SBIR Phase I: Hardware-Assisted Security Monitoring for Embedded and Wireless Systems Using Power Fingerprinting

点击翻译按钮获取中文摘要

This Small Business Innovation Research (SBIR) Phase I project aims to demonstrate the technical andcommercial feasibility of a novel approach called Power Fingerprinting (PFP) for integrity assessmentand intrusion detection in critical embedded and wireless systems based on side-channel analysis by anexternal monitor. Such integrity assessment approach is fundamental for protecting criticalsystems from cyber attacks in government agencies, financial institutions, military command,and industrial control. PFP treats cyber security as a signal detection and classification problem andintroduces tangible quantitative metrics for security and trust. Phase I objectives include: (1) demonstratethe feasibility of characterizing kernel modules and core applications for embedded systems; 2) extractbehavioral signatures to improve performance; 3) develop techniques to compensate for variations inpower consumption due to manufacturing and environmental variations; and 4) create a generalarchitecture for the application of PFP. The research will be performed using Angstrom Linux on aBeagleboard embedded platform, from which PFP signatures will be extracted and used to detectmalicious intrusions in blind tests. The expected result is to achieve over 95% accuracy in detectingexecution anomalies during blind tests and provide a baseline to develop a commercial PFP monitorprototype in Phase II.The broader impact/commercial potential of this project includes the development of an innovativemechanism for early detection of cyber attacks to critical infrastructure from well-funded adversaries.Such attacks, if not promptly discovered, that can steal state secrets and intellectual property withdevastating consequences to national security. PFP brings a new perspective to cyber security treating itas a signal detection and classification problem and introducing tangible quantitative metrics for integrityand trust. PFP addresses a growing need to secure critical embedded systems. PFP is very difficult toevade, adds little overhead in the processor being monitored, and is effective against zero-day attacks. Incomparison, traditional cyber security monitoring approaches are susceptible to evasion and ineffectiveagainst new attacks because they depend on known malware signatures. These features make PFP capableof detecting sophisticated covert attacks and rootkits, such as the recent Stuxnet worm. PFP has dualapplication in the commercial and government markets, particularly for resource-constrained andembedded platforms, including smart phones, smart grid, critical industrial control, and tacticalcommunication devices. PFP has the potential to become a fundamental player in cyber-security byprotecting the nation?s infrastructure and promoting further development of the economic base andemployment.