PHIDIAS: Power Signature Host-based Intrusion Detection in Automotive Microcontrollers

We present a lightweight host-based Intrusion Detection System (IDS) that detects tampering by utilizing voltage side-channel measurements from software running on automotive Electronic Control Units (ECUs). By collecting and analyzing traces of normal and abnormal software behavior, we train classifiers to recognize unique voltage fingerprints. At a sampling rate of 9.8 MS/s, our system achieved a test accuracy of 99.9% using Deep Learning (DL) and 99.67% with gradient boosting. We verified the high test accuracy across various setup parameters. Specialized training for high availability reduced the false positive rate to 6e-5. We employed noise-aware training to enable neural networks to differentiate between regular noise and potential intrusions, designating noise above a certain threshold as malicious. To validate the practicality of our IDS on automotive microcontrollers, we implemented and tested a complete Machine Learning (ML) pipeline on an Infineon AURIX TriCore, utilizing its Analog-to-Digital Converters (ADCs) to collect traces. The full IDS required only 382.58 kB of ROM and 16.83 kB of RAM.