Power-based side-channel instruction-level disassembler

ABSTRACT

Modern embedded computing devices are vulnerable against malware and software piracy due to insufficient security scrutiny and the complications of continuous patching. To detect malicious activity as well as protecting the integrity of executable software, it is necessary to monitor the operation of such devices. In this paper, we propose a disassembler based on power-based side-channel to analyze the real-time operation of embedded systems at instruction-level granularity. The proposed disassembler obtains templates from an original device (e.g., IoT home security system, smart thermostat, etc.) and utilizes machine learning algorithms to uniquely identify instructions executed on the device. The feature selection using Kullback-Leibler (KL) divergence and the dimensional reduction using PCA in the time-frequency domain are proposed to increase the identification accuracy. Moreover, a hierarchical classification framework is proposed to reduce the computational complexity associated with large instruction sets. In addition, covariate shifts caused by different environmental measurements and device-to-device variations are minimized by our covariate shift adaptation technique. We implement this disassembler on an AVR 8-bit microcontroller. Experimental results demonstrate that our proposed disassembler can recognize test instructions including register names with a success rate no lower than 99.03% with quadratic discriminant analysis (QDA).

References

1. Dakshi Agrawal, Josyula R. Rao, and Pankaj Rohatgi. 2003. Multi-channel Attacks. Springer Berlin Heidelberg, Berlin, Heidelberg, 2--16.
2. Waqas Amir. 2016. Hackers are increasingly targeting IoT Devices with Mirai DDoS Malware. https://www.hackread.com/iot-devices-with-mirai-ddos-malware/. (Oct. 2016).
3. Gerardo Canfora, Massimiliano Di Penta, and Luigi Cerulo. 2011. Achievements and Challenges in Software Reverse Engineering. Commun. ACM 54, 4 (April 2011), 142--151.
4. Chih-Chung Chang and Chih-Jen Lin. 2011. LIBSVM: A Library for Support Vector Machines. ACM Trans. Intell. Syst. Technol. 2, 3, Article 27 (May 2011), 27 pages.
5. Omar Choudary and Markus G. Kuhn. 2014. Template Attacks on Different Devices. Springer International Publishing, Cham, 179--198.
6. Teodoro Cipresso and Mark Stamp. 2010. Software Reverse Engineering. Springer Berlin Heidelberg, Berlin, Heidelberg, 659--696.
7. Leon Cohen. 1995. Time-frequency Analysis: Theory and Applications. Prentice-Hall, Inc., Upper Saddle River, NJ, USA.
8. Nicolas Debande, Youssef Souissi, M. Abdelaziz El Aabid, Sylvain Guilley, and Jean-Luc Danger. 2012. Wavelet Transform Based Pre-processing for Side Channel Analysis. In Proceedings of the 2012 45th Annual IEEE/ACM International Symposium on Microarchitecture Workshops (MICROW '12). 32--38.
9. Thomas Eisenbarth, Christof Paar, and BjÃűrn Weghenkel. 2010. Building a Side Channel Based Disassembler. In Transactions on Computational Science X, Marina L. Gavrilova, C.J. Kenneth Tan, and Edward David Moreno (Eds.). Lecture Notes in Computer Science, Vol. 6340. Springer Berlin Heidelberg, 78--99.
10. Jake Longo Galea, Elke De Mulder, Daniel Page, and Michael Tunstall. 2015. SoC it to EM: electromagnetic side-channel attacks on a complex system-on-chip. IACR Cryptology ePrint Archive 2015 (2015), 561.
11. Michael Henson and Stephen Taylor. 2014. Memory Encryption: A Survey of Existing Techniques. ACM Comput. Surv. 46, 4, Article 53 (March 2014), 26 pages.
12. Atmel Inc. 2016. AVR Instruction set manual. (2016). http://www.atmel.com/images/Atmel-0856-AVR-Instruction-Set-Manual.pdf
13. Paul Kocher, Joshua Jaffe, and Benjamin Jun. 1999. Differential Power Analysis. Springer-Verlag, 388--397.
14. Stefan Mangard, Elisabeth Oswald, and Thomas Popp. 2007. Power Analysis Attacks: Revealing the Secrets of Smart Cards (Advances in Information Security). Springer-Verlag New York, Inc., Secaucus, NJ, USA.
15. Muhammad Ali Mazidi, Sarmad Naimi, and Sepehr Naimi. 2010. AVR Microcontroller and Embedded Systems: Using Assembly and C (1st ed.). Prentice Hall Press, Upper Saddle River, NJ, USA.
16. David McCann, Carolyn Whitnall, and Elisabeth Oswald. 2016. ELMO: Emulating Leaks for the ARM Cortex-M0 without Access to a Side Channel Lab. Cryptology ePrint Archive, Report 2016/517. (2016).
17. Amir Moradi, David Oswald, Christof Paar, and Pawel Swierczynski. 2013. Side-channel Attacks on the Bitstream Encryption Mechanism of Altera Stratix II: Facilitating Black-box Analysis Using Software Reverse-engineering. In Proceedings of the ACM/SIGDA International Symposium on Field Programmable Gate Arrays (FPGA '13). 91--100.
18. Mehari Msgna, Konstantinos Markantonakis, and Keith Mayes. 2014. Precise Instruction-Level Side Channel Profiling of Embedded Processors.
19. M. Ozsoy, K. N. Khasawneh, C. Donovick, I. Gorelik, N. Abu-Ghazaleh, and D. Ponomarev. 2016. Hardware-Based Malware Detection Using Low-Level Architectural Features. IEEE Trans. Comput. 65, 11 (2016), 3332--3344.
20. Jungmin Park and Akhilesh Tyagi. 2016. Security Metrics for Power Based SCA Resistant Hardware Implementation. In 29th International Conference on VLSI Design and 15th International Conference on Embedded Systems, VLSID 2016, Kolkata, India, January 4-8, 2016. IEEE Computer Society, 541--546.
21. Emmanuel Prouff and Matthieu Rivain. 2007. A Generic Method for Secure SBox Implementation. Springer Berlin Heidelberg, Berlin, Heidelberg, 227--244.
22. S. Kullback and R. A. Leibler. 1951. On Information and Sufficiency. The Annals of Mathematical Statistics 22, 1 (1951), 79--86.
23. Daehyun Strobel, Florian Bache, David Oswald, Falk Schellenberg, and Christof Paar. 2015. Scandalee: a side-channel-based disassembler using local electromagnetic emanations. In Proceedings of the 2015 Design, Automation & Test in Europe Conference & Exhibition, DATE 2015, Grenoble, France, March 9-13, 2015. 139--144.
24. Masashi Sugiyama and Motoaki Kawanabe. 2012. Machine Learning in Non-Stationary Environments: Introduction to Covariate Shift Adaptation. The MIT Press.