Abstract: The internal clock of the CPU uses oscillators made from quartz crystals. Small changes in these crystals can cause small but measurable differences in the clock frequency. Under a low CPU load, the function execution time distribution follows the Pareto distribution. However, the function execution time distribution no longer follows the Pareto distribution when the CPU load is high, and the CPU clock fingerprint becomes invalid. In view of this problem, this paper proposes an adaptive Pareto principle that adaptively adjusts the distribution according to the CPU load. Based on this, the robust CPU Clock Fingerprint Model based on the Adaptive Pareto Principle (CFMAP) is proposed. Via a KNN-based fingerprint recognition method, CFMAP solves the instability of existing CPU clock fingerprints under a high CPU load. Experiments show that the average recognition rate of CFMAP fingerprints is 96.82%. Moreover, they are highly robust against CPU load attacks and virtual machine attacks.
0 Replies
Loading