Using Side-Channel Analysis as Anomaly Detection in Embedded Systems

Anomaly detection systems are commonly used in networks as a form of improving system security, especially in critical infrastructure. This research investigates the potential of utilizing side-channel analysis for anomaly detection in real-time systems. In this work, we propose comparing power consumption and electromagnetic emission side-channels to detect anomalous behavior within computing devices. We use a physical testbed for data collection and support vector machine (SVM) classifier to evaluate whether the anomalous behaviors could be detected based on the side-channel data collected from the BeagleBone Black development board with the Bus Pirate hardware implant. The SVM classifier is trained with labeled power consumption data from normal and attacked states. The results show that SVM has a leading accuracy of 97% using EM side-channel data. Using a machine learning model to demonstrate the applicability of using side-channel analysis to determine whether a device contains an implant, we determined that this is a viable means for detecting whether the device contains a hardware implant.