Spectre attacks exploit speculative execution to leak sensitive information. In the last few years, a number of static side-channel detectors have been proposed to detect cache leakage in the presence of speculative execution. However, these techniques either ignore branch prediction mechanism, detect static pre-defined patterns which is not suitable for detecting new patterns, or lead to false negatives. In this paper, we illustrate the weakness of prediction-agnostic state-of-the-art approaches. We propose Specognitor, a novel prediction-aware symbolic execution engine to soundly explore program paths and detect subtle spectre variant 1 and variant 2 vulnerabilities. We propose a dynamic pattern detection mechanism to account for both existing and future vulnerabilities. Our experimental results show the effectiveness and efficiency of Specognitor in analyzing real-world cryptographic programs w.r.t. different processor families.

翻译：光谱攻击利用投机性执行泄漏敏感信息。 在过去几年中,有人提议了一些静态侧通道探测器,以便在出现投机性执行时探测缓存泄漏。然而,这些技术要么忽视分支预测机制,发现不适合探测新模式的静态预设模式,要么导致虚假的负值。在本文中,我们说明了预测性、不可知性的最新方法的弱点。我们提议Specognitor,这是一个新的预测性象征性执行引擎Specognitor,以周密地探索程序路径并探测隐微的光谱变异1和变异2的弱点。我们提议了一个动态模式探测机制,以计及现有和未来的脆弱性。我们的实验结果显示Specognitor在分析现实世界加密程序(r.t.d.d.d.d.d.d.d.d.d.d.specognitor)中的有效性和效率。