A System Inspection through Context Inference Based on State-Change Primitives of Micro-Level Signals = 마이크로 레벨 신호의 상태 변화 프리미티브 기반 컨텍스트 추론을 통한 시스템 인스펙션

다국어 초록 (Multilingual Abstract)

Modern computing systems have evolved toward higher bandwidth and lower latency through high-performance processors, large-capacity memory, fast storage devices, and GPU/HBM-based acceleration structures. In these environments, data moves and is processed rapidly across multiple hardware layers, while fine-grained state changes continuously occur in the form of access frequency, I/O flow, repeated activation patterns, charge accumulation and leakage, payload distribution changes, and entropy-state transitions. These changes are not merely physical by-products. They can be interpreted as information traces that reflect internal data movement and access behavior. Therefore, lower hardware layers can become side-channel or disturbance surfaces for attackers, but they can also serve as sensing surfaces for defenders to observe security-relevant behavior before it is recorded at higher layers. However, conventional security analysis has largely interpreted anomalies using higher-layer information such as operating system logs, file events, network packets, and process behavior. Such information is often recorded as the result of an already occurred behavior, making it difficult to capture lower-layer state changes early while an attack or abnormal behavior is still in progress. Conversely, directly collecting and interpreting lower-layer states may incur additional measurement, logging, and verification costs, especially when the observation point is close to a core data path. Therefore, lower- layer security monitoring benefits from a low-overhead capacitive primitive that exposes security-relevant state changes at low cost and restricts downstream high-cost analysis to compact candidate intervals or targets. Based on this motivation, this dissertation defines lower-layer security monitoring as the early observation and interpretation of lower-layer state changes. The core idea is to represent fine-grained security-relevant state changes using low-overhead capacitive primitives and interpret them as security-relevant candidate contexts, thereby reducing the scope and timing of downstream high-cost analysis. To this end, this dissertation proposes a lower-layer capacitive primitive approach. The proposed approach converts lower-layer signals into compact primitive sequences, interprets these sequences as candidate security contexts, and applies downstream analysis only to the necessary intervals or targets. The capacitive primitive used in this dissertation is based on the charging and leakage behavior of capacitors. When signals are repeatedly applied to a circuit, the capacitive state increases through charge accumulation. When such signals are absent or weakened, the state naturally decreases through leakage. This behavior allows lower-layer activity flows to be represented as compact temporal states without storing every event or analyzing all data directly. This dissertation applies this perspective to two monitoring cases: DRAM row-disturbance monitoring and storage I/ O entropy-state monitoring. First, A-PRAC is a DRAM-layer capacitive primitive for row-disturbance monitoring. Existing PRAC-based approaches manage row-wise ACTIVATE counts using exact digital counters, but storing, updating, and comparing counters for a large number of rows can impose additional area, energy, and latency costs. A-PRAC converts an ACTIVATE stream into a row-level capacitive row-disturbance state and interprets the moment when this state exceeds a threshold as an aggressor hot-row candidate or alert. In this way, A-PRAC narrows the row space and timing window on which downstream verification or mitigation should focus. Second, CthSense is a storage I/O capacitive primitive for entropy-state monitoring along the storage I/O path. Conventional Shannon entropy analysis scans the entire payload and computes a byte distribution, which can increase repeated analysis costs in high-speed I/O environments. CthSense maps storage I/O payloads onto eight bit- position lanes and estimates an entropy-like state using frequency and spread changes in lane-wise capacitive states. The resulting Flow Spectrum is used to select candidate segments that require downstream Shannon entropy verification or higher-layer security analysis. This dissertation evaluates the feasibility of A-PRAC and CthSense through trace-driven simulation and emulation. A-PRAC is evaluated using Ramulator-based DRAM ACTIVATE traces to analyze the detection timing and trace-normalized verification activity of row-disturbance candidates under exact-counting reference models. CthSense is evaluated using QEMU-based storage I/O traces to analyze the correspondence between CthSense-derived entropy-like states and Shannon entropy-based states. The evaluation shows that A-PRAC reduces the row and timing space on which the verifier should focus, while CthSense achieves high agreement with Shannon entropy-based states. In particular, the Strict candidate mode substantially reduces the range of downstream Shannon verification while preserving high-entropy transition episodes. Although A-PRAC and CthSense target different hardware layers, both represent fine-grained hardware state changes using capacitive primitives and transform them into security-relevant candidate contexts. These results show that lower-layer signals can serve as a capacitive sensing basis for reducing the targets and timing of downstream security analysis. For practical deployment, further investigation is required on circuit-level validation, calibration, physical placement, area and energy analysis, and integration with downstream security policies. Keywords: I/O Monitoring, Security Monitoring, Side-channel Analysis, Hardware Security

