PITEM: Permutations-Based Instruction Tracking Via Electromagnetic Side-Channel Signal Analysis
Elvan Mert Ugurlu, Baki Berkay Yilmaz, Alenka G. Zajic, Milos Prvulović · IEEE Transactions on Computers · 2021
The emergence of cyber-physical systems (CPS) and internet of things (IoT) devices impose significant security and privacy concerns that necessitate robust monitoring and malware detection systems. This paper proposes PITEM, a framework for instruction-level monitoring and malware detection using electromagnetic (EM) side-channels. PITEM identifiesinstruction typeswith similar EM emanations using hierarchical clustering. To track all combinations of theseinstruction types, we generate EM signatures for all permutations of them. In testing, we predict the permutation class of testing traces by a matched-filter-like predictor. We test the performance on two devices (FPGA-based and ARM-based) with 50 MHz and 1 GHz clock frequencies. We achieve 95.67 and 87.35 percent accuracies for these devices for single execution of permutations. We note that the accuracy increases to 100 percent when permutation blocks are repeated. Furthermore, we test the limits of the system by tracking permutations of instructions of the same type. With sufficient bandwidth and number of repetitions, individual instructions can be resolved with 87.5 and 95.78 percent accuracies for these devices. The performance is evaluated for different relative signal-to-noise ratio (SNR) levels and performance is stable for relative SNR values$>15$>15dB. Finally, we demonstrate PITEM's ability to detectfine-grainedmalware with 99.89 percent accuracy.