Mohamed-Bachir Belaid

Nassim Belmecheri

Arnaud Gotlieb

Nadjib Lazaar

Helge Spieker

Ap

Approche générique pour l'acquisition de contraintes qualitatives

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Résumé

De nombreux problèmes de planification et d'ordonnancement impliquent la création de combinaisons subtiles de contraintes temporelles ou spatiales. La modélisation précise de ces contraintes, qui sont formulées dans diverses algèbres de relations, nécessite une expertise en modélisation basée sur les contraintes et implique un grand nombre de combinaisons logiques possibles. L'acquisition active de contraintes (AC) a été utilisée avec succès pour aider les utilisateurs non expérimentés à apprendre les réseaux de contraintes conjonctives par la génération d'une séquence de requêtes. Dans cet article, nous proposons une méthode d'AC appelée GEQCA pour Generic Qualitative Constraint Acquisition, qui permet d'apprendre les contraintes qualitatives en utilisant des requêtes qualitatives. GEQCA combine les requêtes qualitatives avec la cohérence de chemin limitée dans le temps (PC pour Path Consistency) et la propagation des connaissances de base pour acquérir les contraintes qualitatives. Nous prouvons

Introduction

Le raisonnement sur le temps et l'espace est essentiel pour résoudre de nombreux problèmes pratiques, tels que la planification automatisée [4] et l'ordonnancement [2]. Dans ce contexte, le calcul qualitatif fournit un cadre algébrique qui établit des relations entre des paires d'entités à l'aide d'un langage qui est exhaustif et disjoint par paires. Des exemples de calculs qualitatifs incluent (sans s'y limiter) l'algèbre des points [START_REF] Marc | Constraint propagation algorithms for temporal reasoning[END_REF] ou l'algèbre des intervalles d'Allen [1] pour raisonner sur les tâches temporelles, et le calcul des connexions de régions (RCC) [5] pour raisonner sur les relations topologiques entre les régions spatiales. Dans ce contexte, les techniques de satisfaction de contraintes et de programmation par contraintes (CP) sont des cadres pratiques pour modéliser et résoudre des réseaux de contraintes qualitatives. Pour faciliter la modélisation des problèmes de programmation par contraintes, Bessiere et al. ont introduit un cadre permettant d'apprendre les modèles de contraintes par un apprentissage passif à partir d'un ensemble d'exemples d'affectations étiquetées ou par un apprentissage actif avec des requêtes spécifiques permettant de classer les affectations complètes.

Cet article présente le concept de l'acquisition générique de contraintes qualitatives (GEQCA), un nouvel algorithme d'acquisition active de contraintes pour apprendre tout type de contraintes qualitatives entre entités. L'algorithme GE-QCA combine des requêtes qualitatives, une cohérence de chemin limitée dans le temps, une heuristique dédiée et une propagation des connaissances de base pour acquérir des contraintes. L'algorithme est conçu pour répondre aux limitations des algorithmes d'acquisition de contraintes existants, telles que l'incapacité de traiter les disjonctions, le contrôle du nombre de requêtes et la connaissance limitée du contexte. L'objectif de GEQCA est de faciliter la modélisation et la résolution de réseaux de contraintes complexes dans des situations pratiques telles que les problèmes d'ordonnancement.

Approche générique pour l'acquisition de contraintes qualitatives JFPC@PFIA 2023 GEQCA : Acquisition de contraintes via des requêtes qualitatives GEQCA est un algorithme générique conçu pour apprendre des contraintes qualitatives. Il est basé sur un nouveau concept appelé "requête qualitative", où l'utilisateur doit confirmer si une relation atomique est valide entre une paire de variables d'entité données. GEQCA prend en entrée un vocabulaire de variables d'entités, un langage de relations atomiques, des connaissances de base et un timeout comme paramètre. L'algorithme commence avec un réseau contenant uniquement des contraintes universelles entre entités, puis itère sur les paires d'entités pour réduire l'ensemble des relations possibles à un ensemble locallement consistant avec ce que l'utilisateur a en tête. GEQCA utilise une procédure de propagation pour réduire automatiquement les relations incompatibles avec l'état courant de l'apprentissage sans avoir besoin de passer par l'utilisateur.

Experiments

Notre évaluation expérimentale de GEQCA porte sur l'algèbre d'Allen appliquée à des entités temporelles. Le langage Γ utilisé contient les 13 relations atomiques connues de cette algèbre. Le tableau 1 présente l'effort fourni par l'utilisateur pour résoudre 5 instances de planification en utilisant GEQCA, avec une heuristique de sélection des paires que nous avons introduite dans ce travail. Nous avons utilisé les instances RCPSP3, disponibles publiquement, en considérant la structure du problème incluant la durée des tâches, les exigences en ressources et les capacités des sources, noté K 1 . De plus, certaines contraintes peuvent déjà être connues de l'utilisateur, telles que la contrainte globale cumulative et la contrainte de délai. Nous appelons K 2 le background knowledge incluant la contrainte cumulative et la contrainte de délai. Nous avons également utilisé une limite de temps (cutoff) d'une heure et noté T max le temps d'attente maximum entre deux requêtes. Chaque instance de planification est caractérisée par le nombre de tâches (par exemple, sch_30_1 fait référence à l'instance numéro 1 avec 30 TIs). La première observation est que l'utilisation de GEQCA avec des connaissances sur la structure du problème K 1 permet de réduire considérablement l'effort de l'utilisateur (en moyenne une réduction de 38%). La deuxième observation est que l'effort de l'utilisateur est également réduit lorsqu'il utilise des connaissances qui portent sur des contraintes connues telles que la contrainte cumulative et les contraintes de délai. Nous observons une réduction de 41% en utilisant K 1 pour la propagation. L'utilisation de K 1 ∧ K 2 apporte une amélioration faible mais non significative (en moyenne une réduction de 41% au lieu de 38%). En outre, en termes de temps CPU, le temps d'attente entre deux requêtes peut atteindre le seuil d'une heure sous K= K 1 ∧ K 2 . Cela s'explique par la procédure solve, qui peut prendre plus d'une heure pour essayer de prouver la cohérence d'une relation avec le réseau appris.

Mots-clés

Ordonnancement, SALB3PM, Modélisation, Programmation par contraintes, SAT, contraintes énergétiques 1. On doit minimiser le pic de consommation énergétique.

2. Chaque tâche doit être affectée à exactement une machine.

3. La somme des durées des tâches affectées à chaque machine ne peut pas dépasser le temps de cycle.

4. Si une tâche i précède une tâche j (i ≺ j), alors la tâche i ne peut pas être affectée à une machine de plus grand numéro que la tâche j.

5. Chaque tâche doit débuter à une et une seule période.

6. Si une tâche i précède une tâche j (i ≺ j) et que les deux tâches sont affectées à la même machine, alors la tâches j débute forcément après la tâche i.

Il est impossible d'avoir deux tâches en cours d'exécution sur la même machine à une période donnée.

Utilisation de SAT pour résoudre le problème SALBP avec minimisation du pic de consommation JFPC@PFIA 2023 1. Chaque tâche doit être affectée à au moins une machine.

min W max (1) s.t. k∈M X j,k = 1 ∀j ∈ O (2) j∈O t j × X j,k ≤ c ∀k ∈ M (3) X j,k ≤ h∈M :h≤k X i,h ∀i, j ∈ O : i ≺ j, k ∈ M (4) t∈T j S j,t = 1 ∀j ∈ O (5) S j,t ≤ t-ti τ =0 S i,τ + 2 -X i,k -X j,k ∀i, j ∈ O : i ≺ j, k ∈ M, t ∈ T j (6) X i,k + X j,k + t τ =t-ti+1 S i,τ + t τ =t-tj +1 S j,τ ≤ 3 ∀i, j ∈ O, k ∈ M, t ∈ T (7) j∈O W j × ( t τ =t-tj +1 S j,τ ) ≤ W max ∀t ∈ T (8) X i,k , S i,t ∈ {0, 1}, W max ∈ Z + ∀i ∈ O, k ∈ M, t ∈ T FIGURE 1 -
2. Chaque tâche doit être affectée à au plus une machine.

3. Si une tâche i précède une tâche j (i ≺ j), alors la tâche i ne peut pas être affectée à une machine de plus grand numéro que la tâche j.

4. Chaque tâche doit débuter à au moins une période.

5. Chaque tâche doit débuter à au plus une période.

6. Une tâche ne peut pas débuter si elle ne peut pas terminer avant la fin du temps de cycle.

7. Il est impossible d'avoir deux tâches en cours d'exécution sur la même machine à une période donnée.

8. Si une tâche débute à une période donnée, alors elle est forcément active ensuite pendant la durée de son exécution. 9. Si une tâche i précède une tâche j (i ≺ j), alors la tâche j ne peut pas être affectée à la même machine i et commencer après le début de la tâche i. On peut constater, par exemple en comparant la ligne (2) du programme linéaire et les lignes ( 2) et (3) de la formule propositionnelle, que le modèle SAT est beaucoup plus gros que le modèle linéaire. Pour cette raison, on effectue un prétraitement pour calculer un ensemble de décisions évidentes à cause de la liste des précédences et de la durée des tâches. Ces prétraitements servent à rajouter de nouvelles contraintes permettent de réduire la taille de l'espace de recherche mais elles servent surtout à éliminer des contraintes du modèle initial (si une des contraintes (2) à (9) est en contradiction avec une des contraintes (10) à (12), alors elle n'est pas intégrée au modèle) : 10 Si une chaîne de précédences empêche une tâche j d'être affectée sur une machine k, on interdit cette affectation (on le note ip(j, k) = 1)

