PCIe Monitoring for Secure Code Execution in Heterogeneous System Architectures

Heterogeneous architectures, such as GPUs, and FPGAs, are now widely used in data centers to handle demanding computational tasks. However, their growing adoption introduces new attack surfaces. For example, a malicious user could exploit a GPU by running unauthorized workloads –such as a crypto miner– causing performance degradation or making the resource unavailable. This work introduces a novel approach for detecting attacks in heterogeneous systems by monitoring PCIe traffic at the hardware level, from the host to the GPU accelerator. By inspecting runtime data and code transfers, the system can identify potentially malicious behavior using rule-based detection. A custom monitoring tool is implemented on an MPSoC-based emulation platform, leveraging predefined GPU instruction patterns to detect crypto miners. Fully hardware-based, the tool is scalable and adds no runtime overhead. The PCIe monitor achieves better performance than the corresponding state-of-the-art, CPU-based implementation by an overall speedup of x1.55, and it is more energy efficient by 543 times while occupying limited hardware resources.