TY - GEN
T1 - Do Programs Dream of Electromagnetic Signals? Towards GAN-based Code-to-Signal Synthesis
AU - INL Author Affiliation
AU - Author D, Hidden
AU - Vedros, Kurt A.
AU - Kolias, Constantinos
AU - Ivans, Robert C.
N1 - Funding Information:
This study was supported by funds from the Department of Energy under U.S. DOE Idaho Operations Office Contract DE-AC07-05ID14517, as part of the Laboratory Directed Research and Development, Resilient Control and Instrumentation Systems (ReCIS) program of Idaho National Laboratory.
Publisher Copyright:
© 2023 IEEE.
DBLP License: DBLP's bibliographic metadata records provided through http://dblp.org/ are distributed under a Creative Commons CC0 1.0 Universal Public Domain Dedication. Although the bibliographic metadata records are provided consistent with CC0 1.0 Dedication, the content described by the metadata records is not. Content may be subject to copyright, rights of privacy, rights of publicity and other restrictions.
PY - 2023/12/25
Y1 - 2023/12/25
N2 - The analysis of EM signals has become a popular approach as a means for achieving non-intrusive and external anomaly detection, particularly in the realm of embedded devices. Previous efforts have shown huge potential in terms of discriminative precision between those signals that correspond to normal versus anomalous operations. However, virtually all research in the area neglects the challenge of gathering high-quality signals for the purpose of fingerprinting all possible execution paths of a program. Today, such efforts are mainly human-driven and because there may be hundreds of alternative paths even in simple programs, EM-based anomaly detection approaches exhibit poor scalability. In this work, we introduce a set of methods for the generation of EM signals directly from code. To the best of our knowledge, this is the first effort that aims to address code-to-signal synthesis for purposes of side-channel analysis. The proposed framework is based on Generative Adversarial Networks (GAN) that receive the corresponding assembly (ASM) code of a program as input and in turn produce artificial signals which bear near-identical morphological characteristics as the corresponding real EM signals. Although the proposed method pertains across a wide range of applications we have evaluated our approach specifically for the task of training anomaly detection models. We experimentally showed that synthetic signals can train models that can then detect even stealthy code injection attacks i.e., very challenging minimal code alterations with great accuracy. More specifically, synthetically trained anomaly detection models achieve a near-perfect AUC score of 0.993 for the detection of four malicious instructions and 0.981 for the detection of two malicious instructions. Interestingly, applying rudimentary feature engineering i.e., considering the maximum amplitude of the signal per cycle as opposed to the entire raw signal leads to perfect detection accuracy.
AB - The analysis of EM signals has become a popular approach as a means for achieving non-intrusive and external anomaly detection, particularly in the realm of embedded devices. Previous efforts have shown huge potential in terms of discriminative precision between those signals that correspond to normal versus anomalous operations. However, virtually all research in the area neglects the challenge of gathering high-quality signals for the purpose of fingerprinting all possible execution paths of a program. Today, such efforts are mainly human-driven and because there may be hundreds of alternative paths even in simple programs, EM-based anomaly detection approaches exhibit poor scalability. In this work, we introduce a set of methods for the generation of EM signals directly from code. To the best of our knowledge, this is the first effort that aims to address code-to-signal synthesis for purposes of side-channel analysis. The proposed framework is based on Generative Adversarial Networks (GAN) that receive the corresponding assembly (ASM) code of a program as input and in turn produce artificial signals which bear near-identical morphological characteristics as the corresponding real EM signals. Although the proposed method pertains across a wide range of applications we have evaluated our approach specifically for the task of training anomaly detection models. We experimentally showed that synthetic signals can train models that can then detect even stealthy code injection attacks i.e., very challenging minimal code alterations with great accuracy. More specifically, synthetically trained anomaly detection models achieve a near-perfect AUC score of 0.993 for the detection of four malicious instructions and 0.981 for the detection of two malicious instructions. Interestingly, applying rudimentary feature engineering i.e., considering the maximum amplitude of the signal per cycle as opposed to the entire raw signal leads to perfect detection accuracy.
KW - Side channel analysis
KW - anomaly detection
KW - electromagnetic signals
KW - generative adversarial networks
UR - https://www.scopus.com/pages/publications/85182398259
UR - https://www.mendeley.com/catalogue/ba54496c-c54f-3ac0-8df1-fa47a26f3ca9/
U2 - 10.1109/MILCOM58377.2023.10356226
DO - 10.1109/MILCOM58377.2023.10356226
M3 - Conference contribution
AN - SCOPUS:85182398259
SN - 9798350321814
T3 - MILCOM 2023 - 2023 IEEE Military Communications Conference (MILCOM)
SP - 716
EP - 721
BT - MILCOM 2023 - 2023 IEEE Military Communications Conference: Communications Supporting Military Operations in a Contested Environment
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2023 IEEE Military Communications Conference, MILCOM 2023
Y2 - 30 October 2023 through 3 November 2023
ER -