The Internet of Things (IoT) and the Internet of Everything (IoE) have driven processors into nearly every powered device, from thermostats to refrigerators to light bulbs. From a security perspective, the IoT and IoE create a new layer of signals and systems that can provide insight into the internal operations of a device via analog side channels. Our research focuses on leveraging these analog ...

We applied machine learning to detect changes in state of key registers in digital devices from their analog RF emissions. As digital devices operate, they emit information via analog side channels. We collected the RF side channel with a 500-MHz shielded loop probe from Riscure, placed in the nearfield (< 1mm) of the device under test (DuT). We investigated a number of Internet-of-Thing (IoT) DuTs including Arduino Uno and PIC24 processors. Conventional processors implement instructions as a sequence of subtasks. The first subtasks include incrementing the program counter (PC) register and fetching the next instruction from program memory to the instruction register (IR). These two subtasks occur almost every instruction cycle. We ran programs on the DuT and collected the RF emissions. We parsed the object code of the programs to determine the state of key registers including the PC and IR during each instruction cycle and observed that the RF signal of each cycle is strongly correlated with the Hamming Distance (HD) (i.e., the number of bits changing) in the PC and IR registers. Based on this result, we developed classifiers to extract the HD of the PC, IR, as well as the stack pointer (SP). The classification results vary with true HD as some values are rare and have few examples in the training set. The classification accuracy exceeds 99% for the PC and the IR. Due to the relatively few HD in the training set for the SP, its results slightly exceeded 97%.

All digital devices leak information through unintended emissions into analog side channels. The RF side channel enables passive collection of high-bandwidth information about the digital state of the device. We collected these RF emissions with a 500-MHz Riscure probe placed in the nearfield of the device under test (DuT) and applied machine learning to detect what program is running on the processor to identify malware intrusions. We explored the applicability of a generalized algorithm classification infrastructure built from a training set of similar DuTs to a similar device from a different production batch (same model number, different serial number.) We collected RF-SC data for five programs running on 28 distinct Arduino Unos (and 28 MSP430 processors.) We trained program classifiers on RF data from all but one DuT and tested the classifiers on the device withheld from the training set. The high-SNR signal provided by the Riscure probe enabled almost perfect classification results when we trained and tested on the same device. Our classification results remained above 99% when we generalized testing to the new DuT of the same model but a different serial number. The classifier was trained on 27 of the devices and tested to determine its ability to detect deviations from a baseline algorithm on a withheld device. The worst misclassification rate was a mere 0.08%.

We use machine learning to characterize the state of digital devices based on their analog emissions. As digital devices operate, they emit internal information into a number of analog side channels. Remote sensing of these unintended signals leads to low signal-to-noise-ratio (SNR) and significant clutter. We developed classifiers to determine which program is executing on a digital device based on analog radio-frequency (RF) emissions collected via a 500-MHz Riscure RF probe. A standard algorithm was developed to serve as a baseline program and intrusions were simulated by introducing minor modifications to this program. We collected a thousand RF traces from each of these modified programs running on ten different devices for thousands of instruction cycles. The ten devices tested are representative of the Internet of Things (IoT) devices including Arduino Unos and PIC24 processors. Our primary approach to mitigating the impact of low SNR is to extend the program execution and signal collection time. Collecting a training set with more traces than samples is not practical. Even after down-sampling the raw data to thirty samples per instruction, the number of samples exceeds the number of traces by orders of magnitude. Such a training set nearly guarantees overlearning. To mitigate this, we present our Whitened Mean Classifier as a method to whiten this sparse training set and avoid overlearning. Classification accuracy exceeded 90% for the modified programs on a subset of the ten devices.

