Time series are a fundamental building block of modern data analysis due to their cost-effectiveness in data collection and versatility in capturing a variety of dynamic phenomena over time. In many applications, the measured proxy variable represents an activity or state of the underlying system of interest. However, high-level information about the system is not directly accessible from raw time series data, which typically consist of sequentially recorded values over time rather than explicit system states. Conducting analysis on time series data often requires identifying the core patterns associated with different possible states. This identification step can enable forecasting, relationship mining, policy verification, or integrity assessment of the system of interest. When a system is neither observable (i.e., its states or activity cannot be accessed at any time) nor controllable (i.e., its states or activity cannot be scheduled), mining key patterns must rely on unsupervised methods. Moreover, when assuming that the system is always in one state, the solution must maximize coverage of the input time series rather than simply returning the best matches. In this paper, we propose a novel approach for mining recurrent patterns from time series, with a focus on maximizing time series coverage. The method first generates a list of candidate patterns and their occurrences using a well-established matrix profile algorithm. Then, a translation layer produces an ensemble of constraints compiled into a model that describes a solution while preventing overlapping occurrences. Finally, a constraint solver generates a solution in the form of a set of core patterns, which are selected based on predefined constraints on the Number of Patterns (NoP) and coverage conditions. We evaluate this approach on a dataset of power consumption time series representing the activity of a computer, as well as synthetic pattern-based time series.

Side channel analysis offers several advantages over traditional machine monitoring methods. The low intrusiveness, independence with the host, data reliability and difficulty to bypass are compelling arguments for using involuntary emissions as input for enforcing security policies. However, side-channel information often comes in the form of unlabeled time series of a proxy variable of the activity. Enabling the definition and enforcement of high-level security policies requires extracting the state or activity of the system from the input data. We present in this paper a novel time series, one-shot pattern locator and classifier called Machine Activity Detector (MAD) specifically designed and evaluated for side-channel analysis. We evaluate MAD in two case studies on a variety of machines and datasets where it outperforms other traditional state detection solutions and presents formidable performances for security rules enforcement. Results of state detection with MAD enable the definition and verification of high-level security rules to detect various attacks without any interaction with the monitored machine.

The current security mechanisms for embedded systems often rely on Intrusion Detection System (IDS) running on the system itself. This provides the detector with relevant internal resources but also exposes it to being bypassed by an attacker. If the host is compromised, its IDS can not be trusted anymore and becomes useless. Power consumption offers an accurate and trusted representation of the system’s state that can be leveraged to verify its integrity during the boot sequence. We present a novel IDS that uses the side-channel power consumption of a target device to protect it against various firmware and hardware attacks. The proposed Boot Process Verifier (BPV) uses a combination of rule-based and machine-learning-based side-channel analysis to monitor and evaluate the integrity of different networking equipment with an overall accuracy of 0,942. The BPV is part of a new layer of cybersecurity mechanisms that leverage the physical emissions of devices for protection.