Systems and methods for runtime program monitoring through analysis of side channel signals

1. A method comprising:

receiving a signal emanated from a monitored device; and

responsive to receiving the signal, performing, based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, signal processing on the signal;

wherein the signal processing comprises multi-hypothesis testing with a trellis search; and

wherein the multi-hypothesis testing comprises:

selecting likely software blocks executed by the monitored device based on a current software trace;

calculating, based on the HW/SW interaction model, distance metrics between the signal and expected one or more signals produced by the monitored device by executing the selected software blocks;

calculating, based on the calculated distance metrics, probabilities of matches with the selected software blocks; and

performing multi-hypothesis matching to update the current software trace to include one or more predicted software blocks of the likely software blocks.

2. The method of claim 1 , wherein the multi-hypothesis testing further comprises performing trace-event alignment on the signal to account for recognized events.

3. The method of claim 1 further comprising determining, in response to detecting an interrupt within a predicted software block for which interrupts are not allowed by the monitored system, that an anomaly exists.

4. The method of claim 1 further comprising determining, in response to detecting a cache miss within a predicted software block for which a cache miss cannot occur at that point in the software block, that an anomaly exists.

5. The method of claim 1 further comprising:

detecting either statistics or patterns of detected interrupts within a predicted software block over one or more occurrences;

performing, respectively, either a statistical test or a pattern matching algorithm on the detected statistics or patterns of the detected interrupts to determine a likelihood of a valid execution of the software block; and

determining, in response to performing either the statistical test or pattern matching algorithm whether an anomaly exists.

6. The method of claim 1 further comprising:

detecting either statistics or patterns of detected cache misses within a predicted software block over one or more occurrences;

performing, respectively, either a statistical test or a pattern matching algorithm on the detected statistics or patterns of the detected cache misses to determine a likelihood of a valid execution of the software block; and

determining, in response to performing either the statistical test or pattern matching algorithm whether an anomaly exists.

7. A monitoring system comprising:

a memory; and

at least one processor configured to implement:

a monitor configured to receive one or more signals emanated from a monitored device;

an analyzer configured to:

signal process by multi-hypothesis testing with a trellis search, and based on a software model and a hardware-software (HW/SW) interaction model of the monitored device, one or more of the signals; and

determine, based on the signal processing, the likelihood that the monitored device is compromised;

wherein the multi-hypothesis testing comprises:

selecting likely software blocks executed by the monitored device based on a current software trace;

calculating, based on the HW/SW interaction model, distance metrics between the signal and expected one or more signals produced by the monitored device by executing the selected software blocks;

calculating, based on the calculated distance metrics, probabilities of matches with the selected software blocks; and

performing multi-hypothesis matching to update the current software trace to include one or more predicted software blocks of the likely software blocks.

8. The monitoring system of claim 7 , wherein:

the monitor is further configured to perform spectral monitoring on one or more of the signals to identify potential anomalies in one or more portions of one or more of the signals; and

the analyzer is further configured to signal process, responsive to the monitor identifying a potential anomaly and based on the software model and the HW/SW interaction model of the monitored device, the one or more portions of one or more of the signals having the identified potential anomaly.

9. The monitoring system of claim 7 , wherein:

the at least one processor is further configured to implement a verifier;

the analyzer is further configured to:

match one or more of the signals to program code executed by the monitored device; and

forward statistics of a signal indicative of the likelihood that the monitored device is compromised to the verifier; and

the verifier is configured to determine, by distinguishing an anomaly based on the statistics collected over multiple instances of one or more of the signals being matched to the same program code executed by the monitored device, that an anomaly exists and that the monitored device is compromised.

10. The monitoring system of claim 7 , wherein the software model is developed based on static analysis of program code executed by the monitored device and observed signals obtained from dynamic analyses of the monitored system.

11. The monitoring system of claim 7 , wherein:

one or more of the signals are separated into at least one sub-channel, and

the monitor is further configured to buffer the at least one sub-channel in real-time.

12. The monitoring system of claim 7 further comprising at least one electro-magnetic sensor configured to detect one or more of the signals emanated from the monitored device;

wherein the monitor is further configured to:

perform, on the detected one or more signals, at least one of location identification of the detected one or more signals, beam forming, and interference cancellation to create enhanced signals; and

separate the enhanced signals into at least one sub-channel.

13. The monitoring system of claim 7 , wherein the multi-hypothesis testing further comprises performing trace-event alignment on one or more of the signals to account for recognized events.

14. The monitoring system of claim 7 , wherein the analyzer is further configured to determine, in response to detecting an interrupt within a predicted software block for which interrupts are not allowed by the monitored system, that an anomaly exists.

15. The monitoring system of claim 7 , wherein the analyzer is further configured to determine, in response to detecting a cache miss within a predicted software block for which a cache miss cannot occur at that point in the software block, that an anomaly exists.

16. A method comprising:

storing a set of predicted computational activities reflective of a processing activity of a monitored device that is uncompromised;

wirelessly receiving signals emanating from the monitored device, the signals reflective of a set of actual computational activities of the monitored device during the processing activity; and

determining the likelihood that the monitored device is compromised by evaluating variance between the set of predicted computational activities to the set of actual computational activities;

wherein the set of predicted computational activities is provided by a software model and a hardware-software (HW/SW) interaction model of the monitored device;

wherein the processing activity comprises executed software blocks; and

wherein determining the likelihood that the monitored device is compromised comprises multi-hypothesis testing comprising:

selecting software blocks executed by the monitored device based on a current software trace;

calculating, based on the HW/SW interaction model, distance metrics between the received signals and signals reflective of the set of predicted computational activities of the monitored device that is uncompromised; and

calculating, based on the calculated distance metrics, probabilities of matches with the selected software blocks.

17. The method of claim 16 , wherein the multi-hypothesis testing further comprises:

performing multi-hypothesis matching to update the current software trace to include one or more predicted software blocks; and

determining, based on the multi-hypothesis matching, the likelihood that the monitored device is compromised.