Internet of Things (IoT) and other similar devices often have little to no security and thus can be readily exploited in any number of ways. In this work, we collect radio frequency (RF) emissions from simple processors on several IoT devices and apply machine learning techniques to detect modifications (corrupted or injected via malware) in ‘known’ software running on the processor. We can detect these modifications due to the correlation between RF emissions and the digital state of the devices. Every bit flip produces a small but potentially detectable electrical pulse. Our approach to developing the recognition algorithm is to adapt to the variability created by the input data by recognizing the sequences in which instruction blocks are executed. Seemingly minor changes to input values can have a detectable effect on the measured RF side channel. We collect RF data from a variety of IoT devices with clock speeds varying from 16-96 MHz. A 1-GHz Riscure RF near-field antenna probe was placed within a millimeter of the IoT device, RF emissions were acquired, and software controls triggered data collection. A classification architecture was trained using object code portioned into blocks to develop the truth data. We then applied new data to the trained block classifier. This approach detects deviations in individual blocks and block sequences as a whole, allowing a greater level of detection resolution than just binary ‘Yes/No’ classification. Initial testing results showed greater than 90% classification accuracy for block-level modifications, and we can detect deviations from truth data with 100% accuracy.

The Sensor Open System Architecture (SOSA) is a C4ISR-focused technical and economic collaborative effort between the Air Force, Navy, Army, the Department of Defense (DoD), Industry, and other Governmental agencies to develop (and incorporate) a technical Open Systems Architecture standard in order to maximize C4ISR sub-system, system, and platform affordability, re-configurability, and hardware/software/firmware re-use. The SOSA effort will effectively create an operational and technical framework for the integration of disparate payloads into C4ISR systems; with a focus on the development of a modular decomposition (defining functions and behaviors) and associated key interfaces (physical and logical) for common multi-purpose architecture for radar, EO/IR, SIGINT, EW, and Communications. SOSA addresses hardware, software, and mechanical/electrical interfaces. The modular decomposition will produce a set of re-useable components, interfaces, and sub-systems that engender reusable capabilities. This, in effect, creates a realistic and affordable ecosystem enabling mission effectiveness through systematic re-use of all available re-composed hardware, software, and electrical/mechanical base components and interfaces. To this end, SOSA will leverage existing standards as much as possible and evolve the SOSA architecture through modification, reuse, and enhancements to achieve C4ISR goals. This paper will present accomplishments over the first year of SOSA initiative.

Radio Frequency (RF)-based techniques have been used to discriminate between suspected authentic mixed-signal ICs (O'Neill 2016). This research extends previous work, applying the technique to discriminate between certified authentic and suspected counterfeit devices. The Device Under Test (DUT) for this research is the MAX526CCWG manufactured by Maxim Integrated Products (Maxim 1997). Unintentional RF Emissions (URE) are collected from the DUT and RF-Distinct Native Attributes (RF-DNA) features are extracted and used to discriminate multiple devices divided into two classes. Class 1 consists of four authentic DUTs certified through and independent certification agency. Class 2 consists of four DUTs which have failed the certification process and thus are considered counterfeit. O'Neill and Stone (2016) demonstrated that the DUTs can be individually discriminated against using RF-DNA and Multiple Discriminate Analysis/Maximum Likelihood (MDA/ML) using 552 different RF-DNA features. This research investigates the use of a lower number of features, as determined by forward stepwise selection, and various classification models such as Quadratic Discriminate Analysis (QDA), random forest (RanF), and Generalized Relevance Learning Vector Quantized-Improved (GRLVQI) classification to achieve similar or better discrimination results. Results have shown that the MDA/ML classification model using RF-DNA features is the model of choice when compared to the other three options. MDA/ML achieves average percent correct classification above 90% starting at a Signal to Noise Ratio (SNR) of -6 dB with a maximum average percent correct classification of 99.67% occurring at SNR >= 18 dB. To reduce the computational requirement on generating fingerprints by 66%, a subset of RF-DNA features which consist exclusively of the instantaneous normalized amplitude features was shown to only reduce the overall classification by 0.41% on average across all explored SNR values.

