

\subsection{Using better decoding algorithms}

Since the maximum RAPL sample rate is currently fixed at $T = 1000$ samples per second, the number of
samples per transmission gets lower as the transmission rate increases. Therefore, to achieve higher transmission rates, we
have to extract as much information as we can from the samples. Unfortunately, using only the mean of the samples
for each transmitted bit gives us too little information, which prevented us from reliably achieving
transmission rates higher than 600 bits in the previous section.

One alternative to the simple decoder we have been using until now is to use clustering algorithms
such as Support Vector Machines or Random Forests. We propose to use the whole set of
samples corresponding to the transmission of each bit as features. More formally,
let $\sigma$ be a small integer, $T$ be the RAPL sample rate, $r$ be the Trojan's transmission rate,
and $c_i$ be the center of the time interval dedicated to the transmission of the $i$-th
message bit.
Then to decode the $i$-th message bit, the spy uses the $\sigma$
power samples taken at time points which are the closest to $c_i$.
In our experiments, we observed that $\sigma = \max(\lceil T/r \rceil, 4)$ is a good choice.
With this setup, since we always feed at least 4 power samples to the classifier, it can perform
much better at rates such as 1000 bits per second, where using $\lceil T/r \rceil$ would yield
only 1 power sample.

The first row of Figure~\ref{fig:mem_multibit} (1 bit per symbol)\footnote{That is, the binary case.}
shows the error rates for the transmission of
binary messages using DRAM based Trojans, under different workloads, when the
spy uses the Random Forests classifier. Again, in our experiment, we ran 10 independent
transmissions of a message of 1000 bits for each
transmission rate and workload. To train the classifier, we used an initial message
of 5000 bits with the correct labels.
We consider that the synchronization step is already done, that is, the value of $t_s$ is known a priori.

\begin{figure}[!ht]
  \centering
  \includegraphics[scale=1]{graphs/multibit/mem_multibit_benchmarks_big.pdf}
  \caption{Error rates for different transmission rates and workloads when transmitting 2, 3, and 4 bits at a time using DRAM-based Trojans combined with CPU-based power consumption states.}
  \label{fig:mem_multibit}
\end{figure}

We can see that by using Random Forests we can achieve much higher transmission rates.
Under both setups, the Trojan achieved 800 bps with error rates lower than 10\%.
When running on the notebook, the Trojan even achieved 1000 bps with around 10\% error rate.
Again, the channel is more robust when running in the notebook platform, where it is able to
transmit at 600 bps under MRBench and Terasort with 10\% error rate.
This makes the Random Forests decoder a better choice than our previous decoding algorithm, at
the expense of a more complex spy process, and the need of a possibly large
initial predefined message to train the classifier.

% One important observation is that we use \texttt{memset} with smaller chunks of memory than
% used with the simple decoder. These are fast enough to enable us to achieve high transmission rates.

\subsection{Encoding multiple bits}

In this section we investigate the possibility of transmitting non-binary symbols per
power modulation.
Our main observation is that, from DRAM power consumption samples, it is possible to distinguish, although with some error,
the size of the memory chunk set by \texttt{memset}.


Figure~\ref{fig:mem_4states} illustrates four memory power consumption states
representing symbols $a$, $b$, $c$, and $d$. Under the notebook setup, these symbols
correspond to the \texttt{memset} operation on memory chunks of size 0, 1.5, 3, and 6 times the platform's L3 size,
respectively. Similarly, under the desktop setup, they correspond to two sequential \texttt{memset} operations using
0, 0.8, 1.2, and 1.4 times the corresponding L3 size.
Notice that, if we want to transmit at high rates, we cannot use \texttt{memset} over too large
chunks of memory because the operation cannot take more
time than the inverse of the transmission rate, otherwise we get synchronization problems.


\begin{figure}[!htbp]
  \centering
  \includegraphics[scale=1]{graphs/multibit/mem_4states.pdf}
  \caption{Power consumption states representing 4 different symbols (2 bits), considering a random message of 1000 symbols transmitted at 200 symbols per second.}
  \label{fig:mem_4states}
\end{figure}


Recall Figure~\ref{fig:power_profiles}, where we can see distinct power consumption profiles
corresponding to different operations.
One straightforward algorithm to encode 4 bits at once, that is, 4 bits per symbol,
when modulating one symbol message is to use 4 threads: 1 thread is responsible for modulating
the DRAM power consumption, and the other 3 modulate only the PP0 power consumption.
The behavior of the encoding algorithm is shown in Table~\ref{tab:multibit_encoding}.
For example, to transmit the bits 1010, one thread does a \texttt{memset} operation
on a memory chunk 3 times the size of L3 cache, and 2 threads perform a CPU-bound task
for a predefined time interval.
Notice that in a system with more cores, we expect the number of symbols we can distinguish to
be larger, since it has more power consumption states.




\begin{table}[!ht]
\centering
\caption{Encoding 4 bits per transmitted symbol combining CPU and DRAM power consumption states under the notebook setup. For the desktop,
we used 0.8, 1.2, and 1.4 times L3, correspondingly.}
\setlength\tabcolsep{5pt}
\def\arraystretch{1.2}
\begin{tabular}{@{}cccccc@{}}
\cmidrule(l){3-6}
\multicolumn{2}{l}{\multirow{2}{*}{}} & \multicolumn{4}{c}{\textbf{DRAM power states}} \\
\multicolumn{2}{l}{} & Do nothing & \begin{tabular}[c]{@{}c@{}}\texttt{memset}\\ 1.5L3\end{tabular} & \begin{tabular}[c]{@{}c@{}}\texttt{memset}\\ 3L3\end{tabular} & \begin{tabular}[c]{@{}c@{}}\texttt{memset}\\ 6L3\end{tabular} \\ \midrule
\multirow{4}{*}{\textbf{\begin{tabular}[c]{@{}c@{}}CPU\\ power\\ states\end{tabular}}} & Do nothing & 0000 & 0001 & 0010 & 0011 \\
 & 1 thread & 0100 & 0101 & 0110 & 0111 \\
 & 2 threads & 1000 & 1001 & 1010 & 1011 \\
 & 3 threads & 1100 & 1101 & 1110 & 1111 \\ \bottomrule
\end{tabular}
\label{tab:multibit_encoding}
\end{table}



Figure~\ref{fig:mem_multibit} shows the error rates observed for the DRAM modulation combined with the CPU modulation
for different workloads. Notice that for 2 bits per symbol, there is no need for a CPU power modulation thread, since
there are 4 distinguishable memory power consumption states.
We can see that, under the desktop setup, it was possible to transmit at 2400 bps using 4 bits per symbol
 at error rates close to 15\%.
Furthermore, under both setups, it is possible to transmit at 1800 bits per second with error rates around 10\%.

It is important to note that the robustness of the channel is better when using 1 and 2 bits per symbol, since there is no need for CPU-power modulation threads,
which are less robust with respect to application interference. For more than 2 bits per symbol, the robustness of the channel under both setups is very similar.




