Electromagnetic covert channel existence perception method for cpu context interference

Abstract

This invention proposes a method for detecting the existence of electromagnetic covert channels in response to CPU context interference, comprising the following steps: dividing the acquired electromagnetic IQ signal into sliding windows and extracting time-frequency features to obtain a window-level time-frequency feature sequence; estimating the center and scale of the local background based on neighboring windows outside the guard interval, and calculating the window-level background residual score; extracting structured modulation evidence related to communication modulation behavior; performing gated fusion of the residual score and the structured modulation evidence to generate a covert channel evidence score; calculating a sequential cumulative statistic based on the covert channel evidence score, triggering an alarm and locating suspicious intervals; and finally, combining the maximum value of the sequential cumulative statistic with the total duration of the suspicious interval to output a record-level decision. This invention eliminates the influence of non-stationary changes in CPU context through local background suppression and reduces false alarms through gated fusion, achieving accurate detection of the existence of electromagnetic covert channels and providing a basis for subsequent tracing and source identification.

Description

Technical Field

[0001] This invention relates to the field of electromagnetic side-channel security assessment technology, and in particular to an electromagnetic covert channel presence detection method for CPU context interference. Background Technology

[0002] Network isolation and air-gap systems have long been considered important means of protecting sensitive computing environments (References 1, 2). These systems are widely used in industrial control, trusted execution environments, hardware security modules, and high-security computing platforms. Due to the limitations of traditional network interfaces, attackers find it difficult to transmit data through conventional communication links. However, existing research has shown that isolated systems can still leak information through non-traditional physical media, such as electromagnetic radiation (References 3, 4), power consumption variations (References 5, 6), acoustic signals (References 7, 8), and temperature changes (References 9, 10). Among these, electromagnetic covert channels (References 11-17) are particularly noteworthy. These channels do not rely on explicit communication interfaces at the software level; they can be induced by processor, memory bus, or peripheral activity and can be passively observed by external probes.

[0003] Current research on covert channels mainly focuses on two types of tasks. The first type is covert channel construction and decoding (references 18-20), which focuses on how to transmit information in the electromagnetic or other physical domains through specific modulation methods and evaluate its transmission performance. The second type is anomaly detection (references 21-23), which can detect electromagnetic or power consumption behaviors that deviate from normal performance. Most of the above works assume that covert channels are known, have occurred, or their typical characteristics have been mastered.

[0004] However, the primary challenge in real-world defense scenarios is not how to decode known covert channels, nor how to identify a known attack category. In long-term passive monitoring, defenders first need to answer a more fundamental question: does the current system harbor suspicious electromagnetic covert channel activity? This is known as electromagnetic covert channel presence detection. Presence detection is a prerequisite security capability for subsequent tracking, classification, attribution, and forensic analysis.

[0005] Electromagnetic hidden channels are not arbitrary outliers, but rather persistent and structured anomalous execution processes introduced by communication modulation behavior. Compared to ordinary contextual perturbations, these structured features exhibit stronger temporal consistency and accumulative properties. However, normal CPU execution itself generates complex and non-stationary electromagnetic signals; different workloads, thread scheduling, memory access, core binding, cache states, and concurrent tasks can all significantly alter electromagnetic amplitude, spectral morphology, and temporal structure. Therefore, presence detection is more difficult than known channel identification. Furthermore, normal contextual perturbations may resemble hidden channel activity within a local window, making it difficult to reliably determine the existence of hidden channels using simple energy thresholds, global normality models, or single-window anomaly detection.

[0006] Therefore, there is an urgent need to propose a sensing method that can accurately detect electromagnetic covert channel activity in the presence of normal contextual perturbations.

[0007] The references are as follows: [1] W. Son, S. Kwon, J. Lee, and J.-H. Lee, “Exploration of OptimalFrequency Bands for Acoustic Signal Air-Gap Attacks,” IEEE Trans. DependableSecure Comput., vol. 23, no. 3, pp. 6212–6229, May 2026, doi: 10.1109 / TDSC.2026.3661896. [2] MJAA Raja, Z. Masood, I. Hussain, A. Zameer, and MAZRaja, “Design of deep learning networks for nonlinear delay differentialsystem for Stuxnet virus spread in an air gapped critical environment,” Appl.Soft Comput., vol. 175, p. 113091, May 2025, doi: 10.1016 / j.asoc.2025.113091. [3] J. Du, Z. Wang, and A. Yu, “Revisiting the Masking Strategy: ASide-Channel Attack on CRYSTALS-Kyber,” IEEE Transactions on InformationForensics and Security, vol. 20, pp. 3387–3399, 2025, doi: 10.1109 / TIFS.2025.3550061. [4] J. J. Pantoja, V. A. Bucheli, and R. Donaldson, “Electromagneticside-channel attack risk assessment on a practical quantum-key-distributionreceiver based on multi-class classification,” EPJ Quantum Technol., vol. 11,no. 1, p. 78, Dec. 2024, doi: 10.1140 / epjqt / s40507-024-00290-6. [5] P. Bhade, J. Paturel, O. Sentieys, and S. Sinha, “LightweightHardware-Based Cache Side-Channel Attack Detection for Edge Devices (Edge-CaSCADe),” ACM Transactions on Embedded Computing Systems, vol. 23, no. 4,pp. 1–27, Jul. 2024, doi: 10.1145 / 3663673. [6] H. Wang, “Amplitude-modulated EM side-channel attack on provablysecure masked AES,” J. Cryptogr. Eng., vol. 14, no. 3, pp. 537–549, Sep.2024, doi: 10.1007 / s13389-024-00347-3. [7] N. Kulasooriya and A. Sayakkara, “Machine Learning Approaches forSurveilling Keyboard Activity on Mobile Devices through Acoustic and InertialSensors,” in 2025 International Conference on Advances in Technology andComputing (ICATC), IEEE, Dec. 2025, pp. 1–6. doi: 10.1109 / ICATC68823.2025.11407526. [8] K. Yang, Y. Zhang, T. Li, and L. Sun, “ASIDS: Acoustic side-channel based intrusion detection system for industrial robotic arms,”Comput. Secur., vol. 157, p. 104586, Oct. 2025, doi: 10.1016 / j.cose.2025.104586. [9] M. Elahi, M. R. Elshamy, A.-H. A. Badawy, and A. Patooghy,“SentinelEdge: An Attention-Based Defense for Real-Time Mitigation ofAdversarial Thermal Manipulations in System-on-Chips,” ACM Transactions onEmbedded Computing Systems, vol. 25, no. 3, pp. 1–27, May 2026, doi: 10.1145 / 3802543.