The Internet of Things (IoT) and Internet of Everything (IoE) has driven the proliferation of processors into nearly every powered device around us: from thermostats to refrigerators to light bulbs. From a security perspective, IoT/IoE creates a new layer of signals and systems that can be exploited to access supporting network layers. Our research focuses on leveraging the analog side channels of IoT/IoE processors, for defensive purposes. We apply signal-processing and machine-learning techniques to collected RF emissions to detect if code running on the processor has been modified (i.e., corrupted or injected with malware). The paper describes our process for positioning a wide-bandwidth RF probe over the device under test (DuT). Classifiers are implemented for identifying the code running on the device. We demonstrate the ability to detect, identify, and isolate instructions based on signatures learned during initial DuT characterization. The probe is positioned to capture RF signals that support-vector machine (SVM) classifiers can accurately discriminate between instructions, rather than relying on raw power leakage. At this well-discriminated location, the signatures of each instruction are extracted by applying principal component analysis (PCA) to separate its signal into components (fetch, opcode, operands, and values). These signatures are used to identify instructions in the test code. Additionally, this paper discusses applying our methodology to blocks of code/algorithms using sequence learning algorithms. These techniques enable significant reduction in feature dimensions improving speed and accuracy of instruction level classification of low-SNR RF sidechannels.

Side-Channel Analysis (SCA) is an increasingly well-known method for non-invasively extracting information from unintended “side-channel” emissions given off by electronic devices. The common method for extracting side-channel information is via a near-field antenna probe placed in the vicinity (i.e., millimeters) of the target device. The antenna detects and amplifies the radio-frequency (RF) emissions given off by the device and transmits the information for analysis and testing. Side-channel attacks are most known for their utility in cryptanalytics; however, they can also be used to fingerprint devices or even determine the digital state of the system. In this work, characterization studies on a 1- GHz antenna using Riscure’s RF probe station are performed. For RF-SCA, the ultimate limits of signal sensitivity and frequency response are determined by the antenna characteristics. In addition, the effective source-receiver distance (SRD), cross-talk and spatial signal averaging at various SRDs have to be characterized for signal attenuation and normalization. From our testing, it appears that the Riscure probe has a peak frequency response at about 200 MHz. For example, the 418MHz antenna had multiple peaks at 130 MHz, 172 MHz, 213 MHz, and 370 MHz, as well as multiple less significant protrusions at higher frequencies. The BeeHive100C probe peaked at exactly 200 MHz but had a couple of side-lobes in the 600-800 MHz range. The Pharad 30-512 MHz antenna peaked at a slightly lower 193MHz, although, some response was observed in the 600-800 MHz range as in the other antennas. The Pharad 225-6000MHz antenna exhibited a similar peak but lesser roll-off and an elevated response at increased frequencies than its predecessor.

Industrial control systems are used to operate critical infrastructure assets in the civilian and military sectors. Current industrial control system architectures are predominantly based on networked digital computers that enable reliable monitoring and control of critical functions via localized and distributed operations. Many industrial control systems, in particular, supervisory control and data acquisition (SCADA) systems, implement monitoring and control using programmable logic controllers, which have served as gateways through which cyber attacks have been orchestrated against high-profile industrial control system targets.This paper focuses on securing the programmable logic controller gateway against unauthorized entry and mitigating attack risks by (i) adopting a previously demonstrated capability that provides hardware device discrimination using information extracted from intentional radio frequency (RF) emissions; and (ii) adapting the RF-based verification methodology to exploit information in unintentional programmable logic controller emissions to detect anomalous operations and enhance industrial control system security. Operational status verification (normal operation versus anomalous operation) is demonstrated using emissions from 10 like-model programmable logic controllers. The correlation-based verification approach with Hilbert transform features demonstrates superior performance than with untransformed time domain features. Experimental results demonstrate that an arbitrary equal error rate (EER) benchmark (EER≤10%) is achieved for all programmable logic controllers with a signal-to-noise ratio (SNR) of 5.0dB when Hilbert-transformed features are used for complete programmable logic controller program scans or SNR=0.0dB when each programmable logic controller program operation is compared independently. This benchmark was not achieved for any programmable logic controllers when untransformed time domain features were employed.

