Remote Detection of Unauthorized Activity via Spectral Analysis

Abstract

Unauthorized hardware or firmware modifications, known as trojans, can steal information, drain the battery, or damage IoT devices. Since trojans may be triggered in the field at an unknown instance, it is important to detect their presence at runtime. However, it is difficult to run sophisticated detection algorithms on these devices due to limited computational power and energy and, in some cases, lack of accessibility. This article presents a stand-off self-referencing technique for detecting unauthorized activity. The proposed technique processes involuntary electromagnetic emissions on a separate hardware, which is physically decoupled from the device under test. When the device enters the test mode , a predefined test application is run on the device repetitively for a known period. The periodicity ensures that the spectral electromagnetic power of the test application concentrates at known frequencies, leaving the remaining frequencies within the operating bandwidth at the noise level. Any deviations from the noise level for these unoccupied frequency locations indicate the presence of unknown (unauthorized) activity. Hence, we are able to differentiate trojan activity without using a golden reference , or any knowledge of the attributes of the trojan activity. Experiments based on hardware measurements show that the proposed technique achieves close to 100% detection accuracy at up to 120cm distance.

Malicious Activity Detection in Lightweight Wearable and IoT Devices Using Signal Stitching

“…We achieve this by generating a test sequence such that the signal (i.e., the response of the device) has spectral properties that can be differentiated from the Trojan activity. We can denote the measured power as follows: where is the sinusoidal power consumption of the primary circuit, denotes the error that we make in setting up the sine wave, is random noise, and is the power consumption of the Trojan circuit [ 2 , 47 , 48 ]. The power spectrum of the primary signal, i.e., is concentrated in one frequency location.…”