[10] N. Mishra, T. L. Dutta, S. Shukla, A. Chakraborty, and D.Mukhopadhyay, “Too Hot to Handle: Novel Thermal Side-Channel in Power Attack-Protected Intel Processors,” in 2024 IEEE International Symposium on HardwareOriented Security and Trust (HOST), IEEE, May 2024, pp. 378–382. doi:10.1109 / HOST55342.2024.10545405.

[11] M. Guri, “AIR-FI: Leaking Data from Air-Gapped Computers UsingWi-Fi Frequencies,” IEEE Trans. Dependable Secure Comput., pp. 1–18, 2022,doi: 10.1109 / TDSC.2022.3186627.

[12] Z. Zhan, Z. Zhang, and X. Koutsoukos, “A High-Speed, Long-Distance and Wall-Penetrating Covert Channel Based on EM Emanations from DRAMClock,” Journal of Hardware and Systems Security, vol. 6, no. 1–2, pp. 47–65,Jun. 2022, doi: 10.1007 / s41635-022-00128-6.

[13] Z. Zhan, Z. Zhang, and X. Koutsoukos, “BitJabber: The World’sFastest Electromagnetic Covert Channel,” in 2020 IEEE International Symposiumon Hardware Oriented Security and Trust (HOST), IEEE, Dec. 2020, pp. 35–45.doi: 10.1109 / HOST45689.2020.9300268.

[14] M. Guri et al., GSMem: Data Exfiltration from Air-GappedComputers over GSM Frequencies GSMem: Data Exfiltration from Air-GappedComputers over GSM Frequencies. 2015.

[15] M. Guri, “RAMBO: Leaking Secrets from Air-Gap Computers bySpelling Covert Radio Signals from Computer RAM,” 2024, pp. 144–161. doi:10.1007 / 978-3-031-47748-5_9.

[16] O. A. Ajike, T. Acharya, M. Chouikha, A. Annamalai, A. Kulkarni,and S. T. Ahmed, “Covert Data Exfiltration via Electromagnetic Side-ChannelEmissions from Computer Memory,” in 2025 4th International Conference onSmart Cities, Automation & Intelligent Computing Systems (ICON-SONICS),IEEE, Oct. 2025, pp. 1–7. doi: 10.1109 / ICON-SONICS67145.2025.11309245.

[17] C. Shen, T. Liu, J. Huang, and R. Tan, “When LoRa Meets EMR:Electromagnetic Covert Channels Can Be Super Resilient,” in 2021 IEEESymposium on Security and Privacy (SP), IEEE, May 2021, pp. 1304–1317. doi:10.1109 / SP40001.2021.00031.

[18] Qisheng Jiang and Chundong Wang, “Sync+Sync: A Covert ChannelBuilt on fsync with Storage,” in 33rd USENIX Security Symposium (USENIXSecurity 24), Philadelphia, PA: USENIX Association, Aug. 2024, pp. 3349–3366.Accessed: Apr. 21, 2025. [Online]. Available: https: / / www.usenix.org / conference / usenixsecurity24 / presentation / jiang-qisheng

[19] P. Maurya, L. Daksha, V. Kahar, and A. A. Kherani, “PerformanceAnalysis of CoLoRa: Covert Channel Over LoRa PHY,” in 2024 NationalConference on Communications (NCC), IEEE, Feb. 2024, pp. 1–6. doi: 10.1109 / NCC60321.2024.10485879.

[20] F. N. Bostanc et al., “Understanding and Mitigating CovertChannel and Side Channel Vulnerabilities Introduced by RowHammer Defenses,”in Proceedings of the 2025 58th IEEE / ACM International Symposium onMicroarchitecture, New York, NY, USA: ACM, Oct. 2025, pp. 1412–1432. doi:10.1145 / 3725843.3756029.

[21] B. B. Yilmaz, N. Sehatbakhsh, A. Zajic, and M. Prvulovic,“Communication Model and Capacity Limits of Covert Channels Created bySoftware Activities,” IEEE Transactions on Information Forensics andSecurity, vol. 15, pp. 1891–1904, 2020, doi: 10.1109 / TIFS.2019.2952265.

[22] J. González-Gómez, M. B. Sikal, H. Khdr, L. Bauer, and J.Henkel, “Balancing Security and Efficiency: System-Informed Mitigation ofPower-Based Covert Channels,” IEEE Transactions on Computer-Aided Design ofIntegrated Circuits and Systems, vol. 43, no. 11, pp. 3395–3406, Nov. 2024,doi: 10.1109 / TCAD.2024.3438999.

