Systems, methods, and apparatuses for intrusion detection and analytics using power characteristics such as side-channel information collection
Some embodiments described herein include a system that collects and learns reference side-channel normal activity, process it to reveal key features, compares subsequent collected data and processed data for anomalous behavior, and reports such behavior to a management center where this information is displayed and predefine actions can be executed when anomalous behavior is observed. In some instances, a physical side channel (e.g. and indirect measure of program execution such as power consumption or electromagnetic emissions and other physical signals) can be used to assess the execution status in a processor or digital circuit using an external monitor and detect, with extreme accuracy, when an unauthorized execution has managed to disrupt the normal operation of a target system (e.g., a computer system, etc.).
1. An apparatus, comprising:
a circuit anomaly detector configured to monitor a side-channel output from a target circuit chip over a plurality of times to define a time-related performance of the target device, the circuit anomaly detector configured to detect an anomaly at the target device to define a detected anomaly based on at least one of (1) the time-related performance of the target device, or (2) the time-related performance of the target device and a time-related performance of a plurality of devices similar to or common as the target device; and
a notification processor communicatively coupled to the circuit anomaly detector, the notification processor configured to send a notification message to a device designated to respond to the detected anomaly,
the plurality of times includes a time of an initial manufacture of the target circuit chip, a time the target circuit chip is installed on a printed circuit board assembly (PCBA), and a time the PCBA is installed in a device.
2. The apparatus of claim 1 , wherein the plurality of times includes a time associated with a use of the target circuit chip.
3. The apparatus of claim 1 , wherein:
the target circuit chip is reprogrammable,
the plurality of times including a first time associated with a first reprogrammable state of the target circuit chip and a second time different than the first time and associated with a second reprogrammable state of the target circuit chip different than the first reprogrammable state.
4. The apparatus of claim 1 , wherein the plurality of times are for an operational period of the target circuit chip that is at least a day long.
5. The apparatus of claim 1 , wherein:
a statistical reference model is based on at least one of the time-related performance of the target device or the time-related performance of the plurality of devices similar to or common as the target device; and
the circuit anomaly detector is configured to detect the anomaly of the target device based on the statistical reference model.
6. An apparatus, comprising:
a circuit anomaly detector configured to monitor a side-channel output from a target circuit chip over a plurality of times to define a time-related performance of the target device, the circuit anomaly detector configured to detect an anomaly at the target device to define a detected anomaly based on at least one of (1) the time-related performance of the target device, or (2) the time-related performance of the target device and a time-related performance of a plurality of devices similar to or common as the target device; and
a notification processor communicatively coupled to the circuit anomaly detector, the notification processor configured to send a notification message to a device designated to respond to the detected anomaly,
the plurality of times includes a time of an initial manufacture of the target circuit chip, a time of a use of the target circuit chip, and a time that the target circuit chip is no longer in use.
7. A method, comprising:
sending a first signal to a plurality of devices that are common in device type, each device from the plurality of devices having a detector configured to detect a side-channel information from that device during operation;
receiving, from each device from the plurality of devices and after that device receives the first signal to that device, a second signal that represents side-channel information from that device;
defining, using unsupervised learning, a baseline for the device type of the plurality of devices based on the side-channel information for each device from the plurality of devices;
updating a database with the baseline for the device type of the plurality of devices, the database including a plurality of baselines including the baselines, each baseline from the plurality of baselines being for a device type from a plurality of device types;
detecting an anomaly at a device of the device type based on the baseline for the device type; and
sending a notification of the anomaly in response to detecting the anomaly.
8. The method of claim 7 , wherein:
the device is a first device,
the receiving and the defining are performed at a second device, the plurality of devices at locations remote from the device.
9. The method of claim 7 , wherein:
for each device from the plurality of devices, the first signal is a request for signal-channel information for that device,
for each device from the plurality of devices, the second signal for that device is a response to the request for that device.
10. The method of claim 7 , wherein:
for each device from the plurality of devices, the second signal for that device is pushed from that device at a time different from a time that the second signal for another device from the plurality of devices was pushed.
11. The method of claim 7 , wherein:
for each device from the plurality of devices, the database includes at least one of an indicator of a code executed by that device during the generation of the side-channel information, or an indicator of a temperature of that device during generation of the side-channel information.
12. The method of claim 7 , wherein:
for each device from the plurality of devices, the database includes at least one of a model number of that device, a date of manufacture of that device, or a distributor of that device.