  We present a kernel-level infrastructure that allows system-wide detection of
malicious applications attempting to exploit cache-based side-channel attacks
to break the process confinement enforced by standard operating systems. This
infrastructure relies on hardware performance counters to collect information
at runtime from all applications running on the machine. High-level detection
metrics are derived from these measurements to maximize the likelihood of
promptly detecting a malicious application. Our experimental assessment shows
that we can catch a large family of side-channel attacks with a significantly
reduced overhead. We also discuss countermeasures that can be enacted once a
process is suspected of carrying out a side-channel attack to increase the
overall tradeoff between the system's security level and the delivered
performance under non-suspected process executions.
