1. Defining Anomalous Behavior for Phase Change Memory
Siddhartha Chhabra and Yan Solihin
Electrical and Computer Engineering
North Carolina State University
WEST-2010

2. Chhabra, Solihin – PCM Anomalous Behavior
Outline
Defining Anomalous Behavior
Motivation
Related Work
Experimental Setup
Anomaly Detection Mechanism
Writebacks Per Instruction (WPI)
Write Traffic Distribution (WTD)
Writeback Traffic Per Page (WTPP)
Hardware Implementation
PCM, a replacement for DRAM ?
Conclusions
Chhabra, Solihin – PCM Anomalous Behavior

3. Chhabra, Solihin – PCM Anomalous Behavior
Motivation A A A
Core
Core
Core
Horizontal Expansion
Vertical Expansion
Main Memory
Main Memory
However:
DRAM faces cost, energy and scalability challenges
PCM being researched as one promising alternative
DISK
Chhabra, Solihin – PCM Anomalous Behavior

4. Chhabra, Solihin – PCM Anomalous Behavior
Motivation
However, PCM has several limitations:
Higher access latencies
Higher read and write energy
Limited write Endurance (107 – 108)
Chhabra, Solihin – PCM Anomalous Behavior

5. System Fails in 32 seconds
Motivation
Attack on PCM only system
Thrashing Last Level cache, causing a writeback every iteration
TTF = Cell Endurance * cycles per write
System Fails in 32 seconds
Chhabra, Solihin – PCM Anomalous Behavior

6. Chhabra, Solihin – PCM Anomalous Behavior
Motivation
Wear Leveling Algorithms
FGWL: Fine Grained Wear Leveling
Store blocks in a page in a rotated manner
Works across page faults
Security contingent on the OS swapping out the attack application’s pages
Discuss lightly loaded system and the fact that PCM will be much bigger than DRAM increases the likelihood of page staying resident in main memory
Chhabra, Solihin – PCM Anomalous Behavior

7. Motivation Start-Gap Wear Leveling Algorithm
Wear Leveling Algorithms cannot protect against malicious behavior
Need a separate Anomaly Detection Mechanism
Chhabra, Solihin – PCM Anomalous Behavior

8. Chhabra, Solihin – PCM Anomalous Behavior
Contributions
Defining anomalous behavior for PCM based systems. (Anomaly Detection Mechanism)
Propose a hardware implementation to collect these statistics reliably
Show that complete replacement of DRAM with PCM is not possible
Chhabra, Solihin – PCM Anomalous Behavior

9. Related Work Chhabra, Solihin – PCM Anomalous Behavior
Bridging Energy Gap
Cho et al., Lee et al., Zhou et al.
Qureshi et al., Lee et al., Cho et al.
Bridging Latency Gap
Increasing Lifetime
Qureshi et al., Cho et al., Lee et al., Zhang et al.
Security
Chhabra, Solihin – PCM Anomalous Behavior

10. Chhabra, Solihin – PCM Anomalous Behavior
Experimental Setup
Simics, Full system Simulator
4GHz, in-order processor
Split L1 cache (32KB), 2-cycle latency
Unified L2 (1MB), 10-cycle latency
All caches have 64b block size and use LRU
SPEC 2006 benchmarks: Skip 5B and simulate 200M instructions
Chhabra, Solihin – PCM Anomalous Behavior

11. Anomaly Detection Mechanism
Goals
Design a metric to define Anomalous behavior
Provide for reliable collection of statistics to derive this metric
Chhabra, Solihin – PCM Anomalous Behavior

12. Writebacks Per Instruction (WPI)
Intuition
Need multiple writebacks to cross the endurance limit of a cell resulting in a successful attack
Significantly more than regular applications
Claim
Writebacks Per Instruction (WPI) can be used to define anomalous behavior
Chhabra, Solihin – PCM Anomalous Behavior

13. Writebacks Per Instruction (WPI)
Talk about how to get the system WPI (normal distribution)…..and say that the application so identified can be marked as potentially harmful (detection mechanism) and the protection mechanism can then come in to protect the system.
Anomalous Behavior: An application with a WPI of more than the system WPI indicates potentially anomalous behavior
Chhabra, Solihin – PCM Anomalous Behavior