k∈M X j,k ∀j ∈ O (1) X j,k1 ∨ X j,k2 ∀j ∈ O, k 1 , k 2 ∈ M : k 1 ̸ = k 2 (2) X j,k ∨ X i,h ∀i, j ∈ O : i ≺ j, k, h ∈ M : k < h (3) t∈T j S j,t ∀j ∈ O (4) S j,t1 ∨ S j,t2 ∀j ∈ O, t 1 , t 2 ∈ T j : t 1 ̸ = t 2 (5) S j,t ∀j ∈ O, t ∈ T : t / ∈ T j (6) X i,k ∨ X j,k ∨ A j,t ∨ A j,t ∀i, j ∈ O : i ̸ = j, k ∈ M, t ∈ T (7) S j,t ∨ A j,t+ϵ ∀j ∈ O, t ∈ T j , ϵ ∈ [0, t j -1] (8) X i,k ∨ X j,k ∨ S i,t1 ∨ S j,t2 ∀i, j ∈ O : i ≺ j, k ∈ M, (9)
t 1 ∈ T i , t 2 ∈ T j : t 1 > t 2 Xj, k ∀j ∈ O, k ∈ M : ip(j, k) (10) Xj, k ∨ S j,t ∀j ∈ O, k ∈ M : p(j, k), t ∈ T j : ip(j, k, t) (11) A j,t ∀t ∈ [c -t i , t i -1] (12) j∈C A j,t ∀C ∈ C, t ∈ T (13)
FIGURE 2 -Modélisation des contraintes de SALB3PM sous forme de formule propositionnelle 11 Si une chaîne de précédences empêche une tâche j d'être affectée sur une machine k à une période t, on interdit d'avoir simultanément cette affectation et cet ordonnancement (on le note ip(j, k, t) = 1) 12 Si une tâche a une durée qui dépasse la moitié du temps de cycle, elle est forcément active aux dates médianes Une fois que l'on a écrit le modèle mathématique précédent, sa résolution par un algorithme de résolution du problème SAT permet de trouver un ordonnancement faisable.

Pour ensuite déterminer l'ordonnancement avec un pic d'énergie minimum, on relance, autant de fois que possible, notre algorithme en intégrant au modèle des contraintes supplémentaires. Ces contraintes correspondent à l'interdiction d'exécuter en même temps un ensemble de tâches qui l'étaient dans la dernière solution calculée et dont la somme des énergies est supérieure au pic d'énergie de la meilleure solution rencontrée depuis le début de l'exécution de l'algorithme. Ces contraintes correspondent à la ligne (13) du modèle et l'ensemble C contient en permanence l'ensemble des ensembles de tâches que l'on ne souhaite plus voir ordonnancées en même temps. Après ajout de ces contraintes, on relance la résolution du problème de faisabilité.

Lorsqu'il n'est plus possible de trouver une solution pour le problème de faisabilité, la meilleure solution rencontrée jusqu'à cet instant est une solution optimale pour le problème SALB3PM.

Expérimentations

Nous avons expérimenté notre algorithme sur plusieurs instances de la littérature, avec pour chaque instance les résultats obtenus en implémentant le modèle existant sur CPLEX [3]

Conclusion

Dans cet article, on a étudié le problème SALB3PM. On a proposé une approche qui fait appel itérativement au problème SAT pour résoudre ce problème. Cette approche a été comparée avec une approche par programmation linéaire en nombres entiers existante, et donne des résultats préliminaires prometteurs. Ces résultats préliminaires doivent être confirmés en offrant le même niveau de finesse de modélisation pour les deux approches et en comparant avec les récentes améliorations du modèle linéaire [2]. Il faudra réfléchir également à comment réduire la taille du modèle SAT initial et comment mieux gérer la fonction objectif. Enfin, il serait intéressant d'essayer d'hybrider ces approches entre elles ou avec d'autres approches heuristiques [5].

TABLE 1 -

 1 Effort de l'utilisateur eF avec GEQCA agissant sur les instances RCPSP (avec cutoff = 3, 600s, T max en secondes).Utilisation de SAT pour résoudre le problème SALBP avec minimisation du pic de consommation

	Conclusion
	Cet article, publié à AAAI 2022, présente un nouvel al-gorithme d'apprentissage actif appelé GEQCA pour ap-prendre des réseaux qualitatifs via des requêtes qualitative.

L'algorithme utilise la propriété JEPD du calcul qualitatif et la cohérence du chemin sur les contraintes temporelles pour prouver la convergence et minimiser le nombre de requêtes nécessaires. Les résultats montrent que GEQCA est une approche appropriée et efficace pour des applications pratiques. Peak Minimization). On propose une résolution de ce problème en utilisant une séquence de problèmes SAT à résoudre, avec appels à un solveur SAT pour résoudre chaque sous-problème. La pertinence de cette approche est vérifiée expérimentalement par comparaison avec les résultats existants sur quelques instances issues de la littérature. Ces travaux sont une extension de

[4]

.

  Un ensemble de machines M numérotées de 1 à m.-Un temps de cycle c : après c unités de temps, les machines sont arrêtées. L'horizon temporel est découpé en périodes et est noté T = {0, ..., c -1}. On note l'ensemble T j = {0, ..., ct j } l'ensemble des périodes où peut commencer la tâche j ∈ O pour pouvoir terminer avant la fin du temps de cycle. -Un ensemble de précédences P : si une tâche i ∈ O précède une tâche j ∈ O, ce qui est noté i ≺ j, alors :-soit la tâche i est affectée à une machine de plus petit numéro que la tâche j, -soit les tâches i et j sont affectées à la même machine mais la tâche i est ordonnancée avant la tâche j. -La variable W max est une borne supérieure sur le pic de consommation énergétique. Les lignes du programme linéaire en nombres entiers modélisent la fonction objectif et les contraintes du problème :

			L'objectif du problème SALB3PM est de décider d'affecter chaque tâche sur une machine et d'ordonnancer les tâches affectées sur les mêmes machines (c'est à dire déterminer leur période de lancement), en minimisant le pic d'éner-gie de la solution obtenue, c'est à dire en minimisant la consommation maximale énergétique des tâches ordonnan-cées simultanément.
	1 Présentation SALB3PM	du	problème
	Le problème SALB3PM (Simple Assembly Line Balancing Problem with Power Peak Minimization) est un problème d'optimisation qui consiste, étant donné un ensemble de tâches et un ensemble de machines, à construire l'ordon-nancement des tâches sur les différentes machines de ma-nière à minimiser le pic d'énergie consommé par l'ordon-nancement obtenu. Les données du problème SALB3PM sont les suivantes :

-Un ensemble O de n tâches, où chaque tâche j ∈ O a une durée de traitement t j et une consommation énergétique W j . -

2 Modélisation linéaire existante

Dans l'article

[3]

, le problème SALB3PM est modélisé sous la forme du programme linéaire en nombres entiers présenté dans la figure

1

. Les variables de décision sont les suivantes :

-Les variables d'affectation X j,k . Étant donnée une tâche j ∈ O et une machine k ∈ M , la variable X j,k vaut 1 si et seulement si la tâche j est affectée à la machine k. -Les variables d'ordonnancement S j,t . Étant donnée une tâche j ∈ O et une période t ∈ T , la variable S j,t vaut 1 si et seulement si la tâche j débute à la période t.

  -Les variables d'ordonnancement S j,t . Étant donnée une tâche j ∈ O et une période t ∈ T , la variable S j,t vaut 1 si et seulement si la tâche j débute à la période t. -Les variables d'activité A j,t . Étant donnée une tâche j ∈ O et une période t ∈ T , la variable A j,t vaut 1 si et seulement si la tâche j est active à la période t. Les premières lignes de la formule propositionnelle modélisent les contraintes du problème :

Modélisation de SALB3PM sous forme de PLNE

[3]

8. Le pic de consommation énergétique est plus grand que la consommation maximale énergétique des tâches ordonnancées sur une même période. 3 Approche SAT On modélise le problème SALB3PM sous forme d'un problème de satisfaisabilité booléenne (problème SAT). Comme le problème SAT est un problème de décision, et non un problème d'optimisation, on modélise initialement le problème de faisabilité qui consiste à trouver une solution qui respecte toutes les contraintes du problème et qui est présenté dans la figure 2. Les variables de décisions sont les suivantes, où les deux premiers jeux de variables de décision sont les mêmes que pour la modélisation linéaire : -Les variables d'affectation X j,k . Étant donnée une tâche j ∈ O et une machine k ∈ M , la variable X j,k vaut 1 si et seulement si la tâche j est affectée à la machine k.

TABLE 1 -

 1 On considère 4 tâches, 3 machines, un temps de cycle c = 5 et des précédences lexicographiques o 1 ≺ o 2 ≺ o 3 ≺ o 4 : Tâche o 1 o 2 o 3 o 4 Comparaison des approches PLNE et SAT sur quelques instances La solution proposée a un pic d'énergie de 10, causé par l'ordonnancement des tâches o 1 , o 3 et o 4 . On ajoute donc les contraintes suivantes au modèle, pour empêcher désormais ces trois tâches d'être actives à une même période :On relance ensuite le solveur SAT et, à la troisième itération, le solveur SAT trouve que le problème ne possède pas de solution. La meilleure solution proposée jusqu'à maintenant, qui est ici la solution proposée à la deuxième itération, est donc la solution optimale, avec un pic d'énergie de 10.

	4 Exemple illustratif
	Durée	5	2	3	3
	Energie 4 Tout d'abord, on crée le modèle initial et, à la première ité-4 2 4 ration, le solveur SAT trouve la solution suivante :
	machine 1			o 1
	machine 2		o 2		o 3			Pic d'énergie : 12
	machine 3			o 4
		0	1	2	3	4	5	temps
	La solution proposée a un pic d'énergie de 12, causé par l'ordonnancement des tâches o 1 , o 2 et o 4 . On ajoute donc les contraintes suivantes au modèle, pour empêcher désor-mais ces trois tâches d'être actives à une même période :
	A o1,t ∨ A o2,t ∨ A o4,t			∀t ∈ T
	On relance ensuite le solveur SAT et, à la deuxième itéra-tion, le solveur SAT trouve la solution suivante :
	machine 1			o 1
	machine 2		o 2		o 3			Pic d'énergie : 10
	machine 3				o 4
		0	1	2	3	4	5	temps

  et les résultats obtenus avec notre algorithme. Le problème SAT sous-jacent est résolu grâce au solveur Sat4j[1]. On donne, pour chaque instance, le nombre de tâches n, de machines m, le temps de cycle c et, pour chaque méthode, le pic d'énergie de la meilleure solution calculée, la durée d'exécution (au plus 1 heure) et son statut (optimal ou non). On constate dans la table 1 que l'approche proposée permet de trouver la solution optimale sur plus d'instances (19 instances sur 21) qu'avec l'approche ILP connue (15 sur 21).