[23] S. Alam, J. Xiao, and NU Eisty, “Exploiting CPU ClockModulation for Covert Communication Channel,” in 2024 IEEE / ACIS 22ndInternational Conference on Software Engineering Research, Management andApplications (SERA), IEEE, May 2024, pp. 153–158. doi: 10.1109 / SERA61261.2024.10685636. Summary of the Invention

[0008] This invention proposes an electromagnetic hidden channel existence detection method for CPU context disturbances, which solves the problem that most existing hidden channel detection schemes assume that the hidden channel is known, has occurred, or has typical characteristics, and cannot accurately detect the existence of the hidden channel in the context of CPU context disturbances.

[0009] The technical solution of this invention is implemented as follows: The first aspect of this invention provides a method for detecting the existence of electromagnetic covert channels in response to CPU context interference, comprising the following steps: Step S1: Divide the acquired raw electromagnetic IQ signal into sliding windows and extract the time-frequency features of each window to obtain a window-level time-frequency feature sequence; Step S2: Based on the time-frequency feature sequence, estimate the center and scale of the local background using the neighboring windows outside the protection interval of the current detection window, and calculate the window-level background residual score of the current window relative to the local background. Step S3: Extract structured modulation evidence related to communication modulation behavior from the window-level time-frequency feature sequence; Step S4: The window-level background residual score is fused with the structured modulation evidence to generate the hidden channel evidence score for the current window. Step S5: Calculate the sequential cumulative statistics based on the hidden channel evidence score. When the sequential cumulative statistics exceed the alarm threshold, trigger an alarm. Locate the start and end points of the suspicious interval based on the growth and decline of the sequential cumulative statistics. Step S6: Based on the maximum value of the sequential cumulative statistics in the entire record and the total duration of the suspicious interval, generate a record-level existence score, and output a record-level decision on whether there is suspicious electromagnetic hidden channel activity in the entire observation by comparing the record-level existence score with the record-level decision threshold.

[0010] Specifically, step S1 includes: The acquired raw electromagnetic IQ signals are represented as a sequence. , , The total length of the signal. For discrete-time indexing; Let the window length be The sliding step size is The FFT length is , No. The short-time Fourier transform of a signal segment within a window is defined as: ; in, Indicates the first A window at frequency point The frequency domain complex value; Indicates the original signal at the 1st... The first window One sampling point; For window functions, For frequency point index, For window number, The imaginary unit; No. The power spectrum corresponding to each window is: ; in, Indicates the first A window at frequency point The signal power on; Based on the power spectrum Construct the time-frequency feature vector for each window: ; in, Indicates the first The time-frequency feature vector of each window, Indicates the first The target frequency band energy of each window Indicates the first The spectral centroid or main peak frequency of each window. Indicates the first The effective bandwidth of each window Indicates the first The spectral entropy of a window, Indicates the first Spectral flux of each window Indicates the first Correlation of mirrored frequency bands in each window The transpose of the vector is represented by the time-frequency feature vectors of each window, which together form a window-level time-frequency feature sequence.

[0011] Specifically, step S2 includes: For the Each detection window defines its local background set. for: ; in, The length of the background window; The guard interval is the length of the guard interval, used to prevent suspicious activity in the current window from contaminating the background estimate; For the first The time-frequency feature vector of each window, The index of the background window; For the Each time-frequency characteristic component, local center With local scale They are estimated as follows: ; ; in, This indicates taking the median of the data. For the first Window feature vectors The There are several components, with 1.4826 being the Gaussian consistency correction coefficient. To prevent division by zero of constants; Calculate the standardized residuals of each feature of the current window relative to the local background: ; in, For the first The first window Standardized residuals of each feature For the current number Window feature vectors The One component; Window-level background residual fraction is defined as: ; in, Indicates the first Window-level background residuals for each window; For feature vectors The total number of features in For the first Feature weights of each feature This is to truncate the normalization function.

[0012] Specifically, in step S3, the structured modulation evidence vector Defined as: ; in, This indicates periodic evidence, and its value is obtained by calculating the autocorrelation of the local energy sequence or the main peak intensity sequence; This indicates evidence of spectral peak persistence, and its value is determined according to the first... Set of significant spectral peaks in each window The degree to which a frequency point repeatedly appears in a continuous window is determined; This represents evidence of the intensity of energy alternation, and its value is determined based on the degree to which the high and low states of the local energy sequence exhibit stable alternation according to an adaptive threshold. This indicates evidence of consistency in the spectral trajectory, and its value is determined based on the fitting error of the main peak frequency or spectral centroid within a local time window by fitting a linear or piecewise linear trajectory. This indicates evidence of cyclic stationarity, and its value is determined based on whether the characteristic sequence forms a stable peak at the cyclic frequency or whether the bandwidth remains consistent with the trajectory migration.

[0013] Specifically, in step S4, the fusion method is gated fusion: ; in, Indicates the first Hidden channel evidence score for each window For the first Residual fractions after window normalization For the first The normalized window number is the first A structured modulation evidence component, For the first Non-negative weights of structured modulation evidence; This gating fusion form means that the system assigns a higher hidden channel evidence score only when the current window cannot be explained by the local background and has a modulation structure.

[0014] Specifically, step S5 includes: Define centralized evidence increment: ; in, Indicates the first Centralized evidence increment in each window Indicates the first Hidden channel evidence score for each window This represents the conservative drift term under normal conditions. The sequential cumulative statistic is defined as: , ; in, Indicates the first Sequential cumulative statistics for each window; when At that time, a suspicious hidden passage alarm was triggered, in which Alarm threshold; The most recent Starting from zero and continuously growing as a candidate starting point, Falling back to the low threshold Alternatively, locations with insufficient or continuous evidence are considered candidate endpoints; adjacent candidate intervals are merged if the interval is less than the minimum merging interval; intervals with a duration shorter than the minimum length are removed, resulting in a final set of suspicious intervals. : ; in, To output the number of intervals, and The first The start and end points of the time intervals for each suspicious interval.

