Security Begins at Home

Of the many interesting articles in this issue of IEEE Design&Test , one particular article by Zhou et al. grabbed my attention. The article showed that hardware performance counters, which count instances of microarchitectural events, cannot distinguish between a system in normal operation and a system under attack. One reason given is the gap between the functional behavior of a system and the behavior at the microarchitectural level. Therefore, it is best to look for incursions at the functional level and distinguish good from any suspicious behavior there.