Remerciements

Ce travail a reçu un financement du projet T-LARGO et Au-toCSP du Conseil norvégien de la recherche, accord de subvention n°274786 et n°324674. Ainsi que du programme de recherche et d'innovation Horizon 2020 de l'Union européenne (projet TAILOR).


Alexis Falempin
email: alexis.falempin@cea.fr

Johan Laurent

Jean-Baptiste Doré

Rafik Zayani

Emilio Calvanese Strinati

On the Performance of Quantized Neural Networks based Digital Predistortion for PA linearization in OFDM systems

Keywords: OFDM, Energy-efficiency, Power amplifier, Digital pre-distortion, Machine learning, Neural networks, Quantization

Neural networks (NNs) based digital predistortion (DPD) have been shown to be a very promising technique to enhance power amplifier (PA) linearity. However, studies consider high level of quantization NNs (32-bits) whose implementation is not feasible in practice. Therefore, this paper investigates few-bits quantization of NNs based DPD for PA linearization in OFDM communication systems, in order to improve inference time, resources and energy efficiency. To perform quantization, we first operate a post training quantization to assess the impact of quantization on the NN. Second, we perform a quantization aware training (QAT) to cope with the quantization noise. Numerical simulations show that, via the QAT approach, 4-bits quantization of the NN parameters and activation functions, can offer excellent linearization performance, with slight degradation on the error vector magnitude (EVM) performance compared to the ideal case using 32-bits quantization. Consequently, considering 4bits, the resource usage is reduced by 62% compared to the 32-bits quantization, with slight EVM loss. Thus, the proposed quantization approach puts forward an efficient transmission chain using NN DPD for OFDM based wireless communication systems.

I. INTRODUCTION

Future communications systems such as 6G systems are leading the path to new services requiring high data rate and ultra low-latency [START_REF] Strinati | 6G: The Next Frontier: From Holographic Messaging to Artificial Intelligence Using Subterahertz and Visible Light Communication[END_REF]. Nevertheless, the major challenge is to offer a sustainable and cost-effective design of wireless transmitter, leading to green communications. To that extent, it becomes increasingly important to improve the energy consumption and computing resources of wireless transceivers. Particularly, we break down the hardware complexity of neural network (NN) based digital pre-distortion using quantization. Since, the radio-frequency (RF) power amplifier (PA) is the most critical power-hungry component in a transceiver, representing about 60% and 80% of the energy consumed respectively, in the BS and UE RF chains. Thus, its efficiency must be maximized in order to improve the global energy-efficiency transmitter and lessen the overall carbon footprint of the system. Nonetheless, RF PAs exhibits a high level of nonlinearities close to its saturation level, where its power efficiency is high [START_REF] Cripps | Nonlinear Effects in RF Power Amplifiers[END_REF]. Indeed, the PA induces nonlinear amplitude-to-amplitude (AM/AM) and amplitude-tophase (AM/PM) distortions on the transmitted signal affecting the performance at the receiver. Hence, one must find a tradeoff between linearity and power efficiency of the system.

To fulfill both aspects, digital pre-distortion has been shown to be the most effective PA linearization technique [START_REF] Hussein | Digital predistortion for RF power amplifiers: State of the art and advanced approaches[END_REF]. It consists in adding a module before the PA, such that the resulting system is linear. However, estimating a DPD module can be challenging due to the severity of nonlinearities induced by the PA.

Thus, machine learning techniques have been investigated in order to solve the issue of deriving a DPD module. Indeed, NNs are proven to be efficient at solving nonlinear problems. Nevertheless, NN based DPD has been widely investigated in the literature. In [START_REF] Tarver | Neural Network DPD via Backpropagation through a Neural Network Model of the PA[END_REF] and [START_REF] Wu | Residual Neural Networks for Digital Predistortion[END_REF], authors have proposed deep learning architectures which exhibit high performance. However, those algorithms present a high computational complexity and are difficult to implement. In [START_REF] Falempin | Low-Complexity Adaptive Digital Pre-Distortion with Meta-Learning based Neural Networks[END_REF], we designed low-complexity neural network architectures to perform DPD while being highly efficient to derive the DPD function. Nonetheless, even with low-complexity design, implementation of neural networks is still challenging because of computational cost and energy consumption. Hence, to propose efficient implementation of NNs, one must consider quantizing, i.e. lowering the number of bits to perform matrix multiplication and activation functions. Quantization of NNs is highly active in the literature since it permits optimizing computational resources and energy consumption [START_REF] Horowitz | 1.1 Computing's energy problem (and what we can do about it)[END_REF]. In [START_REF] Gholami | A Survey of Quantization Methods for Efficient Neural Network Inference[END_REF] and [START_REF] Nagel | A White Paper on Neural Network Quantization[END_REF], authors have studied the different approaches to perform quantization on NNs. However, to the best authors' knowledge, there is no use of quantization regarding state-of-the-art NN based DPD solutions.

The main contribution of this work is to enable quantized NN based DPD to enhance the resource usage of the transmission chain and by extent its energy efficiency. Thus, we analyze the effect of quantization on the performance of our developed solution in [START_REF] Falempin | Low-Complexity Adaptive Digital Pre-Distortion with Meta-Learning based Neural Networks[END_REF]. Specifically, we first study the impact of quantization on the parameters of a pre-trained NN based DPD using post-training quantization (PTQ). Using PTQ, numerical evaluation shows that a severe degradation occurs on the Error Vector Magnitude (EVM) and spectrum due to the quantization noise. Thus, we also use quantization aware training (QAT) on our NN to correct the quantization noise. Through numerical simulations, we show that QAT allows to use 4-bits quantization instead of the 32-bits one with a slight degradation on the EVM and spectrum. In addition, we give en estimation of the resource usage of our solution on FPGA regarding several quantization levels.

The remainder of this paper is structured as follows. Sec. II recalls the system model used in [START_REF] Falempin | Low-Complexity Adaptive Digital Pre-Distortion with Meta-Learning based Neural Networks[END_REF]. We introduce the quantization scheme and algorithms employed in Sec. III. While Sec. IV presents our simulation results, Sec. V draws the conclusion and some future perspectives of this work. For the sake of clarity, in this paper, lowercase bold symbols represent vectors, uppercase bold symbols represent matrices and regular symbols represent scalars.

II. SYSTEM MODEL A. Communication model

In this work, we consider a communication system pictured in Fig. 1 using an OFDM transmitter, a DPD based on NNs and a PA. To derive the DPD, a loop back link is necessary and is modeled as a complex perturbation coefficient h and additive noise n. Then, the received symbols are given by

y = hx + n, (1)
where z, y ∈ C N , N = N OF DM (N f f t + N CP ), h ∈ C and n ∼ CN (0, σ 2 ) with σ 2 the noise variance.

The PA model is characterized by an amplitude distortion function (AM/AM) denoted by f ρ and a phase distortion function (AM/PM) denoted by f Φ . The output characteristics, modulus and phase, are given by

|y| = f ρ (|x|) and arg(y) = f Φ (|x|) + arg(x) (2)
where x and y are the PA input and output signals, respectively. Assuming a PA derived from a 3GPP Rapp model for communication [START_REF] Nokia | Realistic power amplifier model for the New Radio evaluation[END_REF], the two functions are defined as follows:

f ρ (u) = Gu 1 + Gu Vsat 2p 1 2p , f Φ (u) = Au q 1 + u B q (3)
where u denotes the magnitude of the input signal. G represents the gain in linear region, p the "knee" factor and V sat the saturation voltage level. A, B and q are fitting parameters. Thereafter, we consider the following input back-off (IBO) definition :

IBO = P sat,in P avg,in , (4)
where P sat,in corresponds to the input power for which the PA reaches its saturation level and P avg,in the average input power.

B. Low-Complexity Neural Network for DPD (LCDPDNN)

In this section, we recall the architecture of our designed DPD introduced in [START_REF] Falempin | Low-Complexity Adaptive Digital Pre-Distortion with Meta-Learning based Neural Networks[END_REF]. A slight modification of this architecture has been done to make it more robust to quantization effects. Each neural network allows to correct respectively AM/AM and AM/PM distortions. Fig. 2a presents the NN estimating the function f -1

γ 0 (|i|) g 1 (|y|) f -1 ρ (|i|) (a) DPD for AM/AM distortion γ 1 . . . × Dense (ReLU) |i| γ 1 (|i|) g 2 (|i|) f -Φ (|i|) (b) DPD for AM/PM distortion
ρ such that (f ρ • f -1 ρ )(|i|) = G|i|. f -1 ρ (u) = ReLU [g 0 (u) + g 1 (u) + b z ] , (5)
where

     g 0 (u) = γ 0 (u) + (1 -γ 0 (u)) u, γ 0 (u) = 1 + e -α(u-ωρ) -1 , g 1 (u) = N ρ n j=1 ω ρ j [ReLU(W ρ u + b ρ )] j ,
where b z , α, ω ρ , ω ρ j ∈ R, W ρ ∈ R 1×N ρ n and b ρ ∈ R 1×N ρ n are trainable variables optimized during the learning phase. N ρ n denotes the number of neurons. ReLU function is defined by

f (x i ) = max(0, x i ), x i = [x] i .
Similarly, Fig. 2b presents the NN estimating the function

f-Φ such that f Φ (|i|) + f-Φ (|i|) = 0. f-Φ (u) = γ 1 (u)g 2 (u), (6)
where 2) Training: To train both NNs, we consider using indirect learning architecture (ILA). It consists in deriving a postdistorter and placing it before the PA. To do so, we build two datasets D ρ (|z|, |x|) and D Φ (|x|, f Φ (z)) for training, respectively, AM/AM DPD and AM/PM DPD NNs. θ ρ and θ Φ denote all the trainable parameters required to compute respectively f -1 ρ and fΦ . θ ρ and θ Φ are obtained through the optimization of a mean squared error loss function using gradient descent as,

γ 1 (u) = 1 + e -β(u-ωΦ) -1 , g 2 (u) = N Φ n j=1 ω Φ j ReLU [(W Φ u + b Φ )] j , where β, ω Φ , ω Φ j ∈ R, W Φ ∈ R 1×N Φ n and b Φ ∈ R 1×N Φ n are
θ k ρ = θ k-1 ρ -∇ θ k-1 ρ L ρ (θ k-1 ρ , D ρ ), (7)
θ k Φ = θ k-1 Φ -∇ θ k-1 Φ L Φ (θ k-1 Φ , D Φ ),
where k ∈ {1, . . . , N } with N the number of gradient steps. L(θ k-1 , D) represents the loss function between the training dataset D and the predictions of the NNs using the parameters θ k-1 . Once the training his finished, we store the optimal parameters for inference and quantization processing.

