Abstract:
Spectre attacks exploit microarchitectural side channels during speculative execution to leak sensitive information, while existing defense schemes generally face a critical trade-off between performance overhead and security strength. To address this problem, this paper proposes an instruction-level dynamic prioritized suppression method, termed DPS-BPU, which achieves fine-grained protection through a collaborative mechanism of branch prediction isolation and latency injection. Specifically, the integrated vulnerability detection tool SpecFuzz is first employed to statically mark the target program, identifying high-risk branch instruction sets that cover Spectre variants including Spectre-v1 and RSB. For short-latency branches (1–2 clock cycles), the prediction unit is dynamically disabled to eliminate misspeculation at its source. For long-latency branches, an L1 cache access latency (6–10 clock cycles) is injected to block the exfiltration path of sensitive data through microarchitectural covert channels. Experimental results on the gem5 simulator across three architectures (x86, ARMv8, and RISC-V) demonstrate that DPS-BPU achieves a defense success rate of 96%, comparable to the classical Lfence scheme (98%), while incurring an average IPC (Instructions Per Cycle) loss of only 7.3%, significantly outperforming Lfence (28.1%). Moreover, the hardware area overhead is merely 2.1%, substantially lower than that of SafeSpec (15.7%).