  Cache attacks pose a threat to any code whose execution flow or memory
accesses depend on sensitive information. Especially in public clouds, where
caches are shared across several tenants, cache attacks remain an unsolved
problem. Cache attacks rely on evictions by the spy process, which alter the
execution behavior of the victim process. We show that hardware performance
events of cryptographic routines reveal the presence of cache attacks. Based on
this observation, we propose CacheShield, a tool to protect legacy code by
monitoring its execution and detecting the presence of cache attacks, thus
providing the opportunity to take preventative measures. CacheShield can be run
by users and does not require alteration of the OS or hypervisor, while
previously proposed software-based countermeasures require cooperation from the
hypervisor. Unlike methods that try to detect malicious processes, our approach
is lean, as only a fraction of the system needs to be monitored. It also
integrates well into today's cloud infrastructure, as concerned users can opt
to use CacheShield without support from the cloud service provider. Our results
show that CacheShield detects cache attacks fast, with high reliability, and
with few false positives, even in the presence of strong noise.