III. QUANTIZATION OF NEURAL NETWORKS For cost-effective implementation of NNs, quantization is mandatory in order to minimize latency and energy consumption. Thereafter, we present the quantization scheme and techniques applied to the LCDPDNN presented in Sec. II-B.

A. Quantization Scheme

There are two different ways to represent a fractional number, floating-point and fixed-point. In this paper, we consider the fixed-point arithmetic because it is easier to implement and less resource-intensive than floating-point arithmetic.

1) Fixed-Point representation: We define S(i, f ) being a signed fixed point number representation with i bits for the integer part including the sign bit and f bits for the fractional part. Using this representation, the range of a number with i + f bits will be -2 i-1 , 2 i-1 -2 -f and a step of 2 -f . As a toy example, let suppose having S(1, 1) to represent a number r. Then r ∈ {-1, 0.5, 0, 0.5}.

2) Fractional number to fixed-point number: Now, let's suppose that we have a given fractional number r to represent using a scheme S(i, f ). The resulting fixed point number is given by

Q(r, i, f ) = clip r2 f 2 f , -2 i-1 , 2 i-1 -2 -f , (8)
where ⌊.⌉ performs rounding half to even and clip(u, [min, max]) returns min if u < min, max if u > max and u otherwise. We denote N bits = i + f , the total number of bits for the considered scheme.

B. Post Training Quantization (PTQ)

PTQ is the fastest technique to quantize the weights and activation functions of a NN. As its name indicates, the quantization is performed on a pre-trained NN. Regarding our model defined in Sec. II-B, we suppose that we have performed a training leading to optimal set of weights θ N ρ and θ N Φ . Then, we apply PTQ on both weights and activation functions using the function Q described in Eq. [START_REF] Gholami | A Survey of Quantization Methods for Efficient Neural Network Inference[END_REF]. Each parameter of the set θ N ρ and respectively θ N Φ can use a different quantization scheme S(i, f ). This allows some flexibility to build a trade-off between performance and quantization levels. Finally, each neuron output is quantized the same way as the weights using the Q function.

NN Q(N N ) Q(N N ) ∇L(Q(θ k-1 ), D) STE θ k-1 -α∇L(Q(θ k-1 ), D)
i Fig. 3. QAT algorithm for one gradient step This method is straightforward to enable quantization of NNs. However, we may expect severe performance degradation due to the noise introduced by the quantization. To cope with this issue, we introduce in the next paragraph an algorithm able to mitigate the added quantization noise.

C. Quantization Aware Training (QAT)

QAT is a training algorithm that takes into account the error brought by the quantization of weights and activation functions. Fig. 3 presents the QAT algorithm for one gradient step. We perform a forward pass using the Q function to quantize the weights and activations of the NN. Then, we calculate the gradients of the loss w.r.t. to the weights and finally we update the weights using a regular gradient descent or an optimizer such as Adam [START_REF] Kingma | Adam: A method for stochastic optimization[END_REF]. It must be underlined that the quantization only occurs in the forward pass, i.e. on the hatched box in Fig. 3. Gradients computation and gradient descent are performed in floating-point over 32 bits to avoid zero gradient issue.

Besides, to compute the gradient of the loss w.r.t. to the quantized weights, one may encounter an issue due to the rounding function. The rounding function is a step function and its gradient is almost zero everywhere. This will leads to a convergence problem during the training. Thus, we use a straight through estimator (STE) [START_REF] Bengio | Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation[END_REF] which considers the rounding function as a linear function. Then, its derivative equals 1. It is a biased estimator but allows to escape from the zero gradient issue.

Finally, once QAT has fully converged, we stores the quantized weights for further implementation on-chip or field programmable gate array (FPGA).

IV. NUMERICAL SIMULATIONS

In this section, we evaluate the impact of both PTQ and QAT on the performance of our NN based DPD. Regarding the system model, we consider using a 64-QAM and OFDM with N f f t = 1024 and N CP = 72. The PA follows the model given in Eq. ( 3) with p = 0.7, A = -345, B = 0.17 and q = 4. N ρ n = 6 and N Φ n = 3 are the number of neurons used respectively for the AM/AM and AM/PM DPDs. We evaluate the EVM and conduct a spectrum analysis to assess the impact of different quantization schemes. Besides, the baseline model denotes the DPD w/o quantization.

A. Choice of quantization schemes

In order to perform PTQ and QAT, we must choose coherent quantization schemes regarding the activation functions and weights.

S(3, f ) bρ, b Φ S(1, f ) ω ρ j , ω Φ j S(1, f ) γ 0 , γ 1 S(0, 12) ReLU S(2, 10)
Regarding the activation functions, since the γ function is the most complex, we use the scheme S(0, 12) which is an unsigned fixed point number. γ ranges between 0 and 1 hence no bits are required for the integer part. 12 bits are needed to have an efficient sigmoid, otherwise it leads to an unusable DPD. For the ReLUs, we employ the scheme S(2, 10) because the output value may exceed 1. Choosing those schemes will ensure no loss on the performance. Moreover, on a real system, input data of the NN will be quantized on 12 bits. Concerning the weights, we are mainly interested in changing the fractional bits f . Indeed, the weights

ω ρ j , ω Φ j ∈ [-1, 1), b ρ , b Φ , b z ∈ [-1, 1) and W ρ , W Φ in[-4, 4).

B. EVM performance

Here, we analyze the impact of the quantization on the EVM. Fig. 4 presents the EVM performance of our baseline model and using PTQ and QAT. The green line corresponds to the DPD without quantization, the orange and magenta bars are respectively the EVM performance using PTQ and QAT. The number of bits corresponds to the variation of the quantization scheme S(1, f ) used for parameters described in Table I.

First, we can notice that the PTQ exhibits high performance loss when the number of bits is lower than 7. We also remark that for quantization levels higher than 7 bits, the DPD reaches an EVM threshold around -30dB which is still far from the baseline model reaching -40dB.

Second, we observe that QAT allows to almost reach the baseline model performance. The EVM always reaches -35dB. For quantization levels higher than 7 bits, QAT permits reaching the same performance as the baseline model. Besides, for low-bit quantization, i.e. lower than 6 bits, we have up to 30dB gain in terms of EVM performance.

C. Spectrum analysis

In this paragraph, we conduct a spectrum analysis concerning the impact of quantization on the our NNs. All the spectrums presented are obtained using a digital up converter (DUC) function in order to design a realistic RF chain. This function is composed of multiple filters which design and coefficients can be found in [START_REF] Xilinx | Zynq UltraScale+ RFSoC RF Data Converter[END_REF]. Fig. 5 and Fig. 6 present power spectral densities (PSDs) using respectively S(1, 9) and S(1, 3) quantization schemes for the DPD. First, in Fig. 5, concerning the PTQ, we observe that we have a small degradation which is correct. Using QAT allows to have the same PSD as the baseline model. Second, in Fig. 6, the PTQ produces a PSD which is worse than using the PA w/o DPD. However, QAT will almost cancel the quantization noise. All the nonlinearities from the PA are canceled. Even if a small degradation is still present compared to the baseline model, the noise level is below -40dB which is sufficient for practical systems. Thus, we can state that QAT is mandatory to improve the performance of the LCDPDNN while using quantization.

D. Trade-off between implementation complexity and performance

To evaluate the benefits of the quantization, we perform an analysis of the resource consumption using a FPGA synthesis for implementation on a system on chip from Xilinx [START_REF]Zynq UltraScale XCZU9EG MPSoC Data Sheet[END_REF]. Specifically, the resource usage is given in terms of Configurable Logic Blocks (CLB) that constitute the FPGA. Fig. 7 presents the resource usage of the FPGA for the quantization scheme S(1, f ). The resource usage is presented in terms of In Fig. 7, the blue bar presents the number of required LUTs to compute LCDPDNN on FPGA. We observe that the LUTs usage is the same between 6 and 12 bits but is higher with 32 bits. The same interpretation can be given regarding the registers usage represented by the red bars. It may seem that the FPGA exhibits higher resource usage for 4 bits regarding the number of LUTs and registers. However, judging by the yellow bar, it can be noted that the FPGA uses less DSPs than other quantization schemes which the rise of LUTs and registers. As a comparison, the implementation of a 4096 points FFT (12 bits input/output) requires 3160 LUTs, 6230 registers and 48 DSPs. The proposed implementation is therefore of a slightly lower order of magnitude. Next, we can approximate the whole resource usage by considering that 1 LUT is equivalent to 2 registers and 1 DSP is equivalent to 109 LUTs. Thus, using this approximation, 4-bits quantization reduces the resource usage by 62% compared to the 32-bits one, with a slight degradation on the EVM, leading to less than -35dB.