[0015] Furthermore, the alarm threshold The calibration method is as follows: For each candidate threshold The number of false alarms generated per unit monitoring time under normal calibration dataset is counted, and the minimum threshold that meets the target false alarm rate requirement is selected: ; in, Candidate threshold The number of false alarms triggered in normal calibration data. The total monitoring time for the normal calibration dataset. The target is the false alarm rate.

[0016] Specifically, step S6 includes: Record-level existence score Defined as: ; in, This represents the maximum value of the sequential cumulative statistic across the entire record. For duration weighting, and The time start and end points of the suspicious interval, Represents the set of suspicious intervals The total duration of all intervals in the middle; Record-level existence score Corresponding confidence level for: ; in, For record-level decision thresholds, This is a sigmoid function used to limit the output to the range [0,1]; when When the preset confidence threshold is exceeded, the system reports that there is suspicious electromagnetic modulation activity in the record.

[0017] A second aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the computer program to implement the steps of the electromagnetic covert channel presence sensing method.

[0018] A third aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the electromagnetic covert channel existence sensing method.

[0019] Compared to existing technologies, the advantages of this invention are as follows: This invention utilizes neighboring windows outside the protection interval to estimate the local background, effectively suppressing the interference of non-stationary background changes caused by contextual factors such as CPU load, thread scheduling, and caching behavior on detection; by using gated fusion, it requires that the window-level background residual score and structured modulation evidence be significant simultaneously before assigning a higher hidden channel evidence score, avoiding the problem of misjudgment caused by relying solely on energy thresholds or single-window anomaly detection; by using sequential statistics to accumulate weak evidence across windows, it reduces the impact of occasional disturbances in single windows, and finally outputs a three-layer result of window-level evidence, suspicious interval set, and record-level existence judgment, providing a basis for subsequent tracing and manual verification. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the present invention; Figure 2 The method of this invention is for record-level hierarchical detection results of two types of data: GSMem and EMLoRa.

[0022] Figure 3 This is the robustness perception result of the method of the present invention under changes in buffer parameters, timing jitter, and CPU context.

[0023] Figure 4 A comparison chart showing the contribution of each independent piece of evidence to the evidence fused by the method of this invention.

[0024] Figure 5 This is a comparison chart of operational-level evidence.

[0025] Figure 6 This is a comparison diagram of the baseline activity range and the output sensing range of the method of this invention. Detailed Implementation

[0026] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0027] Reference Figure 1 The first aspect of this invention provides a method for detecting the existence of electromagnetic hidden channels in response to CPU context interference, comprising the following steps: Step S1, Window Feature Extraction: The acquired raw electromagnetic IQ signal is divided into sliding windows, and the time-frequency features of each window are extracted to obtain a window-level time-frequency feature sequence; specifically, it includes the following steps: The acquired raw electromagnetic IQ signals are represented as a sequence. , , The total length of the signal. For discrete-time indexing; Let the window length be The sliding step size is The FFT length is , No. The short-time Fourier transform of a signal segment within a window is defined as: ; in, Indicates the first A window at frequency point The frequency domain complex value; Indicates the original signal at the 1st... The first window One sampling point; For window functions, For frequency point index, For window number, The imaginary unit; No. The power spectrum corresponding to each window is: ; in, Indicates the first A window at frequency point The signal power on; Based on the power spectrum Construct the time-frequency feature vector for each window: ; in, Indicates the first The time-frequency feature vector of each window, Indicates the first The target frequency band energy of each window Indicates the first The spectral centroid or main peak frequency of each window. Indicates the first The effective bandwidth of each window Indicates the first The spectral entropy of a window, Indicates the first Spectral flux of each window Indicates the first Correlation of mirrored frequency bands in each window The transpose of the vector is represented by the time-frequency feature vectors of each window, which together form a window-level time-frequency feature sequence.

[0028] This step characterizes the electromagnetic signal of each window from six dimensions: frequency band energy, spectral peak position, bandwidth, spectral entropy, spectral flux, and image correlation. Different hidden channel morphologies correspond to different feature subsets: GSMem-like activities usually exhibit on-off keying energy alternation, while EMLoRa-like activities are closer to chirp structures with continuous frequency shifts.

[0029] Step S2, Local Background Suppression: Based on the time-frequency feature sequence, the center and scale of the local background are estimated using the neighboring windows outside the protection interval of the current detection window, and the window-level background residual score of the current window relative to the local background is calculated.

[0030] The background in long-term electromagnetic observations is typically non-stationary; CPU load, thread scheduling, cache behavior, memory access, and probe position changes can all alter the local spectrum. Using a globally normal model would require covering a large amount of normal context and is prone to false alarms under unknown workloads. Therefore, this invention employs local background estimation to suppress context drift, specifically including the following steps: For the Each detection window defines its local background set. for: ; in, The length of the background window; The guard interval is the length of the guard interval, used to prevent suspicious activity in the current window from contaminating the background estimate; For the first The time-frequency feature vector of each window, The index of the background window; For the Each time-frequency characteristic component, local center With local scale They are estimated as follows: ; ; in, This indicates taking the median of the data. This indicates retrieving the nth window from the background set. The median of the eigenvalues; This means first calculating the absolute deviation of each window feature value in the background set relative to the median, and then taking the median of these absolute deviations; For the first Window feature vectors The The component is 1.4826, which is the Gaussian consistency correction coefficient for MAD. To prevent division by zero of constants; Calculate the standardized residuals of each feature of the current window relative to the local background: ; in, For the first The first window Standardized residuals of each feature For the current number Window feature vectors The One component; Window-level background residual fraction is defined as: ; in, Indicates the first Window-level background residuals for each window; For feature vectors The total number of features in For the first Feature weights of each feature To truncate the normalization function. Normal context switching can also produce large residuals, therefore window-level background residual scores do not constitute a separate latent channel criterion.

