Malware Detection Using Power Consumption and Network Traffic Data

Jiménez, Jarilyn Hernández; Goševa-Popstojanova, Katerina

doi:10.1109/icdis.2019.00016

Cited by 11 publications

(3 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [91], ML classifiers are trained and validated by data acquired from hardware performance counters (HPCs). A side-channel malware detection method that utilizes CPU power consumption data [92] is another example of M-ID1. M-ID2 detects a hidden backdoor.…”

Section: B Malware Defense (Attacks #2-#6)mentioning

confidence: 99%

An Overview of Cyber-Resilient Smart Inverters Based on Practical Attack Models

Ahn,

Kim,

Ahmad

et al. 2024

IEEE Trans. Power Electron.

View full text Add to dashboard Cite

With high penetration of distributed energy resources (DERs), power systems are increasingly transforming into distributed power grids, which provide grid automation, decarbonization, and decentralization of critical assets. Smart inverters are key power-electronic devices that connect renewable energy and energy storage equipment to power grids. DER includes several intelligent grid functions, such as fault ride through, grid-voltage support, and reactive-power compensation, typically with real-time remote access, data exchange, and seamless over-the-air firmware updates in a cyber-physical environment. However, cybersecurity concerns arise due to extensive information exchange among DER and multiple stakeholders (e.g., utilities, aggregators, vendors, operators, and owners). Therefore, smart inverters account for a growing attack surface for the power grid. This article reviews the cybersecurity best practices and current recommendations for smart inverters and explores emerging cyber threats for smart inverters, including malware attacks and hardware attacks. Finally, we propose a new smart inverter security and resilience framework for developing cyber-resilient smart inverters against the advanced/future threat actors. This article establishes a resilience-by-design baseline reference for smart inverter cybersecurity teams, which bridges the gap between cybersecurity and power-electronics' communities.

show abstract

Section: B Malware Defense (Attacks #2-#6)mentioning

confidence: 99%

An Overview of Cyber-Resilient Smart Inverters Based on Practical Attack Models

Ahn,

Kim,

Ahmad

et al. 2024

IEEE Trans. Power Electron.

View full text Add to dashboard Cite

show abstract

“…It was shown that differences in the power consumption profiles of a mobile phone might be used to identify the currently used application [ 3 ]. The performance may be further improved when power consumption profiling is performed together with network traffic data analysis [ 4 ].…”

Section: Introductionmentioning

confidence: 99%

Passive Fingerprinting of Same-Model Electrical Devices by Current Consumption

Ronkin

Bykhovsky

2023

Sensors

View full text Add to dashboard Cite

One possible device authentication method is based on device fingerprints, such as software- or hardware-based unique characteristics. In this paper, we propose a fingerprinting technique based on passive externally measured information, i.e., current consumption from the electrical network. The key insight is that small hardware discrepancies naturally exist even between same-electrical-circuit devices, making it feasible to identify slight variations in the consumed current under steady-state conditions. An experimental database of current consumption signals of two similar groups containing 20 same-model computer displays was collected. The resulting signals were classified using various state-of-the-art time-series classification (TSC) methods. We successfully identified 40 similar (same-model) electrical devices with about 94% precision, while most errors were concentrated in confusion between a small number of devices. A simplified empirical wavelet transform (EWT) paired with a linear discriminant analysis (LDA) classifier was shown to be the recommended classification method.

show abstract

“…Their data was collected from the computer processor power consumption with sample period of five minutes, then various machine learning algorithm were used and tested the method on more than one operating system to ensure that it will have high accuracy. An experiment conducted by Jimenez et al [ 6 ] focused on collecting the power consumption data of the computer processing unit with the network data. They then used ten machine learning techniques to analyze and classify if a computer was infected or not.…”

Section: Introductionmentioning

confidence: 99%

Detection of Potentially Compromised Computer Nodes and Clusters Connected on a Smart Grid, Using Power Consumption Data

Almshari

Tsaramirsis

Khadidos

et al. 2020

Sensors

View full text Add to dashboard Cite

Monitoring what application or type of applications running on a computer or a cluster without violating the privacy of the users can be challenging, especially when we may not have operator access to these devices, or specialized software. Smart grids and Internet of things (IoT) devices can provide power consumption data of connected individual devices or groups. This research will attempt to provide insides on what applications are running based on the power consumption of the machines and clusters. It is therefore assumed that there is a correlation between electric power and what software application is running. Additionally, it is believed that it is possible to create power consumption profiles for various software applications and even normal and abnormal behavior (e.g., a virus). In order to achieve this, an experiment was organized for the purpose of collecting 48 h of continuous real power consumption data from two PCs that were part of a university computer lab. That included collecting data with a one-second sample period, during class as well as idle time from each machine and their cluster. During the second half of the recording period, one of the machines was infected with a custom-made virus, allowing comparison between power consumption data before and after infection. The data were analyzed using different approaches: descriptive analysis, F-Test of two samples of variance, two-way analysis of variance (ANOVA) and autoregressive integrated moving average (ARIMA). The results show that it is possible to detect what type of application is running and if an individual machine or its cluster are infected. Additionally, we can conclude if the lab is used or not, making this research an ideal management tool for administrators.

show abstract

Malware Detection Using Power Consumption and Network Traffic Data

Cited by 11 publications

References 22 publications

An Overview of Cyber-Resilient Smart Inverters Based on Practical Attack Models

An Overview of Cyber-Resilient Smart Inverters Based on Practical Attack Models

Passive Fingerprinting of Same-Model Electrical Devices by Current Consumption

Detection of Potentially Compromised Computer Nodes and Clusters Connected on a Smart Grid, Using Power Consumption Data

Contact Info

Product

Resources

About