Modern processors keep secrets badly. The Meltdown and Spectre revelations of 2018 showed the world that the innermost machinery of a CPU—its caches, its branch predictors, its speculative execution engine—can be coaxed into leaking privileged data without a single line of malicious code touching the operating system. Now, as the open-source RISC-V instruction set architecture spreads from embedded controllers to data-center-class chips, researchers have confirmed what security engineers feared: RISC-V processors are just as exposed to these microarchitectural attacks as their x86 and ARM cousins. A team at the Universitat Politècnica de Catalunya in Barcelona has responded with a defense that lives inside the chip itself, and their results, published in the journal Cybersecurity, are striking.
The researchers, led by Albert Pou, Beatriz Otero, Miguel Robledo, Alejandro Pajuelo and Ramon Canal, built their detection system around a feature that nearly every modern processor already carries: hardware performance counters, or HPCs. These are tiny on-chip registers that tally microarchitectural events as they happen—how many instructions retire, how many branches mispredict, how many cache lines are evicted, how many times the memory-management unit stumbles through a page-table walk. Legitimate software produces characteristic patterns in these counters. Hardware attacks, which must stress specific processor structures far beyond normal operating envelopes, produce patterns that stand out like a scream in a library. The question was whether machine learning could learn to hear it.
To find out, the team ran their experiments on real silicon: a XuanTie C910, a commercial 64-bit, out-of-order RISC-V core, mounted on a SiPEED LicheePi 4A development board running Debian 13. They assembled a dataset they call HARPY-V, comprising sixteen benign applications and sixteen verified microarchitectural attacks, drawn from the attack primitives demonstrated by the Security RISC project and related work. The malicious set spans the modern hardware-attack landscape: cache side channels such as Flush+Reload, Flush+Flush, Evict+Reload and Flush+Fault; translation-lookaside-buffer attacks; speculative-execution exploits including Spectre V1, Spectre V2 and Spectre RSB; interrupt-timing and timer-drift attacks; and GhostWrite, a benchmark that abuses weak memory ordering on RISC-V to write to arbitrary physical addresses. The benign set deliberately includes memory-intensive and compute-intensive workloads—multimedia processing, cryptographic routines, numerical kernels, stress tests—chosen so that their counter signatures overlap with the structures attacks abuse, making the classification problem genuinely hard rather than trivially separable.
Collecting clean data on this platform proved to be a study in itself. The team used the Linux perf tool to sample counters every 10 milliseconds, pinning every run to a single core with taskset to avoid scheduling noise. But they discovered a serious pitfall: when perf tracked multiple counters simultaneously, the act of monitoring distorted the measurements, inflating some counter values by more than 300 percent. The solution was to record each counter in isolation—one perf run per benchmark per counter—yielding attribution-correct ground truth for every event. The researchers also found that the perf event descriptions for the C910 were largely inaccurate, and that the processor’s official specification provided the true counter mapping. The result is a dataset of roughly 64,000 labeled samples, publicly released through the CORA Research Data Repository, which the authors describe as the first reproducible collection of its kind for RISC-V.
With the dataset in hand, the team trained four families of supervised classifiers: Naive Bayes, Decision Trees, Random Forests and Support Vector Machines, using 80 percent of samples for training and 20 percent for testing, with hyperparameters tuned by grid search. They also applied two feature-selection strategies—mRMR, which ranks counters by maximizing relevance while minimizing redundancy, and RFECV, which recursively eliminates the least informative features—to determine which of the chip’s counters actually matter. The headline numbers are impressive: the best models achieved 99 percent detection precision for both benign and malicious samples in the binary task of distinguishing attacks from legitimate software, while multi-class classification—identifying the exact attack type—held steady around 95 percent. Random Forest and Decision Trees consistently led the pack; Naive Bayes lagged, apparently because the counters are strongly interdependent, violating the independence assumption at its core.
The statistical rigor is notable. The team ran a nonparametric bootstrap analysis with 1,000 resampling replicates and found that the RFECV-based detection model’s confidence intervals were narrower than three thousandths across all metrics, with recall varying by as little as ±0.0015 percent. In plain terms, the near-perfect detection results are not an artifact of a lucky train-test split; they are stable under repeated resampling. The multi-class task showed wider intervals, as expected given the difficulty of distinguishing among many benign workload classes, but the intervals remained tight enough to confirm statistical reliability.
