Anomaly Detection via Side-Channel Emanations for IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices lack the processing capacity to utilize established intrusion prevention techniques, making them vulnerable to attacks as they cannot accommodate sophisticated security solutions like intrusion detection and prevention systems.
Innovation Solution
A method for anomaly detection based on side-channel emanations, which involves obtaining and analyzing these emanations to identify distinct patterns and timing characteristics, generating a non-deterministic finite automaton (NFA) to capture device states and transitions, and detecting anomalies by correlating these patterns with normal behavior, allowing for remedial actions such as disabling network communications or alerting users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection and prevention systems are deployed to detect and prevent malicious code, then security detection capability is improved, but device complexity and resource requirements increase beyond what IoT devices can accommodate
Solution Approach 1:
The patent extracts the security detection function from the IoT device itself and relocates it to an external monitoring system. The IoT device continues its normal operation with minimal resources, while a separate system captures side-channel emanations (electromagnetic, acoustic, or other physical signals) and performs the computationally intensive anomaly detection analysis externally, thus resolving the resource constraint contradiction.
Solution Approach 2:
The patent introduces side-channel emanations as an intermediary medium between the IoT device and the security monitoring system. Instead of the IoT device directly executing security detection code, the monitoring system observes physical emanations from the device and infers security states, allowing sophisticated detection without burdening the constrained device.
2Reliability
If sophisticated security solutions are implemented to protect against attacks, then security protection level is improved, but processing power and memory consumption increase beyond IoT device capabilities
Solution Approach 1:
The patent extracts the computationally intensive security analysis functions from the IoT device and performs them externally. The device only needs to naturally emit side-channel signals during operation, while the external system handles all processing, memory-intensive pattern matching, and anomaly detection, thus protecting the device from excessive power consumption.
Solution Approach 2:
The patent replaces traditional computational security mechanisms (code execution, signature matching on-device) with physical observation mechanisms. Instead of the device processing security code, the system observes physical emanations and uses external computational resources to interpret them, substituting mechanical computation with physical signal analysis.
3Loss of time
If real-time anomaly detection is implemented to identify attacks promptly, then response time is improved, but computational complexity increases beyond what can be handled by resource-constrained devices
Solution Approach 1:
The patent uses side-channel emanations as a continuous intermediary signal that provides real-time information about device state without requiring computational processing on the device itself. The external monitoring system receives these continuous physical signals and performs real-time analysis, achieving prompt anomaly detection while keeping the IoT device computationally simple.
Solution Approach 2:
The patent creates a virtual model of the IoT device's operational states by analyzing side-channel emanations. The external system builds and maintains a model of normal behavior patterns based on observed emanations, enabling real-time comparison and anomaly detection without the IoT device needing to execute complex detection algorithms.
Data Source
AI summary
A computer program product, a computer-implemented method, and a computer system include a processor(s) that obtains side channel emanations from a device. The processor(s) analyzes the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns. The processor(s) generates a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, where the NFA captures states and state transitions of the device. The processor(s) identifies an anomaly in the device, based on deviation in emanations from the device.