[0031] Step S3, Structured Modulation Evidence: Extract structured modulation evidence related to communication modulation behavior from the window-level time-frequency feature sequence.

[0032] The fundamental difference between covert channels and ordinary load disturbances lies in the modulation structure. Ordinary programs may generate transient energy peaks or spectral disturbances, but they typically lack a stable communication target. Covert channels, in order to transmit information, need to maintain a certain structure in time, frequency, or execution mode. Therefore, this invention further extracts structured modulation evidence beyond local residuals.

[0033] Let the structured modulation evidence vector be... for: ; in, This indicates periodic evidence, used to characterize recurring patterns caused by symbol transmission or state transitions; its value is obtained by calculating the autocorrelation of local energy sequences or main peak intensity sequences; if stable peaks exist at certain non-zero lags, then... This evidence is suitable for capturing fixed symbol periods or repetitive modulation segments.

[0034] This indicates evidence of spectral peak persistence, used to characterize whether the frequency domain structure is maintained across multiple windows; its value is determined according to the... Set of significant spectral peaks in each window The degree to which frequency points repeatedly appear in a continuous window is determined; if certain frequency points or adjacent frequency bands repeatedly appear in a continuous window, then... The evidence suggests that this can suppress transient spectral peaks caused by sporadic CPU activity.

[0035] This represents evidence of energy alternation intensity, used to describe OOK-like activity; its value is determined based on the degree to which the high and low states of the local energy sequence exhibit stable alternation, as defined by an adaptive threshold. The local energy sequence is divided into high and low states according to the adaptive threshold. If the high and low states exhibit stable alternation and the energy difference between states is significant, then... The increase corresponds to the active / silent switching in the GSMem activity.

[0036] This represents evidence of spectral trajectory consistency, used to describe chirp-like or sweeping-like activity; its value is determined by the fitting error of the main peak frequency or spectral centroid within a local time window, based on the linear or piecewise linear trajectory fitting. Indicates the main peak frequency or spectral centroid. If Within a local time window, a linear or piecewise linear trajectory can be fitted, and the fitting error is small. The increase corresponds to the ridge-like time-frequency trajectory in EMLoRa-like activities.

[0037] This indicates evidence of cyclic stationarity, used to characterize statistical periodic variations caused by modulation; its value is determined by whether the characteristic sequence forms stable peaks at certain cyclic frequencies or whether the bandwidth remains consistent with the trajectory migration; if the characteristic sequence forms stable peaks at certain cyclic frequencies, or the bandwidth remains consistent with the trajectory migration, then... This evidence helps distinguish communication modulation from aimless background fluctuations.

[0038] Step S4, Sequential Interval Perception: The window-level background residual score is fused with the structured modulation evidence to generate the hidden channel evidence score for the current window.

[0039] The local background residuals and structured modulation evidence are fused into a window-level hidden channel evidence score: ; in, Indicates the first Hidden channel evidence score for each window; For the first Residual fractions after window normalization for The weights; For the first The normalized window number is the first A structured modulation evidence component, For the first Non-negative weights of structured modulation evidence; To reduce false alarms caused by common anomalies, a gating fusion approach can be adopted: ; This gating fusion form indicates that only when the current window cannot be interpreted by the local background ( The value is relatively large), and it also has a modulation structure ( The system assigns a higher hidden channel evidence score only when the value is relatively large.

[0040] Step S5: Calculate the sequential cumulative statistics based on the hidden channel evidence score. When the sequential cumulative statistics exceed the alarm threshold, trigger an alarm. Then, locate the start and end points of the suspicious interval based on the growth and decline of the sequential cumulative statistics.

[0041] Long-term monitoring cannot rely on isolated window decisions, otherwise the false alarm probability will accumulate with the increase of monitoring time; therefore, this invention adopts sequential detection to accumulate weak evidence, specifically including the following steps: Define centralized evidence increment: ; in, Indicates the first Centralized evidence increment in each window Indicates the first Hidden channel evidence score for each window This is a conservative drift term under normal conditions, which can be estimated from normal control records or historical quantiles.

[0042] The sequential cumulative statistic is defined as: , ; in, Indicates the first Sequential cumulative statistics for each window; when At that time, a suspicious hidden passage alarm was triggered, in which This is the alarm threshold; this threshold is calibrated using only normal operating condition data, rather than being selected based on test data.

[0043] For each candidate threshold The method of this invention is applied to a normal calibration dataset, and the number of false alarms generated within a unit monitoring time is counted. The minimum threshold that meets the target false alarm rate requirement is then selected. ; in, Candidate threshold The number of false alarms triggered in normal calibration data. The total monitoring time for the normal calibration dataset. The target is the false alarm rate.

[0044] To locate the suspicious area, the most recent Starting from zero and continuously growing as a candidate starting point, Falling back to the low threshold Alternatively, locations with insufficient or continuous evidence are considered candidate endpoints; adjacent candidate intervals are merged if the interval is less than the minimum merging interval; intervals with a duration shorter than the minimum length are removed, resulting in a final set of suspicious intervals. : ; in, To output the number of intervals, and The first The start and end points of the time intervals for each suspicious interval.

