SBIR Phase I: Hardware-Assisted Security Monitoring for Embedded and Wireless Systems Using Power Fingerprinting

这个小企业创新研究（SBIR）第一阶段项目的目的是证明一种新的方法，称为功率指纹（PFP）的完整性评估和入侵检测在关键的嵌入式和无线系统的基础上，通过外部监视器的侧信道分析的技术和商业可行性。这种完整性评估方法对于保护政府机构、金融机构、军事指挥和工业控制中的关键系统免受网络攻击至关重要。PFP将网络安全视为信号检测和分类问题，并引入了安全和信任的有形量化指标。第一阶段的目标包括：（1）论证了表征嵌入式系统内核模块和核心应用程序的可行性; 2）提取行为特征以提高性能; 3）开发技术以补偿由于制造和环境变化而引起的功耗变化; 4）为PFP的应用创建通用架构。该研究将在Beagleboard嵌入式平台上使用Angstrom Linux进行，从中提取PFP签名并用于盲测试中检测恶意入侵。预期的结果是在盲测期间检测执行异常的准确率达到95%以上，并为第二阶段开发商业PFP监控器原型提供基准。该项目更广泛的影响/商业潜力包括开发一种创新机制，用于早期检测资金充足的对手对关键基础设施的网络攻击。此类攻击如果不能及时发现，可以窃取国家机密和知识产权，对国家安全造成毁灭性后果。PFP为网络安全带来了一个新的视角，将其视为信号检测和分类问题，并为完整性和信任引入了有形的量化指标。PFP解决了日益增长的保护关键嵌入式系统的需求。PFP很难规避，在被监视的处理器中增加很少的开销，并且对零日攻击有效。相比之下，传统的网络安全监控方法容易被规避，并且对新的攻击无效，因为它们依赖于已知的恶意软件签名。这些特性使得PFP能够检测复杂的隐蔽攻击和rootkit，例如最近的Stuxnet蠕虫。PFP在商业和政府市场具有双重应用，特别是对于资源受限和嵌入式平台，包括智能手机，智能电网，关键工业控制和战术通信设备。PFP有潜力通过保护国家而成为网络安全的基本参与者？的基础设施和促进经济基础和就业的进一步发展。

This Small Business Innovation Research (SBIR) Phase I project aims to demonstrate the technical andcommercial feasibility of a novel approach called Power Fingerprinting (PFP) for integrity assessmentand intrusion detection in critical embedded and wireless systems based on side-channel analysis by anexternal monitor. Such integrity assessment approach is fundamental for protecting criticalsystems from cyber attacks in government agencies, financial institutions, military command,and industrial control. PFP treats cyber security as a signal detection and classification problem andintroduces tangible quantitative metrics for security and trust. Phase I objectives include: (1) demonstratethe feasibility of characterizing kernel modules and core applications for embedded systems; 2) extractbehavioral signatures to improve performance; 3) develop techniques to compensate for variations inpower consumption due to manufacturing and environmental variations; and 4) create a generalarchitecture for the application of PFP. The research will be performed using Angstrom Linux on aBeagleboard embedded platform, from which PFP signatures will be extracted and used to detectmalicious intrusions in blind tests. The expected result is to achieve over 95% accuracy in detectingexecution anomalies during blind tests and provide a baseline to develop a commercial PFP monitorprototype in Phase II.The broader impact/commercial potential of this project includes the development of an innovativemechanism for early detection of cyber attacks to critical infrastructure from well-funded adversaries.Such attacks, if not promptly discovered, that can steal state secrets and intellectual property withdevastating consequences to national security. PFP brings a new perspective to cyber security treating itas a signal detection and classification problem and introducing tangible quantitative metrics for integrityand trust. PFP addresses a growing need to secure critical embedded systems. PFP is very difficult toevade, adds little overhead in the processor being monitored, and is effective against zero-day attacks. Incomparison, traditional cyber security monitoring approaches are susceptible to evasion and ineffectiveagainst new attacks because they depend on known malware signatures. These features make PFP capableof detecting sophisticated covert attacks and rootkits, such as the recent Stuxnet worm. PFP has dualapplication in the commercial and government markets, particularly for resource-constrained andembedded platforms, including smart phones, smart grid, critical industrial control, and tacticalcommunication devices. PFP has the potential to become a fundamental player in cyber-security byprotecting the nation?s infrastructure and promoting further development of the economic base andemployment.