V. CONCLUSION In this paper, we studied the use of quantization on NNs performing DPD for PA linearization. The goal is to reduce resource usage and to improve its energy efficiency. We performed a fixed-point quantization on the parameters and outputs of the NNs using PTQ to first assess the impact of the latter. Numerical evaluations show that PTQ is severely degrading the performance when the number of bits is low which is undesirable. Thus, using QAT allows to reduce the quantization noise and then retrieve the baseline performance in terms of EVM and spectrum considerations. We showed that we can use only 4 bits for most parameters and 12 bits for the outputs of the NNs to get excellent performance compared to the baseline model. In addition, through a FPGA synthesis of our NN, it appears that quantization highly reduce the resource usage. Hence, through fixed-point quantization and QAT, we provided a low-complexity and low-cost NN based DPD that can be used in real time systems. Eventually, future work will enable the implementation of the proposed solution using a FPGA taking into account the quantization aspects for lowcost design.

1 -

 1 Fig. 1. Communication system

Fig. 2 .

 2 Fig. 2. Architecture of the LCDPDNN for AM/AM and AM/PM distortions

  trainable variables optimized during the training phase. N Φ n denotes the number of neurons.

Fig. 4 .

 4 Fig. 4. EVM performance using PTQ and QAT

0Fig. 5 .0Fig. 6 .Fig. 7 .

 567 Fig. 5. Spectrum using PTQ and QAT, N bits = 10


A Hybrid Solution for Constraint Devices to Detect Microarchitectural Attacks Anonymized

Keywords: IoT, Security, HPCs, Edge-Computing, Local-Remote Detection, Microarchitectural Attacks

We are seeing an increase in cybersecurity attacks on resource-constrained systems such as the Internet of Things (IoT) and Industrial IoT (IIoT) devices. Recently, a new category of attacks has emerged called microarchitectural attacks. It targets hardware units of the system such as the processor or memory and is often complicated if not impossible to remediate since it imposes modifying the hardware. In default of remediation, some solutions propose to detect these attacks. Yet, most of them are not suitable for embedded systems since they are based on complex machine learning algorithms.

In this paper, we propose an edge-computing security solution for attack detection that uses a local-remote machine learning implementation to find an equilibrium between accuracy and decision-making latency while addressing the memory, performance, and communication bandwidth constraints of resource-constrained systems. We demonstrate effectiveness in the detection of multiple microarchitectural attacks such as Rowhammer or cache attacks on an embedded device with an accuracy of 98.75% and a FPR near 0%. To limit the overhead on the communication bus, the proposed solution filters 99% of the samples during normal operation.

Introduction

In recent years, we have observed an increasing number of Internet of Things (IoT) and Industrial IoT (IIoT) devices. Millions of these devices are placed in critical locations and collect data that are later processed to make appropriate decisions and take actions. However, despite their use in critical applications (such as health, transport or smart cities), IoT devices often lack security guarantees and security support.

In parallel to malwares such as cryptolockers, worms or trojans, a new class of attacks has emerged that we refer to as microarchitectural attacks. Microarchitectural attacks include attacks such as Cache Side-Channel Attacks (CacheSCA) [START_REF] Gruss | Flush+ flush: a fast and stealthy cache attack[END_REF], Rowhammer [START_REF] Gruss | Rowhammer. js: A remote software-induced fault attack in javascript[END_REF], Spectre [START_REF] Kocher | Spectre attacks: Exploiting speculative execution[END_REF], and Meltdown [START_REF] Lipp | Meltdown: Reading kernel memory from user space[END_REF] and target hardware units such as the processor or the memory. One major threat of these attacks is the complexity required to remediate them that often imposes the modification of the component itself or an important overhead on the performances. Thus, in default of remediation, some solutions based on the detection of these attacks were presented in the state of the art to circumvent this problem. Yet, most of them are not suitable for embedded systems. These solutions are based on a too complex machine learning algorithm that does not fit in a little processor or solutions that create a very big overhead on the communication bus. In such systems, performance, memory, energy consumption, and communication bandwidth play an important role in adopting a security solution to detect microarchitectural attacks.

Since microarchitectural attacks directly exploit hardware, a number of works [START_REF] Gulmezoglu | Fortuneteller: Predicting microarchitectural attacks via unsupervised deep learning[END_REF], [START_REF] Mushtaq | Whisper: A tool for run-time detection of side-channel attacks[END_REF], [START_REF] Wang | Hardware performance counter-based malware identification and detection with adaptive compressive sensing[END_REF], [START_REF] Polychronou | Madman: Detection of software attacks targeting hardware vulnerabilities[END_REF] rely on Hardware Performance Counters (HPCs) to detect these attacks. HPCs are special core registers found in most modern processors. They enable the measurement of hardware-specific events with near-zero overhead for the CPU. Proposed detection solutions extract and analyse HPCs to characterize the behavior of a program using machine learning (ML). Despite the large number of published security solutions using the HPC-ML configuration, most of them are not suitable for IoT devices due to their high overhead induced by complex ML algorithms.

While we aim for a high attack detection rate, we also need to consider a minimum FPR (that is, avoiding false alarms during normal execution of the system). Due to the criticity of some IoT systems (health, industry, transport, etc), they will implement response mechanisms to prevent damage to human or environment. Thus, undetected attacks may obviously damage the system or extract sensitive data. However, frequently triggering response mechanisms due to a false alarm (such as a system recovery) would result in the device not operating properly. Though, a high FPR can also increase system overheads. Furthermore, as IoT devices often extract and transmit data to a remote server, the required bandwidth is a critical parameter for their normal operation.

Related works:

In the literature we find two main implementation approaches: remote and local. The first approach implements the security mechanism locally within devices, either in software or hardware. This approach allows fast detection and reduces communication and memory overhead of storing and transmitting the HPC measurements remotely later. On the downside, this approach increases the performance overhead since we must extract system information and deploy the ML to decide for the presence or not of an attack. Simple ML models such as Logistic Regression (LR), Decision Trees (DT) etc, can reduce the induced overheads. However, due to their simplicity they have limited learning capacity which can result in low accuracy i.e., either high detection rate and increased FPR, or low detection rate and low FPR. This is why complex ML implementations are preferred.

To reduce the FPR while having high detection rate, in [START_REF] Mushtaq | Whisper: A tool for run-time detection of side-channel attacks[END_REF] the authors use ensemble ML. In an ensemble ML, two or more ML algorithms are used, while the final decision is made by a majority vote. The drawback of this solution is the bigger performance overhead (8%) of using multiple ML algorithms in combination and using one specific model per attack vector. In another work [START_REF] Gulmezoglu | Fortuneteller: Predicting microarchitectural attacks via unsupervised deep learning[END_REF], the authors propose Long Short-Term Memory networks (LSTM) for detection of microarchitectural attacks in desktop and server environments. They use the LSTM to learn the behavior of the system during normal operation, which enables them to detect any deviation from it as malicious. They manage to detect attacks with 99.70% F-score, 0.125% FPR and 3.5% performance overhead. However, LSTMs are resource-intensive MLs, and while a 3.5% performance overhead is not high for server or desktop environments, it can pose limitations when deployed in an IoT device, as resources are limited. Decreasing the frequency of HPC extraction and ML deployment can reduce the overheads, but as shown in [START_REF] Polychronou | Madman: Detection of software attacks targeting hardware vulnerabilities[END_REF], in this case the ML algorithms might be vulnerable to evasive attacks, i.e., attacks whose behavior is modified in a way that the extracted HPCs are closer to the normal behavior.

The second approach implements the security mechanism in a remote system such as a cloud server. This approach reduces the performance overhead of the local implementation of the detection mechanism, since it only needs to periodically extract HPCs, but significantly increases the memory and communication overhead since we must store this extracted information before transmitting them to a remote server. In [START_REF] He | Power-grid controller anomaly detection with enhanced temporal deep learning[END_REF], the authors use LSTM and Conditional Restricted Boltzmann Machine (CRBM) in a remote system. They succeed in detecting attacks with 99.97% accuracy and have an FPR of 0.5%. In [START_REF] Krishnamurthy | Anomaly detection in real-time multi-threaded processes using hardware performance counters[END_REF], the authors use a one-class SVM and detect attacks with an accuracy of 100%. Both implementations extract HPC data every 1 ms, which significantly increases communication overhead. Considering the hundreds of other edge devices transmitting all of their extracted information, these solution might lead to exceeding the networks capacity, which can result in slowdowns and unavailability.

Both approaches seek to minimize some overheads at the expense of others. On the other hand, we find a promising approach [START_REF] Wang | Hardware performance counter-based malware identification and detection with adaptive compressive sensing[END_REF] for resource-constrained systems. In [START_REF] Wang | Hardware performance counter-based malware identification and detection with adaptive compressive sensing[END_REF], authors use information from the HPCs in combination with a remote implementation of ML, to avoid overheads in the local system. They also try to reduce the communication overhead of sending all extracted HPC samples by sending only a compressed version. However, authors found that increasing the compression rate reduces the accuracy. A compression rate of 20% and 30% showed the best detection rate. Yet, their idea is limited in that it relies on signature checking, which attack authors can avoid [START_REF] Demme | On the feasibility of online malware detection with performance counters[END_REF]. Also, they rely on matrix multiplication for local data compression, which tends to increase execution overhead exponentially with the size of the data being compressed and linearly with the compression rate. The authors measure the performance overhead to be more than 5% at a compression rate of 30%.

From the works cited above, we observe that the use of complex ML models is preferred, due to their ability to provide a high detection rate, while minimizing the FPR. On the downside, implementing these solutions locally induces an increased performance overhead, which might be restrictive for IoT devices. While, remote implementations resolve the performance overhead issue but the required bandwidth required to periodically transmit all the extracted information should be optimized, otherwise it could lead to network issues. Also, they will be totally ineffective if the network is down.

