Leveraging side-channels enables zero-overhead detection of anomalies. These channels offer a non-instrumented program profiling capability by means of the distinct signatures generated by processing unintentional signals emitted during executions. In this paper, we propose a Markov based convolutional neural network (CNN) to monitor programs against anomalies on multi-core devices. We refer to the proposed framework as MarCNNet. In the model, the output of the CNN estimates the likelihood of the current state of the program, and the Markov Model tracks the process based on these estimates. If the estimates do not match the Markov model state diagram, it alerts anomaly, otherwise, it keeps monitoring. The framework also simplifies the training process because dependency among states is crucial for the Markov part of the model, but not for the CNN. Therefore, the neural network is trained by treating each state independent. However, for a test signal, both CNN and Markov parts of the framework are considered for malware detection to utilize the program flow. We tested the proposed model for various devices with different number of cores and threads of processes and demonstrated that the framework can detect malware with no false negatives, and a false positive rate less than 2%.

The emergence of cyber-physical systems (CPS) and internet of things (IoT) devices impose significant security and privacy concerns that necessitate robust monitoring and malware detection systems. This paper proposes PITEM, a framework for instruction-level monitoring and malware detection using electromagnetic (EM) side-channels. PITEM identifiesinstruction typeswith similar EM emanations using hierarchical clustering. To track all combinations of theseinstruction types, we generate EM signatures for all permutations of them. In testing, we predict the permutation class of testing traces by a matched-filter-like predictor. We test the performance on two devices (FPGA-based and ARM-based) with 50 MHz and 1 GHz clock frequencies. We achieve 95.67 and 87.35 percent accuracies for these devices for single execution of permutations. We note that the accuracy increases to 100 percent when permutation blocks are repeated. Furthermore, we test the limits of the system by tracking permutations of instructions of the same type. With sufficient bandwidth and number of repetitions, individual instructions can be resolved with 87.5 and 95.78 percent accuracies for these devices. The performance is evaluated for different relative signal-to-noise ratio (SNR) levels and performance is stable for relative SNR values$>15$>15dB. Finally, we demonstrate PITEM's ability to detectfine-grainedmalware with 99.89 percent accuracy.

In this paper, we propose a methodology to identify both the brand of a cell-phone, and the status of its camera by exploiting electromagnetic (EM) emanations. The method is composed of two parts: Feature extraction and Convolutional Neural Network (CNN). We first extract features by averaging magnitudes of short-time Fourier transform (STFT) of the measured EM signal, which helps to reduce input dimension of the neural network, and to filter spurious emissions. The extracted features are fed into the proposed CNN, which contains two convolutional layers (followed by max-pooling layers), and four fully-connected layers. Finally, we provide experimental results which exhibit more than 99% classification accuracy for the test signals.