RISC-V attack detection: high scores, uneven results on unseen programs

A machine-learning study published on October 27, 2026 reported about 99.5% accuracy when detecting known malicious programs in a simulated RISC-V system. Results on programs withheld from training varied sharply by attack, and the study’s selected unknown-attack result is different from its systematic leave-one-program-out average. The experiments ran in gem5; physical RISC-V validation remains future work.

What the detector observes

The researchers built HARPY-V-GEM5, a dataset of simulated processor behavior from 32 programs: 16 benign applications and 16 malicious exploit programs. It combines hardware performance counters (HPCs), which record processor activity, with frequencies of the mnemonic names for committed instructions. A mnemonic is the short name for an instruction, such as an operation the processor carries out.

The team generated the traces with gem5 24.1.0.3, using a simulated single-core, single-threaded, out-of-order RISC-V processor configured at 3 GHz. It had 16 KiB L1 instruction and data caches and a 256 KiB L2 cache. The simulation sampled telemetry every 10,000 committed instructions, producing 12,890 samples per program and 412,480 samples overall.

High accuracy on known programs

In the known-attack test, HPC-based Random Forest reached 99.55% accuracy and HPC-based Decision Tree reached 99.54%. With instruction-mnemonic features, the reported detection accuracy was 99.08% for Random Forest and 99.06% for Decision Tree. These figures describe detection of malicious behavior in the simulated test.

Detection and identifying an attack family are different tasks. For known attacks, HPC-based Random Forest classified attack families with 97.52% accuracy; instruction-feature classification was about 60%. The higher detection figures do not mean the models identified which family an attack belonged to with the same accuracy.

What the unseen-program scores measure

The paper reports 90.08% accuracy for HPC-based Random Forest in a selected unknown-attack case study. Its systematic leave-one-program-out (LOPO) evaluation gives a different result: a 77.95% mean for HPC-based Random Forest. In LOPO, the researchers withheld one complete program and its 12,890 samples in each iteration, so the test set for that iteration contained behavior from a program excluded from training.

The paper’s results section also reports 89.38% for instruction-based Decision Tree in LOPO. Its abstract gives a separate figure of greater than 96% for instruction features on unseen attacks. Those are the figures the paper reports in those respective sections; they do not provide one shared instruction-feature score.

Attack-specific misses and the study’s limits

The LOPO results varied considerably across held-out programs, with reported cross-program standard deviations ranging from 25% to 36%. In attack-specific results, the paper reports 1.34% accuracy for spectrev2 and 0.00% for flush-fault-ret. It also describes complementary results between feature types: instruction-based models scored 0.00% on timer-drift, while HPC-based models detected it nearly perfectly.

The authors propose an instruction-based Decision Tree for lightweight initial monitoring, HPC-based Random Forest when attack attribution is needed, or a two-stage combination. These are research recommendations based on simulated experiments; validation on physical RISC-V hardware and integration into a live runtime monitor remain future work.