14. Writebacks Per Instruction (WPI)
However, this definition of anomaly can be broken
Conclusion: Seemingly useful metric, WPI, cannot be used to define anomalous behavior
Insert one cycle instructions to get the WPI down
Talk about NOP filtering and say ADD can be used
WPI can be trivially bypassed by attackers armed with any knowledge of the definition of anomaly
Brings WPI below System WPI but attack still succeeds in seconds
Chhabra, Solihin – PCM Anomalous Behavior

15. Write Traffic Distribution (WTD)
Intuition
Attacker needs to force writebacks to the same address repeatedly
High concentration of writes to a few lines could indicate anomalous behavior
Claim
Write Traffic Distribution (WTD) could be used to define anomalous behavior
Chhabra, Solihin – PCM Anomalous Behavior

16. Write Traffic Distribution (WTD)
Anomalous Behavior: If the distribution favors one set of lines by more than α%, it indicates potential anomalous behavior
Chhabra, Solihin – PCM Anomalous Behavior

17. Write Traffic Distribution (WTD)
However, armed with knowledge of definition of anomalous behavior, WTD can be bypassed
Write to all lines of a page: Assuming 4KB page size and 64byte block size, attack succeeds in 64X time (34 minutes)
Conclusion: Seemingly useful metric, WTD, cannot be used to define anomalous behavior
Chhabra, Solihin – PCM Anomalous Behavior

18. Writeback Traffic Per Page (WTPP)
A foolproof metric must incorporate two factors:
The number of writebacks (WPI)
Set of addresses (WTD)
A successful attack application will make a large number of writebacks (WPI) to a fixed set of addresses (WTD)
Need to consider the two factors together to come up with a foolproof metric
Chhabra, Solihin – PCM Anomalous Behavior

19. Writeback Traffic Per Page (WTPP)
Ideal PCM lifetime: 3 years
Plugging in, Writeback Traffic = 5.3GBPS
For ideal lifetime, traffic should be uniform.
This gives us a traffic of 1.2KBPS per page to keep ideal lifetime
Anomalous Behavior: A page receiving a WTPP of more than 1.2KBPS
Chhabra, Solihin – PCM Anomalous Behavior

20. Writeback Traffic Per Page (WTPP)
Attacker can reduce the WTPP to less than 1.2KBPS
Conservative but needed to retain ideal lifetime
Chhabra, Solihin – PCM Anomalous Behavior

21. Hardware Implementation
Need to collect stats reliably
Need to track writebacks to all pages
Low hardware overheads
Add a page counter cache that tracks the writebacks
Main memory portion dedicated for overflows of the counter cache: Scratch memory
To keep runtime overheads low, anomalous behavior tracked across context switches
Chhabra, Solihin – PCM Anomalous Behavior

22. Hardware Implementation
Chhabra, Solihin – PCM Anomalous Behavior

23. PCM: Complete replacement for DRAM ?
We defined an Anomaly detection mechanism
Once anomalous behavior is detected, a solution must be in place to prevent against these attacks
Killing apps not an option
System must have some memory like DRAM where pages exhibiting anomalous behavior can be remapped to
Hence, having DRAM portion required from both performance and reliability perspective
Chhabra, Solihin – PCM Anomalous Behavior

24. Chhabra, Solihin – PCM Anomalous Behavior
Conclusions
We defined anomalous behavior
Simple metrics like WPI and WTD can be bypassed by attackers
WTPP is a complete metric
Proposed a hardware implementation for the anomaly detection mechanism
Complete replacement of DRAM with PCM not feasible from both performance and reliability perspective
Chhabra, Solihin – PCM Anomalous Behavior

25. Chhabra, Solihin – PCM Anomalous Behavior
Thank you
Chhabra, Solihin – PCM Anomalous Behavior

26. Chhabra, Solihin – PCM Anomalous Behavior
Backup…
Chhabra, Solihin – PCM Anomalous Behavior

27. Attack on hybrid memory system
Lifetime of 24 days
Chhabra, Solihin – PCM Anomalous Behavior