UC Irvine

Speculative execution features allow Spectre attacks to leak sensitive data. Using Hardware Performance Counters (HPCs) to detect these threats at runtime is promising, but standard machine learning models fail in real-world use because they break down due to hardware differences, background noise, and traffic shaping. To address this, our dissertation presents a unified framework combining physical hardware analysis with adaptive machine learning, systematically mapping how Spectre signatures vary across different leakage channels and processors like Intel, AMD, and ARM. To resolve these hardware-induced domain shifts, we designed a hybrid model that pairs a Domain-Adversarial LSTM (DA-LSTM) to track time-based patterns with an XGBoost classifier for precise decision boundaries, leveraging Source-Free Domain Adaptation (SFDA) so the system can automatically adjust to new, unlabeled hardware without original training data. Live client-server pipeline evaluations prove that this approach restores high-recall detection across diverse systems and matches traditional accuracy while cutting computational retraining time by roughly 85%, turning theoretical detection into a practical blueprint for microarchitectural defense.