• Towards “Smarter” Vehicles Through Cloud-Backed Swarm Cognition

  2018cited by this paper
• Performance Counters to Rescue: A Machine Learning based safeguard against Micro-architectural Side-Channel-Attacks

  2017cited by this paper
• A Unified Approach to Interpreting Model Predictions

  2017cited by this paper
• Hardware IP Security and Trust

  2017cited by this paper
• Understanding the Mirai Botnet

  2017cited by this paper
• RHMD: Evasion-Resilient Hardware Malware Detectors

  2017cited by this paper
• “Why Should I Trust You?”: Explaining the Predictions of Any Classifier

  2016cited by this paper
• Relationship between Variants of One-Class Nearest Neighbors and Creating Their Accurate Ensembles

  2016cited by this paper
• A Real-Time Anomaly Detection Framework for Many-Core Router through Machine Learning Techniques

  2015cited by this paper
• Malware-aware processors: A framework for efficient online malware detection

  2015cited by this paper
• Runtime Detection of a Bandwidth Denial Attack from a Rogue Network-on-Chip

  2015cited by this paper
• Hardware Trojan Attacks: Threat Analysis and Countermeasures

  2014cited by this paper
• Unsupervised Anomaly-Based Malware Detection Using Hardware Features

  2014cited by this paper
• Virtual Channels and Multiple Physical Networks: Two Alternatives to Improve NoC Performance

  2013cited by this paper
• On the feasibility of online malware detection with performance counters

  2013cited by this paper
• Hierarchical NoC-based security for MP-SoC dynamic protection

  2012cited by this paper
• MADAM: A Multi-level Anomaly Detector for Android Malware

  2012cited by this paper
• Scikit-learn: Machine Learning in Python

  2011cited by this paper
• Are hardware performance counters a cost effective way for integrity checking of programs

  2011cited by this paper
• Anomaly detection: A survey

  2009cited by this paper
• Malware detection using machine learning

  2009cited by this paper
• Learning and Classification of Malware Behavior

  2008cited by this paper
• A security monitoring service for NoCs

  2008cited by this paper
• Isolation Forest

  2008cited by this paper
• Rule Extraction from Support Vector Machines

  2008cited by this paper
• An Empirical Investigation of Mesh and Torus NoC Topologies Under Different Routing Algorithms and Traffic Models

  2007cited by this paper
• Automated Classification and Analysis of Internet Malware

  2007cited by this paper
• Cache Attacks and Countermeasures: The Case of AES

  2006cited by this paper
• High accuracy range estimation of FMCW level radar based on the phase of the zero-padded FFT

  2004cited by this paper
• Random Forests

  2001cited by this paper
• LOF: identifying density-based local outliers

  2000cited by this paper
• Support Vector Method for Novelty Detection

  1999cited by this paper
• A data mining framework for building intrusion detection models

  1999cited by this paper
• The future of microprocessors

  1996cited by this paper
• Support-Vector Networks

  1995cited by this paper
• Discriminatory Analysis - Nonparametric Discrimination: Consistency Properties

  1989cited by this paper
• Error bounds for convolutional codes and an asymptotically optimum decoding algorithm

  1967cited by this paper

• No citing papers are available for this paper.