[0045] Step S6: Based on the maximum value of the sequential cumulative statistics in the entire record and the total duration of the suspicious interval, generate a record-level existence score, and output a record-level decision on whether there is suspicious electromagnetic hidden channel activity in the entire observation based on the comparison between the record-level existence score and the record-level decision threshold. Record-level existence score Defined as: ; in, This represents the maximum value of the sequential cumulative statistic across the entire record. For duration weighting, and The time start and end points of the suspicious interval, Represents the set of suspicious intervals The total duration of all intervals in the middle; Record-level existence score Corresponding confidence level for: ; in, For record-level decision thresholds, This is a sigmoid function used to limit the output to the range [0,1]; when If the preset confidence threshold is exceeded, the system reports suspicious electromagnetic modulation activity in the record. Record-level decision threshold. The selection should not be made manually on the test records, but should be determined by the normal calibration set. Specifically, first calculate the values ​​of all normal-only calibration records. Then, based on the target record-level false alarm rate Learn from experience Quantiles are used as thresholds. If candidate hidden channel verification records exist, the threshold with the highest recall rate can be selected while satisfying the normal record false alarm rate constraint.

[0046] The final output of this invention is a three-tiered result oriented towards defensive review, including: Window-level evidence: Used to describe the degree of modulation suspicion in each time window, i.e., outputting the hidden channel evidence score for each window. ; Interval-level sensing: used to provide candidate time ranges for subsequent source tracing, thereby outputting a set of suspicious intervals. ; Record-level decision: Used to answer whether there is suspicious electromagnetic hidden channel activity during the entire observation period, i.e., output confidence level. Or a binary decision result.

[0047] A second aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor executes the computer program to implement the steps of the electromagnetic covert channel presence sensing method.

[0048] A third aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the electromagnetic covert channel existence sensing method.

[0049] Evaluation testing and performance analysis: To verify the effectiveness of the method of this invention in electromagnetic covert channel interval detection and source behavior tracing, this invention selects two typical electromagnetic covert channels, GSMem and EMLoRa, as experimental objects. GSMem mainly exhibits intermittent high and low radiation state switching, and its modulation structure conforms to on / off keying characteristics. EMLoRa, on the other hand, exhibits continuous radiation and spectrum shift, and its modulation structure conforms to quasi-linear frequency modulation spread spectrum characteristics. These two represent burst radiation scenarios and continuous radiation scenarios, respectively.

[0050] The experimental platform consists of a target device and a near-field electromagnetic acquisition device. The target device is a Lenovo Air14 laptop equipped with an Intel Core i5-1135G7 processor with a base clock speed of 2.5GHz, containing four physical cores and eight logical threads. The target device is used to run single-instruction loop benchmark programs, pure implicit channel programs, and mixed-scenario programs.

[0051] Electromagnetic signals are acquired by a PBS-H4 near-field electric field probe. The acquired signals are amplified by an AARONIAAG low-noise RF amplifier and then input into the USRPB210 software radio platform for in-phase / quadrature sampling.

[0052] (1) Overall perception results

[0053] Appendix Figure 2 The method of the present invention is shown to perform record-level hierarchical detection for two types of data: GSMem and EMLoRa. For GSMem-like data, the method of this invention did not exhibit any record-level false detections on purely normal samples, indicating that the local background suppression module and structural feature evidence oriented towards on / off keying can filter out CPU operation activities with no fixed pattern. Samples with moderate buffer lengths and small timing jitter can be stably detected, while samples with weak structural features or drastic fluctuations correspond to lower record-level scores. These results demonstrate that GSMem-like signal detection depends not only on signal energy but also on stable signal on / off switching and temporal periodicity.

[0054] For EMLoRa-like signal recording samples, all candidate runtime segments can trigger runtime detection procedures, demonstrating that linear frequency modulation residuals, frequency trajectories, bandwidth patterns, and timing evidence can collaboratively determine signal existence under various CPU contexts and timing fluctuations. Meanwhile, while some signal recordings containing only normal business signals may trigger regular activity alarms, they ultimately fail to establish a complete EMLoRa-like characteristic structure and are therefore not considered to contain a hidden channel. This distinction is crucial: defense systems should not consider all enhanced electromagnetic activity as a hidden channel but should instead determine whether it possesses a communication modulation structure.

[0055] The results above demonstrate that structured evidence can reduce false alarms caused by enhanced normal CPU activity and improve the separability between candidate records and normal records.

[0056] (2) Robustness under parameter variation and context disturbance

[0057] Figure 3 The robustness of the method of the present invention under buffer parameters, timing jitter and CPU context changes is shown. The results show that parameter changes and context interference will affect the quality of interval boundaries, but will not necessarily destroy the existence determination of the entire record level.

[0058] For GSMem-like signals, the buffer size has a significant impact on the accuracy of interval positioning. For example... Figure 3 As shown in (a), when the buffer size is 64KB and 128KB, the method of this invention can completely cover most of the signal activity range while maintaining a moderate IoU (Intersection over Union) and a high coverage. However, when the buffer size is increased to 256KB or more, both the IoU and coverage decrease significantly, indicating that a larger buffer changes the temporal granularity of the on / off keying modulation signal, causing instability in the boundary determination of local residual features and periodic evidence. It is worth noting that the model can still maintain high precision under some large-capacity buffer configurations, that is, the output alarm range is basically concentrated in the actual signal activity area, but the effective coverage is insufficient. Therefore, it can be seen that the quality of perception cannot be determined solely by precision; it is necessary to combine coverage and signal fragmentation for evaluation.

