Defining Anomalous Behavior for Phase Change Memory Siddhartha Chhabra and Yan Solihin Electrical...

Defining Anomalous Behavior for Phase Change Memory

Siddhartha Chhabra and Yan Solihin

Electrical and Computer EngineeringNorth Carolina State University

WEST-2010

2

Outline Defining Anomalous Behavior

Motivation Related Work Experimental Setup Anomaly Detection Mechanism

Writebacks Per Instruction (WPI) Write Traffic Distribution (WTD) Writeback Traffic Per Page (WTPP) Hardware Implementation

PCM, a replacement for DRAM ? Conclusions

Chhabra, Solihin – PCM Anomalous Behavior

Motivation

3Chhabra, Solihin – PCM Anomalous Behavior

Core

A

Main Memory

DISK

CoreCore

AA

Horizontal Expansion

Vertical Expansion

Main Memory

However:DRAM faces cost, energy and scalability challenges

PCM being researched as one promising alternative

Motivation However, PCM has several limitations:

Higher access latencies Higher read and write energy Limited write Endurance (107 – 108)


Motivation


Thrashing Last Level cache, causing a writeback every iteration

TTF = Cell Endurance * cycles per write

Attack on PCM only system

System Fails in 32 seconds

Motivation Wear Leveling Algorithms

FGWL: Fine Grained Wear Leveling Store blocks in a page in a rotated manner Works across page faults Security contingent on the OS swapping out the attack

application’s pages


Motivation


Wear Leveling Algorithms cannot protect against malicious behavior

Need a separate Anomaly Detection Mechanism

Start-Gap Wear Leveling Algorithm

Contributions Defining anomalous behavior for PCM based

systems. (Anomaly Detection Mechanism) Propose a hardware implementation to collect

these statistics reliably Show that complete replacement of DRAM with

PCM is not possible


Related Work


Bridging Latency Gap

Qureshi et al., Lee et al., Cho et al.B

rid

gin

g E

ne

rgy

Ga

p

Ch

o e

t a

l.,

Le

e e

t a

l.,

Zh

ou

et

al.

Incre

asing L

ifetim

e

Quresh

i et a

l., C

ho et a

l.,

Lee e

t al.,

Zhan

g et a

l.

Security

Experimental Setup Simics, Full system Simulator 4GHz, in-order processor Split L1 cache (32KB), 2-cycle latency Unified L2 (1MB), 10-cycle latency All caches have 64b block size and use LRU SPEC 2006 benchmarks: Skip 5B and simulate

200M instructions


Anomaly Detection Mechanism Goals

Design a metric to define Anomalous behavior Provide for reliable collection of statistics to derive this

metric


Writebacks Per Instruction (WPI) Intuition

Need multiple writebacks to cross the endurance limit of a cell resulting in a successful attack

Significantly more than regular applications

Claim Writebacks Per Instruction (WPI) can be used to

define anomalous behavior


Writebacks Per Instruction (WPI)

Anomalous Behavior: An application with a WPI of more than the system WPI indicates potentially anomalous behavior


Writebacks Per Instruction (WPI) However, this definition of anomaly can be broken

Conclusion: Seemingly useful metric, WPI, cannot be used to define anomalous behavior


Insert one cycle instructions to get the WPI down

Brings WPI below System WPI but attack still succeeds in 32.78 seconds

Write Traffic Distribution (WTD) Intuition

Attacker needs to force writebacks to the same address repeatedly

High concentration of writes to a few lines could indicate anomalous behavior

Claim Write Traffic Distribution (WTD) could be used to

define anomalous behavior


Write Traffic Distribution (WTD)

Anomalous Behavior: If the distribution favors one set of lines by more than α%, it indicates potential anomalous behavior


Write Traffic Distribution (WTD) However, armed with knowledge of definition of

anomalous behavior, WTD can be bypassed Write to all lines of a page: Assuming 4KB page size

and 64byte block size, attack succeeds in 64X time (34 minutes)

Conclusion: Seemingly useful metric, WTD, cannot be used to define anomalous behavior


Writeback Traffic Per Page (WTPP) A foolproof metric must incorporate two factors:

The number of writebacks (WPI) Set of addresses (WTD)

A successful attack application will make a large number of writebacks (WPI) to a fixed set of

addresses (WTD)


Writeback Traffic Per Page (WTPP) Ideal PCM lifetime: 3 years

Plugging in, Writeback Traffic = 5.3GBPS For ideal lifetime, traffic should be uniform. This gives us a traffic of 1.2KBPS per page to

keep ideal lifetime


Anomalous Behavior: A page receiving a WTPP of more than 1.2KBPS

Writeback Traffic Per Page (WTPP)


Attacker can reduce the WTPP to less than 1.2KBPS

Conservative but needed to retain ideal lifetime

Hardware Implementation Need to collect stats reliably

Need to track writebacks to all pages

Low hardware overheads


Hardware Implementation


PCM: Complete replacement for DRAM ?

We defined an Anomaly detection mechanism Once anomalous behavior is detected, a solution

must be in place to prevent against these attacks Killing apps not an option System must have some memory like DRAM

where pages exhibiting anomalous behavior can be remapped to

Hence, having DRAM portion required from both performance and reliability perspective


Conclusions We defined anomalous behavior

Simple metrics like WPI and WTD can be bypassed by attackers

WTPP is a complete metric

Proposed a hardware implementation for the anomaly detection mechanism

Complete replacement of DRAM with PCM not feasible from both performance and reliability perspective


Thank you


Backup…


Attack on hybrid memory system


Lifetime of 24 days

Defining Anomalous Behavior for Phase Change Memory Siddhartha Chhabra and Yan Solihin Electrical...

Documents

Transcript of Defining Anomalous Behavior for Phase Change Memory Siddhartha Chhabra and Yan Solihin Electrical...