In most medical facilities, the systems, software, and data that support clinical and business operations have been developed independently and in isolation. This makes it difficult for the systems to efficiently and effectively access the data and metrics needed to improve clinical processes, achieve desired patient outcomes, or make informed business decisions. Furthermore, determining the benefit of current or proposed clinical processes or business practices from these systems is often inefficient and ad hoc, even though the data required is available within these systems. In response to this, we have developed a unified “Packets-to-Patients” approach to measuring key elements of the clinical, business, and technical operations of the medical enterprise. From these elements we derive benefits that are validated as meaningful within those domains. Our approach automatically and efficiently collects data that establishes whether the stages of Electronic Health Record (EHR) Meaningful Use criteria are being met. It also measures EHR adoption rates, clinical benefits like quality of care and patient safety, and business benefits like decreased length of stay and improved workflow efficiency. Our analytical approach has been field-tested and proven through nearly three years of development. This methodology has measured baseline system performance at several medical treatment facilities and also provided those organizations with an in-depth understanding of how health Information Technology (health IT) performance impacts clinical and business operations. More importantly, our approach has enabled rigorous analysis and fact-based decision-making on how best to integrate health IT into clinical operations. Most importantly, this approach allows health care delivery organizations to design a business case based on hard data and increases the likelihood of success in adopting and optimizing health IT.

Application virtualization is likely to play a crucial role in consolidating electronic military health records to help improve the care provided to current and former military members. However, due to bandwidth and other resource constraints, virtualization resources can only be located at a limited number of military treatment facilities within the Military Health System (MHS). This article provides an optimization model to help guide the location of virtualization hubs among a subset of facilities within the MHS, as well as the allocation of demand to those hubs. The objective is to maximize the minimum probability that the response time is no more than a user specified threshold. Computational results show that networks with well over 200 facilities can be solved.

The popularity of ZigBee devices continues to grow in home automation, transportation, traffic management, and Industrial Control System (ICS) applications given their low-cost and low-power. However, the decentralized architecture of ZigBee ad-hoc networks creates unique security challenges for network intrusion detection and prevention. In the past, ZigBee device authentication reliability was enhanced by Radio Frequency-Distinct Native Attribute (RF-DNA) fingerprinting using a Fisher-based Multiple Discriminant Analysis and Maximum Likelihood (MDA-ML) classification process to distinguish between devices in low Signal-to-Noise Ratio (SNR) environments. However, MDA-ML performance inherently degrades when RF-DNA features do not satisfy Gaussian normality conditions, which often occurs in real-world scenarios where radio frequency (RF) multipath and interference from other devices is present. We introduce non-parametric Random Forest (RndF) and Multi-Class AdaBoost (MCA) ensemble classifiers into the RF-DNA fingerprinting arena, and demonstrate improved ZigBee device authentication. Results are compared with parametric MDA-ML and Generalized Relevance Learning Vector Quantization-Improved (GRLVQI) classifier results using identical input feature sets. Fingerprint dimensional reduction is examined using three methods, namely a pre-classification Kolmogorov-Smirnoff Test (KS-Test), a post-classification RndF feature relevance ranking, and a GRLVQI feature relevance ranking. Using the ensemble methods, an SNR=18.0 dB improvement over MDA-ML processing is realized at an arbitrary correct classification rate (%C) benchmark of %C=90%; for all SNR ∈ [0, 30] dB considered, %C improvement over MDA-ML ranged from 9% to 24%. Relative to GRLVQI processing, ensemble methods again provided improvement for all SNR, with a best improvement of %C=10% achieved at the lowest tested SNR=0.0 dB. Network penetration, measured using rogue ZigBee devices, show that at the SNR=12.0 dB (%C=90%) the ensemble methods correctly reject 31 of 36 rogue access attempts based on Receiver Operating Characteristic (ROC) curve analysis and an arbitrary Rogue Accept Rate of . This performance is better than MDA-ML, and GRLVQI which rejected 25/36, and 28/36 rogue access attempts respectively. The key benefit of ensemble method processing is improved rogue rejection in noisier environments; gains of 6.0 dB, and 18.0 dB are realized over GRLVQI, and MDA-ML, respectively. Collectively considering the demonstrated %C and rogue rejection capability, the use of ensemble methods improves ZigBee network authentication, and enhances anti-spoofing protection afforded by RF-DNA fingerprinting.

