Side Channel Signal Monitoring for Runtime Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing runtime monitoring systems are vulnerable to tampering and ineffective in accurately monitoring complex software and modern processor implementations, as they require modification of the monitored device and struggle with noise and variability in signal patterns.
Innovation Solution
The system employs external monitoring using electromagnetic emanations, leveraging probabilistic software and hardware models to recognize program activity, separate sub-channels, and reduce noise, allowing for accurate monitoring without modifying the target device and accounting for variability in signal patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If external monitoring is performed through side channel analysis, then monitoring accuracy is improved, but computational requirements and complexity increase
Solution Approach 1:
The patent segments the complex signal processing task into multiple stages: signal acquisition from side channels, feature extraction to identify relevant patterns, probabilistic software modeling to capture expected behavior, and anomaly detection to identify deviations. This segmentation reduces computational complexity by breaking down the monolithic monitoring task into manageable components that can be processed sequentially.
Solution Approach 2:
The patent creates probabilistic software models that replicate expected program behavior based on training data. These models serve as virtual copies of normal execution patterns, allowing the system to compare actual side channel signals against predicted patterns without requiring exhaustive analysis of every possible execution path, thereby reducing computational requirements.
2Ease of manufacture
If monitoring is performed from within the system, then implementation is simpler, but vulnerability to tampering increases
Solution Approach 1:
The patent introduces an external monitoring system that observes the target system through side channels without requiring direct access to or modification of the target's internal components. This intermediary approach allows monitoring to be performed remotely, eliminating the need to compromise the target system while maintaining monitoring effectiveness through physical side channel observations.
3Ease of operation
If traditional monitoring features are included in the system design, then monitoring capability is provided, but system security is compromised
Solution Approach 1:
The patent replaces traditional software-based monitoring mechanisms with physics-based side channel observation. Instead of using software hooks, instrumentation, or system calls that require modifying the target system, the monitoring is performed by observing physical phenomena (electromagnetic emissions, acoustic signals, power consumption) that naturally occur during computation, thereby substituting mechanical/software intervention with passive physical observation.
4Reliability
If side channel analysis is used for monitoring, then external monitoring is achieved, but noise and signal variability increase
Solution Approach 1:
The patent performs preliminary training during a setup phase where the system learns expected side channel patterns for various program executions before actual monitoring begins. This preliminary action creates reference models of normal behavior, enabling the system to distinguish between expected signal variations and actual anomalies during operational monitoring, thereby improving signal quality assessment.
Solution Approach 2:
The patent employs signal processing techniques that transform raw side channel signals into feature representations that are more robust to noise. By changing the parameter space from raw time-domain signals to frequency-domain features or other transformed representations, the system enhances the signal-to-noise ratio and reduces the impact of variability in the original signals.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach provides precise and generalizable security monitoring, capable of detecting anomalies and maintaining accuracy even with noisy signals, by exploiting subchannels and using models of software and hardware behavior to reduce computational requirements.
Implementation Method 1
receiving a signal from a monitored device... wirelessly receiving signals emanating from the monitored device
Data Source
AI summary
A method of receiving one or more signals emanated from a monitored device, signal processing, based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, one or more signals to determine if an anomaly exists in one or more signals, and responsive to determining that an anomaly exists based on the signal processing, transmitting an indication of the anomaly.