Detecting repeating software operations in code blocks using RF side-channel analysis
Samuel V. Mantravadi, James T. Graham, Ashwin Fisher · 2019
Side-channel analysis covers several methods for determining the state of a device without directly interacting with the device. In previous work, we collected near-field radio frequency emanations from simple programs to assess how various code operations could be differentiated at the instruction level. However, detecting operations in large blocks of instructions in more complicated programs have proven difficult due to the high dimensionality of the data. In this research, we examine methods to differentiate common operations using RF emanations. We use a series of example codes useful for Two Factor Authentication on an Arduino Mega. Some examples are coded with extra operations to simulate malware such as intentionally leaking the key, nuisance operations, or substituting a weaker hash function. After collecting RF data, approximation techniques are used to reduce the data dimensionality and identify motifs in the time series. The motifs are correlated with the operations taking place by use of a uniquely identifiable triggering mechanism. Several exemplary motifs are then used together as templates that can be used to search for a connected series of operations. These templates are compared with an RF time series of unknown operations using a minimum distance metric. We evaluate the quality of templates available from an RF data collection and examine the usefulness of templates as features for classification.