Perhaps the most consequential experiment addressed zero-day attacks—the scenario that keeps security architects awake. Using a leave-one-program-out strategy, the researchers trained their models on every attack except one, then tested whether the held-out attack, never seen during training, would still be flagged as malicious. Here the choice of feature-selection method became decisive, and in a way that reveals a deep interaction between algorithms. Random Forest paired best with mRMR: the ensemble’s random feature subsampling tolerates redundancy, and mRMR’s compact, non-redundant counter sets enhanced the diversity of the trees. Decision Trees, by contrast, paired best with RFECV, whose aggressive pruning of noisy features prevents a single-path model from overfitting to attack-specific artifacts. Attacks with strong, distinctive signatures—Flush+Reload, Flush+Fault, Page Walk, Spectre V1, TLB Eviction—were detected with near-perfect accuracy across most configurations, while stealthier ones such as Spectre V2, Timer Drift and Evict+Reload proved harder, occasionally dipping when the wrong counters were chosen. The lesson, the authors emphasize, is that selecting the right counters matters more than simply adding more of them.
Deployment feasibility was addressed head-on. Reading the counters via perf costs about 0.2 milliseconds per 10-millisecond sampling window—a 2 percent execution-time overhead. Inference is astonishingly cheap: tree-based and Naive Bayes models predict in hundreds of nanoseconds per sample, with Multinomial Naive Bayes reaching 673 nanoseconds, and memory footprints ranging from a few kilobytes to about 11 megabytes. Support Vector Machines, at several milliseconds per prediction, are relegated to offline forensic use rather than inline monitoring. The team also tackled a realistic complication: when attacks run alongside benign processes, raw counter values become noisy, and detection accuracy on unnormalized data collapsed to around 60 percent. Normalizing each counter by the number of retired instructions restored accuracy to 98.56 percent without sacrificing the 10-millisecond temporal resolution—no temporal smoothing required.
The study is candid about its limits. All experiments ran on a single RISC-V core model, so robustness across different microarchitectures remains untested; performance counters are inherently microarchitecture-dependent, and models trained on one chip may not transfer to another without retraining. The zero-day evaluation excludes whole attacks but not obfuscated or polymorphic variants engineered to evade counter-based detection. And the supervised approach requires labeled attack data, which may not exist for genuinely novel threats. The authors point to temporal deep-learning models such as RNNs and transformers, hybrid feature-selection methods, richer counter sets, and energy-aware detection on future RISC-V platforms with on-chip power sensors as the natural next steps.
Still, the core finding stands as a milestone for open-hardware security: a hardware-centric, proactive defense that needs no kernel patches, no new silicon, and no signatures—just the counters the chip already carries, a modest machine-learning model, and the discipline to choose the right features. As RISC-V marches into servers, automobiles and infrastructure, the ability to catch a Spectre-class attack in 10 milliseconds, from inside the chip, with 99 percent precision, may prove to be one of the architecture’s most valuable security features yet.
Subject of Research: Machine-learning detection of microarchitectural hardware attacks on RISC-V processors using on-chip hardware performance counters
Article Title: RISC-V hardware attack detection using on-chip hardware performance counters
Article References: Pou, A., Otero, B., Robledo, M., Pajuelo, A., & Canal, R. (2026). RISC-V hardware attack detection using on-chip hardware performance counters. Cybersecurity, 9(1), Article 222. https://doi.org/10.1186/s42400-026-00662-8
Image Credits: AI Generated
DOI: 10.1186/s42400-026-00662-8
Keywords: RISC-V, hardware performance counters, microarchitectural attacks, Spectre, machine learning, hardware security, side-channel attacks, XuanTie C910, anomaly detection, zero-day detection, Random Forest, feature selection
Cite Scienmag News
APA
MLA
Chicago
Teresa Odom. (September 24, 2026). Machine Learning Turns RISC-V Chips Into Their Own Hardware Attack Detectors. Scienmag. https://scienmag.com/machine-learning-turns-risc-v-chips-into-their-own-hardware-attack-detectors/
Teresa Odom. “Machine Learning Turns RISC-V Chips Into Their Own Hardware Attack Detectors.” Scienmag, 24 September 2026, https://scienmag.com/machine-learning-turns-risc-v-chips-into-their-own-hardware-attack-detectors/. Accessed 24 September 2026.
Teresa Odom. “Machine Learning Turns RISC-V Chips Into Their Own Hardware Attack Detectors.” Scienmag. September 24, 2026. https://scienmag.com/machine-learning-turns-risc-v-chips-into-their-own-hardware-attack-detectors/
Copy citation
Download RIS
Tags: anomaly detectionCPU microarchitectural monitoringdata center chip protectionembedded system securityfeature selectionhardware performance countershardware performance counters for attack detectionhardware securityhardware-based intrusion detectionMachine learningmachine learning for hardware attack detectionMeltdown and Spectre processor flawsmicroarchitectural attack mitigationmicroarchitectural attacksopen-source processor architecture securityopen-source processor securityRandom ForestRISC-VRISC-V security vulnerabilitiesside-channel attacksSpectrespeculative execution vulnerabilitiesXuanTie C910zero-day detection
