Eddie

Abstract

This paper describes EM-Based Detection of Deviations in Program Execution (EDDIE), a new method for detecting anomalies in program execution, such as malware and other code injections, without introducing any overheads, adding any hardware support, changing any software, or using any resources on the monitored system itself. Monitoring with EDDIE involves receiving electromagnetic (EM) emanations that are emitted as a side effect of execution on the monitored system, and it relies on spikes in the EM spectrum that are produced as a result of periodic (e.g. loop) activity in the monitored execution. During training, EDDIE characterizes normal execution behavior in terms of peaks in the EM spectrum that are observed at various points in the program execution, but it does not need any characterization of the malware or other code that might later be injected. During monitoring, EDDIE identifies peaks in the observed EM spectrum, and compares these peaks to those learned during training. Since EDDIE requires no resources on the monitored machine and no changes to the monitored software, it is especially well suited for security monitoring of embedded and IoT devices. We evaluate EDDIE on a real IoT system and in a cycle-accurate simulator, and find that even relatively brief injected bursts of activity (a few milliseconds) are detected by EDDIE with high accuracy, and that it also accurately detects when even a few instructions are injected into an existing loop within the application.

Efficient Dissimilarity Detection in Time Series With Application to Side-Channel Analysis

“…Similarly, [29] studies control flow monitoring by using a neural network architecture to process EM side-channels. [30] introduces an approach for the detection of anomalies in program execution where malware and code injections are detected based on the spikes in the EM spectrum. [31] also works on malware detection with side-channels where autoencoder based deep learning method is proposed.…”

EMI Architectural Model and Core Hopping

“…As opposed to the publications that show how vulnerable processors are to side channel attacks, some publications use EMI to discern whether or not a process has been modified. For example, EDDIE detects code injections without introducing any overheads or changing the hardware or software [17].…”