목차 (Table of Contents)

• 1 Introduction 1
• 1.1 Research Background and Rationale 1
• 1.2 Proposed State-Change Primitive-Based Context Inference 3
• 1.2.1 A-PRAC 5
• 1.2.2 CthSense 6
• 1.2.3 Integrated Monitoring Perspective 9
• 1.3 Contributions and Dissertation Organization 9
• 2 Related Work 12
• 3 A-PRAC: Auxiliary Row-Disturbance Sensing Primitive for PRAC Rowhammer Monitoring 16
• 3.1 Introduction 16
• 3.2 Related Work 22
• 3.2.1 Rowhammer Mitigation and PRAC-Based Activation Tracking 22
• 3.2.2 Count-Based Monitoring and A-PRAC Positioning 25
• 3.3 A-PRAC Design 27
• 3.3.1 Design Goal, PRAC Baseline, and Row-Disturbance State Model 27
• 3.3.2 Two-Level Alarm Generation and Circuit-Oriented Logic 32
• 3.3.3 Alarm Matching and Evaluation Definitions 38
• 3.3.4 Threat Model and Evaluation Scope 39
• 3.4 Implementation 42
• 3.4.1 Implementation Pipeline and ACTIVATE Trace Generation 42
• 3.4.2 PRAC Baseline and A-PRAC Row-Disturbance State Model Implementation 44
• 3.4.3 Alarm Comparison, Metrics, and Parameter Configuration 47
• 3.5 Evaluation: A-PRAC Row-Disturbance Primitive 49
• 3.5.1 Evaluation Setup and Reference Paths 49
• 3.5.2 Candidate Coverage and Pattern Robustness 53
• 3.5.3 Alert Timing 55
• 3.5.4 Monitoring Cost and Verifier Scope 57
• 3.5.5 Comparison and Evaluation Scope 59
• 3.6 Summary 60
• 4 CthSense: Storage I/O Capacitive Primitive for Entropy-State Flow Spectrum Pre-filtering 62
• 4.1 Introduction 62
• 4.2 Related Work 68
• 4.3 Design of CthSense 70
• 4.3.1 Design Goal and Capacitive I/O-State Architecture 71
• 4.3.2 Primitive Extraction and Fixed-Cost Flow Spectrum 73
• 4.3.3 Entropy-Transition Flow Spectrum Model 76
• 4.3.4 Candidate Scoring, Suppressors, and Visualization 79
• 4.4 Implementation 81
• 4.4.1 Full-System I/O Collection and Label Alignment 83
• 4.4.2 Trace-Driven Capacitive Emulation and Primitive Generation . 86
• 4.4.3 Workload, Dataset, and Evaluation Outputs 87
• 4.4.4 Threat Model and Evaluation Scope 88
• 4.5 Evaluation: Flow Spectrum Primitive Validity 90
• 4.5.1 Evaluation Setup and Primitive Generation 90
• 4.5.2 Flow Spectrum Response and Shannon–Spread Relation 92
• 4.6 Evaluation: Observation Cost and Verification Scope 96
• 4.6.1 Runtime, Operation Count, and Verification Reduction 96
• 4.7 Evaluation: Ransomware Workload Monitoring 100
• 4.7.1 Workload Priority and Prefilter Utility 100
• 4.8 Summary 103
• 4.9 Summary 104
• 5 Conclusion 107
• References 110