Method and device for detecting DMA attack based on ATS

Embodiments relate to methods and apparatus for detecting ATS-based DMA attacks. Embodiments are directed to providing secure address translation services. One embodiment of a system includes a computer-readable memory for storing data, the computer-readable memory including a first memory buffer and a second memory buffer, an attack discovery unit device including processing circuitry to perform operations, the processing circuitry including a first memory buffer and a second memory buffer, the operations include receiving a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request including a host physical address and a header indicating that a target memory address has been previously translated to a host physical address (HPA); and blocking the direct memory access in response to a determination that the remote device has not obtained at least one of a valid address translation from the translation agent or a