Contributions:

We propose a HPC-based mechanism allowing to detect microarchitectural attacks and compliant with resource limited devices. This solution is based on a local-remote approach, featuring a simple ML classifier locally to the device, alongside complex and resource heavy ML located in a remote cloud. The local ML will first try to decide how likely a behavior is suspicious and send the samples to the cloud only if necessary for further analysis.

This solution is based on edge computing concepts and takes advantage of both local and remote approaches to accurately detect attacks, targeting a 0% FPR without imposing large overhead on the local system while minimizing bandwidth. This target of 0% FPR is introduced by the likelihood of automatic fallback mechanisms in critical IoT devices that will disrupt physical processes (e.g., health monitoring, power distribution, etc) and which should only be triggered for good reasons. Hence, our contributions are the following:

• We propose the first HPC-based local-remote ML mechanism to detect microarchitectural attacks in resource-limited devices. To decide when to send a sample to the remote ML, we implement a two-level detection threshold scheme. • We evaluate and compare ML algorithm implementations in local, remote, and local-remote systems. We evaluate our solution against microarchitectural attacks and compare it to related works. • Finally, we propose and evaluate a near zero false positives strategy (FP) based on an Isolation Forest algorithm used in combination with the local-remote implementation.

Outline: The remainder of the paper is organized as follows. In Section 2, we introduce our local-remote ML mechanism allowing to detect microarchitectural attacks and analyze it in detail. Then, in Section 3, we compare ML algorithms implemented locally, remotely, and finally the local-remote implementation. In Section 4, we adapt the approach of [START_REF] Sadaf | Intrusion detection based on autoencoder and isolation forest in fog computing[END_REF] to the needs of our proposed idea and successfully further reduce the FPR. Section 5 talks about the comparison between our solution with related works and Section 6 discusses limitations of our solution. Finally, Section 7 summarizes our work and concludes.

Proposed solution

We propose a solution that uses edge computing techniques to detect microarchitectural attacks in constraint devices such as IoT and decrease the use of the communication bandwidth. The global architecture is represented in Figure 1 and describes a first level of detection on the local IoT devices and a second on a remote server. The edge device preprocesses the extracted HPC data to filter out the ones with low value of maliciousness, i.e., the normal HPC measurements. To be somewhat independent of a remote security solution, the local ML is able to raise an alarm when it is convinced that an attack is being carried out. This is useful in cases where the network is down and no connection to the remote solution is possible. HPC values that cannot easily be labeled neither as malicious or trusted are transmitted to a remote server for further analysis. In this case, a complex ML can accurately detect malicious activities. The proposed idea allows us to move parts of the storage and processing resources away from the remote center and closer to the local device. This idea overcomes many limitations of traditional cloud computing such as latency, service delays, network outages, and reliability.

Local ML implementation

In each edge device, the local ML algorithm which processes the HPC values can be supervised or unsupervised. It reads the HPC samples and outputs a probability between 0% and 100% for each sample to be a microarchitectural attack. The implementation, as shown in Figure 2, allows us to trust samples with a low probability of an attack. It sends samples with an intermediate probability to a remote ML for further evaluation and raises an alert if there are samples with a high attack probability. This is achieved by setting two thresholds. The first threshold (alert threshold) acts as a trigger for detecting samples that have a high probability of being a microarchitectural attack. We choose the alert threshold based on the maximum probability obtained using the local ML for only normal training samples, plus an extra offset. This offset acts as an uncertainty level. By choosing the alert threshold as this, we are more certain that during evaluation the local ML will not raise false alerts.

The second threshold (suspicious threshold) is set to allow the samples that our local ML cannot identify with high confidence to be stored and later sent to the remote ML for further processing. MLs from related work use a probability of 50% to classify samples as malicious or normal. We chose to set the suspicious threshold to the threshold with the maximum G mean , as shown in [START_REF]Correlation coefficient: Simple definition, formula, easy steps[END_REF]. G mean is a metric that tries to find an equilibrium between FPR and True Positive Rate (TPR). Essentially, G mean will give us the probability threshold that allow us to filter as many normal samples as possible, while also maximizing the suspicious samples to raise an alert locally or sent them to the remote for further evaluation.

G mean = T P R * (1 -F P R) (1)
Subtracting an offset allows the local ML to label samples as suspicious a bit more loosely. This will allow to send malicious samples with behavior closer to normal to the remote ML, but also possibly future attacks based on zero-day vulnerabilities which may differ from learning data and have a lower suspicious score. The trade-off being that more normal traffic will also be sent for remote analysis.

Remote ML implementation

Suspicious samples are stored locally and then sent to a remote ML for further analysis. The local system sends suspicious samples every ∆s to the remote system. This value is chosen empirically and more analyses will be required to evaluate its optimum. The remote ML is based on a complex ML, which is capable of learning complicated behaviors. It can be either a supervised or an unsupervised ML implementation. An unsupervised ML implementation, such as an LSTM, learns only normal behavior and detects any behavior that deviates significantly from the patterns our ML mechanism is trained to identify as a normal behaviour. Using MLs that learn only from normal behavior, we can potentially detect zero-day attacks by hypothesizing that they deviate from normal behavior and that the local ML succeeds in labelling them as suspicious.

The remote system examines suspicious samples it receives from the local system for differences from normal behavior and flags them as abnormal if they deviate and notifies the local system. Examples of such complex MLs are Autoencoders, one-class SVM, and LSTM networks. LSTM is a network that uses information from past samples to make predictions for current or future samples. Thus, if a remote LSTM ML is used, the additional information about the past HPC samples increases the data sent to the remote.

Benefits of a local-remote approach: Local filtering allows us to reduce the memory requirements for local storage of the extracted samples while minimizing the communication and network overhead for transmitting the samples to the remote system each ∆s. Using this local-remote approach, we can generally filter most of the extracted data under normal operation, while only transmitting remotely data under attack. In the following sections, we evaluate various local-remote implementations and present their overhead and detection capabilities.

Solution evaluation

In this section, we evaluate various local or remote ML models individually and their combination using several detection metrics. We also evaluate the overheads incurred in the local system and the data successfully filtered. Section 3.1 will introduce our experimental platform and the choice of HPC we use for monitoring. Section 3.2 will present our experimental results, justifying our final choice of ML algorithms. In Section 3.3, we evaluate the filtering succeeded by the two-level threshold approach and finally, in Section 3.4, we optimize the memory required to save the extracted HPC data labelled suspicious.

Experimental platform

Our experimental platform is based on a Raspberry Pi4 Model B running on Ubuntu 20.04.2 LTS. Its processor is widely used in embedded devices with high resources requirements such as I-IoT gateways and has four ARM Cortex-A72 cores running at 1.5GHz. Each core of the processor provides 84 HPCs and enables the extraction of measurements from six registers simultaneously. As proposed in [START_REF] Polychronou | Madman: Detection of software attacks targeting hardware vulnerabilities[END_REF], we extract measurements from the HPC registers each 1ms to be able to detect cache attacks integrating eviction techniques. A dedicated kernel module mainly based on assembly code was used to extract the samples in order to limit the performance overhead.

To demonstrate our idea, we use several microarchitectural attacks as test vectors. These include CacheSCA variants, Spectre variants, Meltdown, and Rowhammer. Also, we include obfuscated (evasive) variants as suggested in [START_REF] Polychronou | Madman: Detection of software attacks targeting hardware vulnerabilities[END_REF] by inserting nop or sleep instructions in the attack code to hide malicious activity. Most of these attacks are publicly available from github [START_REF]Armageddon: Cache attacks on mobile devices[END_REF], [START_REF] Yuval | Mastik: A micro-architectural side-channel toolkit[END_REF], [START_REF] Jinbum | Csca (crypto side channel attack)[END_REF], [START_REF]Flush + flush[END_REF], [START_REF]Attempt of implementation of spectre for armv7a[END_REF], [30], [START_REF] Cosmin | Poc code implementing variant 3a of the meltdown attack for aarch64[END_REF] and modified to be able to run on the targeted processor. For our benign applications, we use MiBench [START_REF] Matthew R Guthaus | Mibench: A free, commercially representative embedded benchmark suite[END_REF] and PARSEC [START_REF] Bienia | The parsec benchmark suite: Characterization and architectural implications[END_REF], which are industry standard embedded system benchmarks that cover a wide range of applications. Our library contains 29 attacks and 72 normal applications.

As the number of events that can be measured simultaneously is limited to six on our experimental platform, it is essential to select the optimal subset of HPC registers to monitor in order to obtain the best detection results. There are different ways to identify the best suitable HPC registers:

• A first solution is to use HPC registers related to different hardware units of the processors: cache memory, bus, TLB, etc. • A second solution is to use generic HPC registers, that is to say, events that are implemented in most of the CPU cores (Intel, AMD, ARM, RISC-V).

• Feature extraction methods such as Pearson correlation [START_REF]Correlation coefficient: Simple definition, formula, easy steps[END_REF] or Mutual Information [START_REF] Miller | Entropy and mutual information[END_REF] are mathematical methods allowing to calculate the amount of information provided by a hardware event in order to detect or classify data. • A theoretical study was proposed in the review [START_REF] Polychronou | A comprehensive survey of attacks without physical access targeting hardware vulnerabilities in iot/iiot devices, and their detection mechanisms[END_REF] to present the most interesting events to detect microarchitectural attacks.

Finally, we selected six HPC events using Mutual information method. This requires the extraction of all available HPCs in the ARM cortex-A72 processor core during the execution of normal and malicious applications. The experimental setup described in Figure 3 was used to extract these measurements. The methodology can be divided in multiple steps:

• The top six features we obtained with this methodology for microarchitectural attacks detection in the context of IoT are the following:

• ISB_SPEC: This event counts each instruction barrier speculatively executed.