This research investigates profiled linear regression-based attacks for extracting the advanced encryption standard AES secret key. Several methods from recent advancements are compared for their capability to correctly build the multivariate distribution for profiling. Attack performance shows greater than 98% success rate with as few as 100 training and test traces. In 8 out of 9 test cases examined, linear regression attacks using the coefficient of determination R 2< small>< sup>, adjusted coefficient of determination r 2< small>< sup> a< small>< sub> and correlation power analysis cpa performed better than or equal to the original stochastic attack using symmetry metric. our new method r 2< small>< sup> a< small>< sub> is proven to suppress unimportant variables and enhance important ones better than other methods. it successful when the microcontrollers data collection hardware differ between training test phases found be more effective in noisy environments cpa.< p>a<> 2<> a<> 2<> 2<>

Mobile Ad-hoc Network (MANET) is type of unguided network whose nodes are self-configuring and connected by wireless links. Anonymity communication is one of the major issues in MANET. Many anonymity enhancing techniques have been introduced based on packet encryption. These were designed for the protection of communication anonymity in mobile ad hoc networks. However, passive statistical traffic analysis attacks that can be vulnerable to MANET. The communication anonymity consists of two aspects: source/destination anonymity and end-to-end anonymity. In order to discover the communication pattern without decrypting the captured packets, this proposed system will be designed. The proposed system will first search the required node by using a heuristic approach. Then statistical traffic analysis will be performed to find the data transmission of the searched node to its neighboring nodes. After performing the statistical traffic analysis, the probability of the searched node being a source or destination will be determined.

Side Channel Analysis (SCA) passively extracts packet information by analyzing emissions from network cabling. Normally, a network connection is required to capture wired or fiber network packet information using tools like libpcap and TCPdump or a hardware packet analyzer. Advances in SCA techniques bypass this requirement by exploiting the Electromagnetic (EM) emanations of network cables. Our collection process only requires that a small EM probe be near a 10BASE-T cable to collect signal traces. We also develop a correlation-based signal processing technique with digital filters, which facilitates decoding of the packet header and payload. To date; we have successfully extracted Ethernet frame information and decoded payload data at a 2(-7) Bit Error Rate (BER). This passive attack would require physical inspection to discover, thereby reducing the ability for detection.

Random Forest, a non-parametric classifier, is proposed for byte-wise profiling attack on advanced encryption standard (AES) and shown to improve results on PIC microcontrollers, especially in high-dimensional variable spaces. It is shown in this research that data collected from 40 PIC microcontrollers exhibited highly non-Gaussian variables. For the full-dimensional dataset consisting of 50,000 variables, Random Forest correctly extracted all 16 bytes of the AES key. For a reduced set of 2,700 variables captured during the first round of the encryption, Random Forest achieved success rates as high as 100% for cross-device attacks on 40 PIC microcontrollers from four different device families. With further dimensionality reduction, Random Forest still outperformed classical template attack for this dataset, requiring fewer traces and achieving higher success rates with lower misclassification rate. The importance of analysing the system noise in choosing a classifier for profiling attack is examined and demonstrated through this work.