[0059] Temporal jitter primarily affects symbol boundaries and periodic evidence. For example... Figure 3 As shown in (b), for light to moderate jitter settings, the method of this invention still maintains good interval accuracy; as jitter increases to a stronger level, IoU and Coverage decrease, and fragmentation increases, indicating that symbol boundary drift can break continuous evidence into multiple short intervals. This phenomenon is consistent with the boundary sensitivity of OOK modulation: when the active / silent transition is no longer stably aligned, interval localization is more prone to degradation than whole-segment existence judgment.

[0060] like Figure 3 As shown in (c), typical operational-level evidence indicates that, for EMLoRa-like signals, the record-level presence score... The chirp-like phenomenon remains relatively stable across different CPU contexts and is accompanied by the co-occurrence of chirp (linear frequency modulation), residual, trajectory, and sequential evidence, indicating that the existence of chirp-like phenomena is not determined by a single frequency band energy, but rather by the combined support of the sweep trajectory, bandwidth shape, and cross-window persistence. Figure 3 As shown in (c), the comparison of evidence from pure normal samples and candidate samples shows that CPU-bound, memory-bound, same-core, and different-core interference may cause local spectral fluctuations and trajectory fragmentation. However, as long as the chirp trajectory and bandwidth pattern continue to appear repeatedly in multiple windows, the method of the present invention can still form a whole record-level evidence.

[0061] (3) Contribution of structured evidence

[0062] Figure 4 The contributions of different pieces of evidence are analyzed from two perspectives: the separability of evidence and the distribution of evidence at the record-level structure. For example... Figure 4 As shown in (a), regarding the discriminative power of the evidence, for GSMem-like data, the AUROC / AUPRC of band power is lower than that of residual, structure, and ECSense evidence, indicating that single energy features are easily affected by CPU background interference. Figure 4 As shown in (b), regarding the distribution of operational-level structural evidence, for EMLoRa-like data, the record-level structural evidence heatmap shows that candidate records typically possess chirp, trajectory, bandwidth, and sequential evidence simultaneously, while normal-only records lack a complete structural combination.

[0063] Figure 5 Further, a comparison of evidence at each level of the record is provided. For example... Figure 5 As shown in (a), all evidence components of the GSMem-like signal are higher than the random baseline, indicating that OOK-like activity can achieve moderate separability in residual, structural, and existential evidence. Figure 5As shown in (b), the mean score of the EMLoRa-like signal operation level shows a more significant difference between normal and candidate, while the differences in individual chirp, residual, or structural scores are relatively limited, indicating that fused evidence is more suitable for supporting record-level existence determinations.

[0064] (4) Interval-level perception results

[0065] Figure 6 The correspondence between the baseline activity range and the output range of the method of this invention (ECSense) is shown. For GSMem-like records, such as Figure 6 As shown in (a), the output interval of the method of the present invention has good overlap with the standard active interval. Minor mismatches mainly arise from boundary blurring, timing jitter, and signal fragmentation. For EMLoRa-like records, Figure 6 (b) The correspondence between the reference activity interval and the ECSense output interval is shown. Since chirp-like activities have high duty cycles and multiple short-time structures, the ECSense output usually manifests as multiple short candidate intervals. Therefore, in addition to IoU, this invention also reports coverage, fragmentation, and run-level score to more comprehensively reflect the interval-level sensing effect.

[0066] In the GSMem-like parameter experiments, B64 and B128 achieved high coverage and moderate IoU, indicating that OOK-like activities under small to medium buffers can be covered relatively completely. J100, J500, and J1000 maintained high accuracy even under jitter conditions, indicating that the output range mainly falls near the actual activity. As jitter further increased, coverage decreased while fragmentation increased, indicating that the system tends to output conservative but reliable candidate ranges rather than expanding the alarm range to pursue coverage.

[0067] In EMLoRa-like data, the duration of sensing intervals exhibits a right-skewed distribution. Most final sensing intervals are concentrated in the 1–2 second range, with a few lasting longer. This indicates that linear frequency modulation (LFM)-like structures typically exist as multiple short-duration activities. Evidence composition of typical intervals shows that trajectory evidence dominates in most intervals, with LFM evidence, residual evidence, and temporal evidence providing supplementary support. This result demonstrates that the intervals output by ECSense are not only applicable to on / off keying scenarios with clear reference boundaries but can also provide candidate time intervals for subsequent tracking and manual verification of LFM-like activities. The candidate suspicious intervals output by the algorithm can reduce the amount of data input into subsequent tracking analysis or manual verification, while providing interpretable feature information, including interval location, duration, and dominant evidence type.

[0068] In summary, the method of this invention achieves robust signal presence detection by integrating local residuals, modulation structure features, and a time-series accumulation mechanism. GSMem-like data primarily relies on residuals, alternating transformations, and periodic features for identification; while EMLoRa-like data depends more on trajectory, bandwidth characteristics, and linear frequency modulation consistency features for characterization.

[0069] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting the existence of electromagnetic covert channels in response to CPU context interference, characterized in that, Includes the following steps: Step S1: Divide the acquired raw electromagnetic IQ signal into sliding windows and extract the time-frequency features of each window to obtain a window-level time-frequency feature sequence; Step S2: Based on the time-frequency feature sequence, estimate the center and scale of the local background using the neighboring windows outside the protection interval of the current detection window, and calculate the window-level background residual score of the current window relative to the local background. Step S3: Extract structured modulation evidence related to communication modulation behavior from the window-level time-frequency feature sequence; Step S4: The window-level background residual score is fused with the structured modulation evidence to generate the hidden channel evidence score for the current window. Step S5: Calculate the sequential cumulative statistics based on the hidden channel evidence score. When the sequential cumulative statistics exceed the alarm threshold, trigger an alarm. Locate the start and end points of the suspicious interval based on the growth and decline of the sequential cumulative statistics. Step S6: Based on the maximum value of the sequential cumulative statistics in the entire record and the total duration of the suspicious interval, generate a record-level existence score, and output a record-level decision on whether there is suspicious electromagnetic hidden channel activity in the entire observation by comparing the record-level existence score with the record-level decision threshold.

2. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 1, characterized in that, Step S1 specifically includes: The acquired raw electromagnetic IQ signals are represented as a sequence. , , The total length of the signal. For discrete-time indexing; Let the window length be The sliding step size is The FFT length is , No. The short-time Fourier transform of a signal segment within a window is defined as: ； in, Indicates the first A window at frequency point The frequency domain complex value; Indicates the original signal at the 1st... The first window One sampling point; For window functions, For frequency point index, For window number, The imaginary unit; No. The power spectrum corresponding to each window is: ； in, Indicates the first A window at frequency point The signal power on; Based on the power spectrum Construct the time-frequency feature vector for each window: ； in, Indicates the first The time-frequency feature vector of each window, Indicates the first The target frequency band energy of each window Indicates the first The spectral centroid or main peak frequency of each window. Indicates the first The effective bandwidth of each window Indicates the first The spectral entropy of a window, Indicates the first Spectral flux of each window Indicates the first Correlation of mirrored frequency bands in each window The transpose of the vector is represented by the time-frequency feature vectors of each window, which together form a window-level time-frequency feature sequence.

3. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 1, characterized in that, Step S2 specifically includes: For the Each detection window defines its local background set. for: ； in, The length of the background window; The guard interval is the length of the guard interval, used to prevent suspicious activity in the current window from contaminating the background estimate; For the first The time-frequency feature vector of each window, The index of the background window; For the Each time-frequency characteristic component, local center With local scale They are estimated as follows: ； ； in, This indicates taking the median of the data. For the first Window feature vectors The There are several components, with 1.4826 being the Gaussian consistency correction coefficient. To prevent division by zero of constants; Calculate the standardized residuals of each feature of the current window relative to the local background: ； in, For the first The first window Standardized residuals of each feature For the current number Window feature vectors The One component; Window-level background residual fraction is defined as: ； in, Indicates the first Window-level background residuals for each window; For feature vectors The total number of features in For the first Feature weights of each feature This is to truncate the normalization function.

4. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 1, characterized in that, In step S3, the structured modulation evidence vector Defined as: ； in, This indicates periodic evidence, and its value is obtained by calculating the autocorrelation of the local energy sequence or the main peak intensity sequence; This indicates evidence of spectral peak persistence, and its value is determined according to the first... Set of significant spectral peaks in each window The degree to which a frequency point repeatedly appears in a continuous window is determined; This represents evidence of the intensity of energy alternation, and its value is determined based on the degree to which the high and low states of the local energy sequence exhibit stable alternation according to an adaptive threshold. This indicates evidence of consistency in the spectral trajectory, and its value is determined based on the fitting error of the main peak frequency or spectral centroid within a local time window by fitting a linear or piecewise linear trajectory. This indicates evidence of cyclic stationarity, and its value is determined based on whether the characteristic sequence forms a stable peak at the cyclic frequency or whether the bandwidth remains consistent with the trajectory migration.

5. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 1, characterized in that, In step S4, the fusion method is gated fusion: ； in, Indicates the first Hidden channel evidence score for each window For the first Residual fractions after window normalization For the first The normalized window number is the first A structured modulation evidence component, For the first Non-negative weights of structured modulation evidence; This gating fusion form means that the system assigns a higher hidden channel evidence score only when the current window cannot be explained by the local background and has a modulation structure.

6. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 1, characterized in that, Step S5 specifically includes: Define centralized evidence increment: ； in, Indicates the first Centralized evidence increment in each window Indicates the first Hidden channel evidence score for each window This represents the conservative drift term under normal conditions. The sequential cumulative statistic is defined as: ， ； in, Indicates the first Sequential cumulative statistics for each window; when At that time, a suspicious hidden passage alarm was triggered, in which Alarm threshold; The most recent Starting from zero and continuously growing as a candidate starting point, Falling back to the low threshold Alternatively, locations with insufficient or continuous evidence are considered candidate endpoints; adjacent candidate intervals are merged if the interval is less than the minimum merging interval; intervals with a duration shorter than the minimum length are removed, resulting in a final set of suspicious intervals. : ； in, To output the number of intervals, and The first The start and end points of the time intervals for each suspicious interval.

7. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 6, characterized in that, The alarm threshold The calibration method is as follows: For each candidate threshold The number of false alarms generated per unit monitoring time under normal calibration dataset is counted, and the minimum threshold that meets the target false alarm rate requirement is selected: ； in, Candidate threshold The number of false alarms triggered in normal calibration data. The total monitoring time for the normal calibration dataset. The target is the false alarm rate.

8. The electromagnetic covert channel presence detection method for CPU context interference as described in claim 6, characterized in that, Step S6 specifically includes: Record-level existence score Defined as: ； in, This represents the maximum value of the sequential cumulative statistic across the entire record. For duration weighting, and The time start and end points of the suspicious interval, Represents the set of suspicious intervals The total duration of all intervals in the middle; Record-level existence score Corresponding confidence level for: ； in, For record-level decision thresholds, This is a sigmoid function used to limit the output to the range [0,1]; when When the preset confidence threshold is exceeded, the system reports that there is suspicious electromagnetic modulation activity in the record.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the electromagnetic hidden channel existence sensing method as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the electromagnetic hidden channel existence sensing method as described in any one of claims 1 to 8.

Images