Systems, methods, and apparatuses for intrusion detection and analytics using power characteristics such as side-channel information collection

摘要

Some embodiments described herein include a system that collects and learns reference side-channel normal activity, process it to reveal key features, compares subsequent collected data and processed data for anomalous behavior, and reports such behavior to a management center where this information is displayed and predefine actions can be executed when anomalous behavior is observed. In some instances, a physical side channel (e.g. and indirect measure of program execution such as power consumption or electromagnetic emissions and other physical signals) can be used to assess the execution status in a processor or digital circuit using an external monitor and detect, with extreme accuracy, when an unauthorized execution has managed to disrupt the normal operation of a target system (e.g., a computer system, etc.).

主权项

1. An apparatus, comprising:
a probe component configured to capture side-channel information relating to an operation status of a target device when the probe component disposed proximate to the target device; a positioner device, disposed in connection with the probe component, configured to adjust a position of the probe component; a processor, communicatively coupled to the probe component and the positioner device, configured to:
place, via the positioner device, the probe component at a first position,capture, via the probe component at the first position, a first set of side-channel data,obtain, from a data analytics component, feedback relating to the first set of side-channel data,determine a quality metric value associated with the first position based on the feedback, andsend a signal to the positioner device to adjust the positioner device to place the probe component at a second position.