Evaluation of different ML algorithms

For the training of the ML algorithms we used a 70/30 random split of the different applications. Since some applications have a longer execution time than others, we used time-series data augmentation techniques as proposed in [START_REF] Kenji | An empirical survey of data augmentation for time series classification with neural networks[END_REF] to balance the number of samples between each application, either by upsampling or downsampling. Such techniques are time warping, magnitude warping, window warping, scaling, and window slicing. After augmenting our dataset we use 20% of the training data for validation using stratified sampling [START_REF] Zeng | Distribution-balanced stratified cross-validation for accuracy estimation[END_REF].

As a first step, we identify how each ML algorithm performs on our classification problem. Our motivation for evaluating the performance of each ML classifier is to show that simple local MLs are capable of identifying malicious samples but have a high FPR. This allows us to demonstrate the need to use complex MLs that have a lower FPR, and finally the advantages of a local-remote ML solution.

We selected two local ML classifiers for testing: (i) Linear SVC (LSVC), and (ii) AdaBoost using five Logistic Regression classifiers. We also select two remote ML classifiers: (i) LSTM, and (ii) LSTM Autoencoder (LSTMAE) with each of them using the seven past samples to predict the current one. For the evaluation, we use the following metrics: True Positive Rate (TPR) or detection rate, and FPR. TPR is a metric that measures how well we identify True Positives (TP) and FPR is the percentage of negative samples falsely classified as positive relative to the total number of negative samples. We pay significant attention to FPR because we argue that low FPR is as important as high TPR for resource-limited and critical devices. In Table 1, we display results according to the different classification metrics for each of the classifiers. These results for the simple MLs are obtained by using as the classification threshold, the 50% probability of a sample being a microarchitectural attack as in other state of the art works. For the complex MLs, we use as the classification threshold, the quantile (99.85%) of the distribution of the mean square of the reconstruction errors of the normal training dataset as in [START_REF] Oleksandr I Provotar | Unsupervised anomaly detection in time series using lstm-based autoencoders[END_REF].

Also as we can see from Table 1, the local MLs have a high TPR (∼ 99.70%) but also a high FPR (0.68% and 1.63%) while the more complex MLs have lower FPR (0.03% and 0.45%) than the simple MLs. The lower TPR of the complex ML is due to the fact that the simple MLs use classification, able to learn patterns from the input and knowing the final label, while the complex perform anomaly detection and detect as malicious any input that greatly deviates from the normal dataset. This is why the remote has lower FPR, since they are trained only with normal data, which helps the remote ML to recognize most normal samples. To recall, having a 0.5% FPR would mean that 5 samples out of 1000 would be erroneously detected as malicious. With a sampling rate of 1ms, this would potentially mean a false alarm every 1 seconds. In Table 2, we observe how the combination of the simple local ML with the more complex remote ML responds to this classification problem. As we can see the TPR remains high (92.66%) and the FPR low (0.13%) when using the combination of AdaBoost and LSTM AutoEncoder7 algorithms.

Benefits of a local-remote approach: First minimizing the FPR is desirable since one FP is enough to label a whole application as malicious. As stated in Section 1, frequently taking actions due to an alarm during normal operation can make the device unusable. Furthermore, the TPR remains high, which allows us to capture as much malicious activity as possible and only need one timingwindow with high anomaly score to detect a malicious app. The TPR is lower that the simple single-level threshold MLs, since the local part of the local-remote only raises alerts for high probability samples and transmits the suspicious for further evaluation in the remote. Also, attacks do not execute only malicious actions in their whole execution, and the remote ML will recognize such parts as normal, and not as attacks as indicated in our labelling effectively lowering the TPR.

Edge-device Local ML filtering

In this section we evaluate the filtering succeeded by the two-level threshold approach. We focus on the filtering succeeded during normal operation only, since this is the state of the device in most of its operation and we do not want to overflow the communication interface with limited value data under this condition. From Table 3 we can observe the filtering succeeded under normal operation, when the local ML is configured as AdaBoost (same case than in Table 2), monitoring the system each 1ms, monitoring six 32 bit HPC counters per core, and 4 cores in total, while transmitting the data to the remote each 1 minute. The total size of data extracted from the system per minute of execution is 5760Kb.

Benefits of a local-remote approach: From Table 3, we can see that our approach can successfully filter more than 99% of the extracted HPC data under normal operation. This is due to the local ML being very successful to label as normal benign applications (keeping them under the suspicious threshold). This allows us to dramatically reduce the bandwidth required under normal operation where solutions containing only a remote ML will send all samples to the cloud.

Memory & Detection Time Optimization

In this subsection we optimize the memory required to save the extracted HPC data labelled suspicious. Further-more, we optimize the detection time, since under attack we would like to detect the attacks before the specified ∆s = 1 minute and further waiting the remote ML to give us the final decisions. To succeed with the above, we make the two following observations from Figure 4 and Figure 5:

• Under normal only operation the saved suspicious data does not exceed a certain value, which in this case as seen in Figure 5 is not more than 50Kb.

• When an attack executes on the system, the rate of saving suspicious data in local storage increases. We can observe that in Figure 4 in periods 2-3, 5-6, 8-9. So to optimize the memory required and the detection time, we set the size of the local storage to the calculated maximum amount of data saved and transmitted under normal operation, so under normal operation we do not exceed this size. For AdaBoost this is 54kb. If under attack, we require more memory to save the extracted HPC samples, and rather than saving more data and as soon as the memory is full, we send the data directly to the remote to have a quicker detection time. As mentioned in the previous observations, under attack the rate of suspicious data saved is greater than under normal operation, which most probably will overflown the local storage.

This implementation choice allows us to only specify the necessary memory for local storage, rather than using Figure 6. Isolation Forest used by Sadaf et al. [START_REF] Sadaf | Intrusion detection based on autoencoder and isolation forest in fog computing[END_REF] to increase classification metrics. a 5760Kb memory, and also under attack we transmit the data faster in most cases, than waiting the specified ∆s.

False Positive Minimization Using an Isolation Forest

In the previous section, we successfully reduced the required communication bandwidth and optimized the memory and detection time. But, as observed from Table 2, the FPR of the local-remote might be lower than both complex and single MLs used individually, but it can still be minimized to avoid unnecessary false alarms. To minimize the FPR, we adapt a solution proposed by [START_REF] Sadaf | Intrusion detection based on autoencoder and isolation forest in fog computing[END_REF] as can be seen in Figure 6. Sadaf et al. use an Isolation Forest [START_REF] Fei | Isolation forest[END_REF] to optimize their classification metrics. An Isolation Forest is a technique allowing to detect/find outliers in a set of data as the samples that greatly differ from others. In their implementation as seen in Figure 6, the input samples are predicted by a ML. As their ML is not perfect, it has some FPs and some FNs. In their hypothesis, FPs are outliers among the rest of the TPs and FNs are outliers among the majority of TNs. By using then an Isolation Forest in the positives, they can find the FPs and change their final label to negative increasing the correct predictions and classification metrics.

In our case to minimize the FPR, we adapt their approach by also using the memory and detection time optimization presented before in Section 3.4. To do this we make the following hypotheses:

• If the remote ML received the data before the expected ∆s, we trust its decisions since this most probably happened due to the execution of an attack. • If the remote ML received data at the expected ∆s, we can expect being under normal operation and must be careful for FPs. Thus, we double check the remote's ML positive decisions using an Isolation Forest.

In Figure 7, we can see both our pseudo-algorithm and our technique to adapt the approach proposed by Sadaf et al. When the remote received the data as expected at ∆s, for each remote ML positive decision, we also check if the suspicious samples are inliers or outliers in the Isolation Forest. If the Isolation Forest indicates that the sample is an inlier, i.e., it predicts that it is similar with a large pool of normal samples used for the remote ML training, then we reset the decision to negative, otherwise we notify the embedded device of the presence of an attack. As we can see from Table 4, the use of the Isolation Forest to double check remote's decisions, can successfully reduce the FPR to a near 0% compared to not using it, which results in 0.13%.

State-of-the-Art Comparison

Table 5 presents how our work compares to other approaches in the SOTA. This is not a comparison on the same dataset, since we use different attack vectors and normal libraries, in addition to the different experimental platform, but it shows the contributions of our approach as all articles try to detect the same microarchitectural attacks.

As we can see from the table, when the threat model has limited attack vectors (as in rows 1-4), simple ML models such as Logistic Regression can succeed in detecting the attacks with high accuracy and low FPR. When the threat model has more attack vectors (rows 5-), then more complex MLs are used, such as ensemble ML and LSTM, which keep the accuracy high, while minimizing the FPR. On the downside, we can observe that WHISPER [START_REF] Mushtaq | Whisper: A tool for run-time detection of side-channel attacks[END_REF] has an overhead of 8%, and FortuneTeller an overhead of 3.5%. These overheads might not be significant in the targeted desktop/server systems, but using these solutions Finally, compared to the solution proposed by [START_REF] Wang | Hardware performance counter-based malware identification and detection with adaptive compressive sensing[END_REF], which was able to compress the extracted data by 20-30% while keeping the overhead around 5%, we see that our solution can filter up to 99% while the overhead is less than 1%.

Discussion

In this section we discuss some implications of our findings and limitations of our approach and propose some ideas to improve future solutions.

Overhead in more constraint devices: In Section 5 and more precisely in Table 5, we mentioned that the overhead imposed by our solution in the Raspberry PI4 is less than 1%. However, this kind of platform has high computation resources and is considered as a complex IoT device. To validate that our proposed solution can be integrated in more resources constrained devices, more experiments should be performed to evaluate the overhead induced by HPC monitoring with tiny ML.

