Using multiple antennas to characterize a computer system based on electromagnetic signals

1. A method for characterizing a computer system parameter by analyzing a target electromagnetic signal radiating from the computer system, the method comprising:

monitoring the target electromagnetic signal using a first antenna;

monitoring the target electromagnetic signal using a second antenna, wherein an axis of the second antenna is oriented non-parallel to an axis of the first antenna; and

separately analyzing the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna to characterize the computer system parameter.

2. The method of claim 1 , wherein the computer system parameter includes a computer system health metric.

3. The method of claim 1 , wherein:

the first antenna is orthogonal to the second antenna.

4. The method of claim 3 , further comprising:

monitoring the target electromagnetic signal using a third antenna, wherein the third antenna is orthogonal to the first antenna and the second antenna; and

separately analyzing the target electromagnetic signal received from the first antenna, the target electromagnetic signal received from the second antenna, and the target electromagnetic signal received from the third antenna to characterize the computer system parameter.

5. The method of claim 1 , wherein prior to monitoring the target electromagnetic signal using the first antenna and the second antenna, the method further comprises:

monitoring a reference electromagnetic signal radiating from the computer system using a first reference antenna;

monitoring the reference electromagnetic signal using a second reference antenna, wherein an axis of the second reference antenna is oriented non-parallel to an axis of the first reference antenna;

generating a first reference model to characterize the computer system parameter based on the reference electromagnetic signal monitored using the first reference antenna; and

generating a second reference model to characterize the computer system parameter based on the reference electromagnetic signal monitored using the second reference antenna.

6. The method of claim 5 , wherein at least one of the first reference model and the second reference model uses a pattern-recognition technique.

7. The method of claim 5 , wherein at least one of the first reference model and the second reference model uses a multivariate state estimation technique (MSET).

8. The method of claim 5 , wherein:

the first reference antenna includes the first antenna; and

the second reference antenna includes the second antenna.

9. The method of claim 5 , wherein separately analyzing the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna includes:

generating a first target electromagnetic-signal fingerprint from the target electromagnetic signal monitored using the first antenna;

generating a second target electromagnetic-signal fingerprint from the target electromagnetic signal monitored using the second antenna;

feeding the first target electromagnetic-signal fingerprint into the first reference model to characterize the computer system parameter; and

feeding the second target electromagnetic-signal fingerprint into the second reference model to characterize the computer system parameter.

10. The method of claim 9 ,

wherein feeding the first target electromagnetic-signal fingerprint into the first reference model to characterize the computer system parameter includes producing a first estimated electromagnetic-signal fingerprint using the first reference model;

wherein feeding the second target electromagnetic-signal fingerprint into the second reference model to characterize the computer system parameter includes producing a second estimated electromagnetic-signal fingerprint using the second reference model;

wherein separately analyzing the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna to characterize the computer system parameter includes:

comparing the first target electromagnetic-signal fingerprint to the first estimated electromagnetic fingerprint to characterize the computer system parameter; and

comparing the second target electromagnetic-signal fingerprint to the second estimated electromagnetic fingerprint to characterize the computer system parameter.

11. The method of claim 10 , wherein comparing the first target electromagnetic-signal fingerprint to the first estimated electromagnetic fingerprint includes:

for each frequency in a set of frequencies from a frequency-domain representation of the first reference electromagnetic signal,

computing a first residual signal between a corresponding first monitored electromagnetic-signal amplitude-time series in the first target electromagnetic-signal fingerprint and a corresponding first estimated electromagnetic-signal amplitude-time series in the first estimated electromagnetic-signal fingerprint;

detecting anomalies in the first residual signal by using sequential detection, wherein the anomalies indicate a deviation of the first monitored electromagnetic-signal amplitude-time series from the first estimated electromagnetic-signal amplitude-time series;

wherein comparing the second target electromagnetic-signal fingerprint to the second estimated electromagnetic fingerprint includes:

for each frequency in a set of frequencies from a frequency-domain representation of the second reference electromagnetic signal,

computing a second residual signal between a corresponding second monitored electromagnetic-signal amplitude-time series in the second target electromagnetic-signal fingerprint and a corresponding second estimated electromagnetic-signal amplitude-time series in the second estimated electromagnetic-signal fingerprint;

detecting anomalies in the second residual signal by using sequential detection, wherein the anomalies indicate a deviation of the second monitored electromagnetic-signal amplitude-time series from the second estimated electromagnetic-signal amplitude-time series; and

wherein characterizing the computer system parameter includes detecting anomalies in at least one of the first residual signal and the second residual signal.

12. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for characterizing a computer system parameter by analyzing a target electromagnetic signal radiating from the computer system, the method comprising:

monitoring the target electromagnetic signal using a first antenna;

monitoring the target electromagnetic signal using a second antenna, wherein an axis of the second antenna is oriented non-parallel to an axis of the first antenna; and

separately analyzing the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna to characterize the computer system parameter.

13. The computer-readable storage medium of claim 12 , wherein:

the first antenna is orthogonal to the second antenna.

14. The computer-readable storage medium of claim 13 , further comprising:

monitoring the target electromagnetic signal using a third antenna, wherein the third antenna is orthogonal to the first antenna and the second antenna; and

separately analyzing the target electromagnetic signal received from the first antenna, the target electromagnetic signal received from the second antenna, and the target electromagnetic signal received from the third antenna to characterize the computer system parameter.

15. The computer-readable storage medium of claim 12 , wherein prior to monitoring the target electromagnetic signal using the first antenna and the second antenna, the method further comprises:

monitoring a reference electromagnetic signal radiating from the computer system using a first reference antenna; and

monitoring the reference electromagnetic signal using a second reference antenna, wherein an axis of the second reference antenna is oriented non-parallel to an axis of the first reference antenna;

generating a first reference model to characterize the computer system parameter based on the reference electromagnetic signal monitored using the first reference antenna; and

generating a second reference model to characterize the computer system parameter based on the reference electromagnetic signal monitored using the second reference antenna.

16. The computer-readable storage medium of claim 15 , wherein:

the first reference antenna includes the first antenna; and

the second reference antenna includes the second antenna.

17. The computer-readable storage medium of claim 15 , wherein separately analyzing the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna includes:

generating a first target electromagnetic-signal fingerprint from the target electromagnetic signal monitored using the first antenna;

generating a second target electromagnetic-signal fingerprint from the target electromagnetic signal monitored using the second antenna;

feeding the first target electromagnetic-signal fingerprint into the first reference model to characterize the computer system parameter; and

feeding the second target electromagnetic-signal fingerprint into the second reference model to characterize the computer system parameter.

18. The computer-readable storage medium of claim 17 ,

wherein feeding the first target electromagnetic-signal fingerprint into the first reference model to characterize the computer system parameter includes producing a first estimated electromagnetic-signal fingerprint using the first reference model;

wherein feeding the second target electromagnetic-signal fingerprint into the second reference model to characterize the computer system parameter includes producing a second estimated electromagnetic-signal fingerprint using the second reference model;

wherein separately analyzing the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna to characterize the computer system parameter includes:

comparing the first target electromagnetic-signal fingerprint to the first estimated electromagnetic fingerprint to characterize the computer system parameter; and

comparing the second target electromagnetic-signal fingerprint to the second estimated electromagnetic fingerprint to characterize the computer system parameter.

19. The computer-readable storage medium of claim 18 , wherein comparing the first target electromagnetic-signal fingerprint to the first estimated electromagnetic fingerprint includes:

for each frequency in a set of frequencies from a frequency-domain representation of the first reference electromagnetic signal,

computing a first residual signal between a corresponding first monitored electromagnetic-signal amplitude-time series in the first target electromagnetic-signal fingerprint and a corresponding first estimated electromagnetic-signal amplitude-time series in the first estimated electromagnetic-signal fingerprint;

detecting anomalies in the first residual signal by using sequential detection, wherein the anomalies indicate a deviation of the first monitored electromagnetic-signal amplitude-time series from the first estimated electromagnetic-signal amplitude-time series;

wherein comparing the second target electromagnetic-signal fingerprint to the second estimated electromagnetic fingerprint includes:

for each frequency in a set of frequencies from a frequency-domain representation of the second reference electromagnetic signal,

computing a second residual signal between a corresponding second monitored electromagnetic-signal amplitude-time series in the second target electromagnetic-signal fingerprint and a corresponding second estimated electromagnetic-signal amplitude-time series in the second estimated electromagnetic-signal fingerprint;

detecting anomalies in the second residual signal by using sequential detection, wherein the anomalies indicate a deviation of the second monitored electromagnetic-signal amplitude-time series from the second estimated electromagnetic-signal amplitude-time series; and

wherein characterizing the computer system parameter includes detecting anomalies in at least one of the first residual signal and the second residual signal.

20. An apparatus that characterizes a computer system parameter by analyzing a target electromagnetic signal radiating from the computer system, the apparatus comprising:

a monitoring mechanism configured to monitor the target electromagnetic signal using a first antenna and a second antenna, wherein an axis of the second antenna is oriented non-parallel to an axis of the first antenna; and

an analyzing mechanism configured to separately analyze the target electromagnetic signal received from the first antenna and the target electromagnetic signal received from the second antenna to characterize the computer system parameter.