In both cases, the patterns are distinct and repeatable, which makes them a trivial way to identify the source of activity.
DRAM is a type of dynamic random-access memory that stores each bit of data in an array of capacitors. The capacitors are charged or discharged to represent a 1 or a 0. When the data isn’t being accessed, the capacitors are in a neutral state.
In order to access a bit, the computer’s memory controller sends a signal to the DRAM to select the row containing the bit and then sends a command to select the specific bit within the row. The capacitors then need to be charged or discharged to represent the bit. This activity creates a detectable change in the capacitors’ electrical properties.
To make the change even more noticeable, the memory controller typically accesses multiple bits at once. For example, if the controller reads two adjacent bits, it will send two commands to the DRAM — one to select the row and another to select the specific bit within the row, which charges or discharges both capacitors. If it then reads the second bit, it will send two more commands to the DRAM — one to select the row and another to select the specific bit within the row, which charges or discharges both capacitors again.
If the computer is accessing the DRAM at a high rate — for example, if it’s performing a cryptographic operation that requires many rounds of bit-by-bit data processing — the memory controller might access the same rows many times in quick succession. If it’s accessing the DRAM at a low rate — for example, if it’s performing a cryptographic operation that requires many rounds of bit-by-bit data processing but with many pauses in between — the memory controller might access the same rows many times in quick succession with many pauses in between.
The upshot is that the pattern of bit-by-bit accesses to the DRAM can be used to distinguish the computer’s activity. If the computer is involved in an operation that requires a high rate of bit-by-bit accesses, the pattern will be dense and regular. If the computer is involved in an operation that requires a low rate of bit-by-bit accesses, the pattern will be sparse and irregular.
Computer scientists have already developed algorithms that can distinguish the operation of different computer programs based on their DRAM patterns. In some cases, the algorithms can distinguish the operation of different versions of the same program, which is useful for debugging purposes.
