LightFAt+: Lightweight Control-flow Attestation via Unsupervised Machine Learning

As computational devices continue to evolve, an increasing number of applications are being run remotely. These applications span a broad range of devices, from low-capability IoT nodes to high-capability large cloud providers. Remote execution often involves handling sensitive data or running proprietary software, raising the challenge of ensuring uncompromised code execution. Remote Attestation addresses this challenge by verifying the integrity of the code through the calculation of a potentially extensive sequence of cryptographic hash values. However, this computation can lead to a control-flow explosion due to variable loop bounds, which renders traditional Control-flow attestation schemes impractical for complex real-world applications. In this work, we introduce LightFAt+, a Lightweight Control-Flow Attestation scheme. Rather than relying on the costly computation of cryptographic hashes, LightFAt+ utilizes readings from the processor’s Performance Monitoring Unit (PMU) together with lightweight unsupervised Machine Learning (ML) classifiers. This approach allows LightFAt+ to detect whether a target application’s control flow has been compromised, thereby enhancing the system’s security. From the prover’s perspective, LightFAt+ incurs significantly lower overhead than other state-of-the-art control-flow attestation solutions. More importantly, from the verifier’s perspective, LightFAt+ achieves a detection accuracy of over 95%, with low false-negative and false-positive rates, as well as very fast inference times when applied to real-world applications and reference (benchmark) programs.