Utilizing electromagnetic emanations for out-of-band detection of unknown attack code in a programmable logic controller

Nathaniel Boggs; Jimmy C. Chau; Ang Cui

doi:10.1117/12.2304465

3 May 2018 Utilizing electromagnetic emanations for out-of-band detection of unknown attack code in a programmable logic controller

Nathaniel Boggs, Jimmy C. Chau, Ang Cui

Author Affiliations +

Proceedings Volume 10630, Cyber Sensing 2018; 106300D (2018) https://doi.org/10.1117/12.2304465
Event: SPIE Defense + Security, 2018, Orlando, FL, United States

Abstract

We propose using out-of-band emanations from embedded devices in order to detect malicious code execution. We passively monitor involuntary electromagnetic (EM) emissions from embedded devices to find and detect new signals. We demonstrate the efficacy and feasibility of an EM emanation based anomaly detection system using commercial off-the-shelf (COTS) software defined radio (SDR) hardware to detect code execution on an industrial control system (the Allen-Bradley 1756-EWEB module). We have developed a fully automated training and testing framework for this anomaly detection system. In this paper, we describe the system architecture, the cliff-detection algorithm used to process the received emanations, the testing setup and procedures, and our results. When trained on one set of EWEB modules and tested on a separate set, we present an experimental prototype capable of detecting unknown (attack) code execution with 98% accuracy at 100% detection rate. We present data supporting the robustness of these results across 16 physical device instances and with training recordings taken months apart from testing recordings.

Conference Presentation

Citation Download Citation

Nathaniel Boggs, Jimmy C. Chau, and Ang Cui "Utilizing electromagnetic emanations for out-of-band detection of unknown attack code in a programmable logic controller", Proc. SPIE 10630, Cyber Sensing 2018, 106300D (3 May 2018); https://doi.org/10.1117/12.2304465

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available