Limited dataset: Botacin et al. [START_REF] Botacin | Why we need a theory of maliciousness: Hardware performance counters in security[END_REF] recently discuss about the use of limited dataset to detect microarchitectural attacks and other kind of malwares with ML algorithms. In order to circumvent this issue, we choose to use evasive attacks based on techniques proposed in [START_REF] Polychronou | Madman: Detection of software attacks targeting hardware vulnerabilities[END_REF]. These include the insertion of N OP or sleep instructions in between sensitive tasks to modify the output counts to range closer to normal behavior. We also use some data augmentation techniques to increase the size of some applications. We can still improve by finding more hidden strategies to obfuscate the attack scripts or use GAN (Generative Adversarial Network) based Augmentation as proposed in [START_REF] Kim | Gan based augmentation for improving anomaly detection accuracy in host-based intrusion detection systems[END_REF].

Improving the security of the solution: It was proven in [START_REF] Basu | A theoretical study of hardware performance counters-based malware detection[END_REF] that an advanced attacker with knowledge of our simple local ML parameters, could hardly develop code that produces behavior similar to normal while still succeeding the attack. However, the current solution is implemented in software, which means that the local security supervisor including the HPC extraction, the tiny ML and the publishing of suspicious samples implementation and the other applications share resources. This issue still introduces a vulnerability that can be used by an attacker to circumvent or break the solution with a malware. An improved solution will be to implement the local detector as a trusted application in a TEE (Trusted Execution Environment) such as Trustzone or as a dedicated hardware implementation as it was proposed in [START_REF] Thevenon | iMRC: Integrated monitoring & recovery component, a solution to guarantee the security of embedded systems[END_REF].

Network availability: If the network is down or victim of a Denial of Service attack, our approach will only rely on the ability of the local ML to detect the attacks. Still, it provides a level of security since it can detect high probability samples. Depending on the criticality of the user application, the lack of communication between the IoT node and the control server can also be considered as an attack.

Periodicity to send data to control server: Another parameter we would like to investigate is ∆s. In this work it was empirically set to one minute, but more research needs to be done that takes into account communication overhead, detection latency, encryption of suspicious data, and storage overhead. Sending data more frequently to the remote can reduce the detection time, but also increases the overheads, while decreasing ∆s reduces the overheads but increases detection time.

Malwares detection: In this paper, we choose to focus on the detection of microarchitectural attack as this class of attacks is complex to circumvent. This kind of attacks can not really be considered as a class of malware but rather as a part of a malware used to gain privileges or steal sensitive data. As some malwares do not use these methods, it is required, to detect more categories of attacks to update our dataset to include complete IoT malwares such as BashLite, IoTReaper or Mirai. Since these malwares do not stress as much as microarchitectural attacks the hardware, it will probably necessitate more complex ML algorithms on the local device and the remote server or samples from different sources than HPCs.

Conclusion

Embedded devices face an increasingly amount of microarchitectural attacks. Such attacks often require hardware changes to be circumvented and detection is generally preferred over mitigation. Several works have been proposed that effectively detect microarchitectural attacks, but without considering the limitations of embedded devices such as computing power, memory, and bandwidth. We have shown that local solutions can have a high detection rate but also a high FPR, while remote solutions are effective but require a large amount of resources and network availability.

This work proposes a solution for detecting attacks on low-resource devices. We propose a local-remote implementation that minimizes the performance, memory, and communication overhead in edge devices while having a high detection rate and minimal FPR. The overall approach benefits from the presence of complex ML algorithms in a cloud to take appropriate decisions but is fully able to work in case of network downtime. We also evaluate the proposed local-remote idea in terms of various metrics. We show that the local system successfully filters 99% of the normal extracted data, which reduces the bandwidth in normal operation. Furthermore, the localremote increases precision compared to a purely single level threshold implementation, while the FP minimization strategy using an Isolation Forest, as applied in the context of this solution, can reduce FPR to near 0%, preventing unneeded attack responses. Finally, we discuss design choices and limitations of this work.

Multiple paths can be explored as future works. First, many parameters can be tweaked to further reduce overhead (∆s, changing local implementation to an FPGA/ASIC solution). This could also reduce the attack surface of the local detection mechanism itself. Also, this work is currently limited to microarchitectural attacks. Many other kinds of attacks target embedded devices and in particular IoT (malwares exploiting softwares flaws, denial of service botnets, cryptolockers, reverse shells, etc). As these attack will less exploit the hardware, we expect that they will be harder to detect with simply HPCs. Experimental evaluations should then be performed on our ability to detect other kinds of attacks with only HPCs and other signals should be proposed.

Figure 1 .

 1 Figure 1. Global overview of the proposed solution.

Figure 2 .

 2 Figure 2. Two-level detection threshold implementation.

Step 1 :

 1 Configuration of the extraction of the HPC events and the monitoring interval. • Step 2: Execution of benign and malicious applications. • Step 3: Extraction of the raw traces of HPC values from a computer. • Step 4: Use of Mutual Information method to evaluate and identify the 6 best HPCs events.

Figure 3 .

 3 Figure 3. Testbed used to identify best features.

Figure 4 .

 4 Figure 4. Data stored to the local memory per second (red dotted line) and sent to the remote ML for further evaluation each ∆s 1 minute (purple triangles). The shaded areas indicate the period where the system is under attack.

Figure 5 .

 5 Figure 5. Data stored to the local memory per second (red dotted line) and sent to the remote ML for further evaluation each ∆s 1 minute (purple triangles) under normal operation.

Figure 7 .

 7 Figure 7. Isolation Forest technique used by Sadaf et al. adapted for our approach.

TABLE 1 .

 1 CLASSIFICATION METRICS FOR THE DIFFERENT ML ALGORITHMS SIMPLE (LINEARSVC & ADABOOST) AND MORE COMPLEX (LSTM7 & LSTM AUTOENCODER7).

	Single Level Threshold	TPR	FPR
	LinearSVC	99.75% 1.63%
	AdaBoost (Logistic Regression)	99.70% 0.68%
	LSTM7	72.99% 0.03%
	LSTM+ AutoEncoder7	92.41% 0.45%

TABLE 2 .

 2 CLASSIFICATION METRICS FOR THE LOCAL-REMOTE.

	Two Level Threshold	TPR	FPR
	AdaBoost + LSTM7	73.09% 0.02%
	AdaBoost + LSTM AutoEncoder7	92.66% 0.13%

TABLE 3 .

 3 DATA SEND PER MINUTE UNDER NORMAL OPERATION AND PERCENTAGE OF FILTERING WHEN 5760KB OF HPC DATA ARE EXTRACTED PER MINUTE.

	Local ML	Data send	filtering
	(filtering only)	per minute	percentage
	AdaBoost (Logistic Regression)	39kb	99.32%

TABLE 4 .

 4 CLASSIFICATION METRICS FOR THE LOCAL-REMOTE ML with and without THE ISOLATION FOREST FOR FP REDUCTION.

	Two Level Threshold	TPR	FPR
	AdaBoost + LSTM AutoEncoder7	92.66% 0.13%
	AdaBoost +
	LSTM AutoEncoder7	92.66%	∼ 0%
	+ Isolation Forest

TABLE 5 .

 5 COMPARISON OF OUR LOCAL-REMOTE IMPLEMENTATION TO THE RELATED WORKS. an embedded device could be challenging. Wei et al.[START_REF] Wei | Using power-anomalies to counter evasive micro-architectural attacks in embedded systems[END_REF], Kuruvila et al.[START_REF] Peedikayil Kuruvila | Explainable machine learning for intrusion detection via hardware performance counters[END_REF], and Wang et al.[START_REF] Wang | Enabling micro ai for securing edge devices at hardware level[END_REF] propose solutions for embedded systems. While Wei et al. succeed having high accuracy and low FPR, they use an LSTM, which is a resource demanding ML algorithm, and it could be challenging fitting it in a resource limited system. On the other hand, Kuruvila et al and Wang et al. use simpler MLs to reduce the overheads imposed on the embedded device, but as we see from the table the FPR is high (or

	Detection Mechanism	Attacks	Accuracy F-score	FPR or Precision	Overhead	System	Local or Remote
	Mushtaq et al. [22] Logistic Regression (No Load)	Flush+Reload	99.51%		0.48% FPR	0.94%		Local
	Mushtaq et al. [22] SVM (No Load)	Flush+Reload	98.82%		0.397% FPR	1.29%		Local
	Mushtaq et al. [22] Logistic Regression (No Load)	Flush+Flush	91.73%		0% FPR	1.10%		Local
	Mushtaq et al. [22] SVM (No Load)	Flush+Flush	97.42%		0% FPR	0.79%		Local
	WHISPER [23]
	Ensemble Learning	CacheCSA,
	One model per attack	(F+F, F+R, P+P),	>97.05%			<8%		Local
	(DT, RF and SVM)	Spectre, Meltdown
	(No Load)
	FortuneTeller [10] LSTM	Spectre, CacheCSA, (F+F, F+R, P+P), Meltdown, Rowhammer		99.70%	0.125% FPR	3.50%		Local
	Wei et al. [34] OC-SVM	Prime + Probe, Spectre, Rowhammer, Evasive	<98.63%		<0.5% FPR
	Wei et al. [34] LSTM	Prime + Probe, Spectre, Rowhammer, Evasive	<99.06%		<0.5% FPR
	Kuruvila et al. [18] Random Forest	Flush + Flush, PNScan, Spectre, Meltdown, Rowhammer, BashLite	89.90%	89.91%	89.25% Precision	<1.22%		Local
	Wang et al. [32] MPL	CacheCSA, (F+F, F+R, P+P), Spectre	<98.9%	<97%	5.3% FPR	<3.2%
	Wang et al. [32] Logistic Regression	CacheCSA, (F+F, F+R, P+P), Spectre	<98,9%	91.90%	14.9% FPR	<3.23%
	Ours AdaBoost + LSTM AutoEncoder7	Spectre, Rowhammer, Meltdown, Evasive CacheCSA (F+F, F+R, E+R, P+P),	98.75%	96.19%	∼ 0% FPR	0.80%		Local Remote

on precision is low). In comparison, our solution succeeds in keeping the detection accuracy high (98.75%), having minimal FPR (∼ 0%) and imposing a minimal overhead (0.8%) on the edge-device.