Embedded systems are evolving in complexity, leading to the emergence of multiple threats. The co-design and execution of software on the embedded systems further exacerbate the attack surface, making them more vulnerable to sophisticated attacks. As embedded systems are used in critical areas, ensuring their security is crucial. In this special session paper, primarily four major topics regarding embedded systems’ security are discussed. Firstly, this paper initially explores timing channel analysis at a microarchitectural level in heterogeneous hardware to address the security challenges. It then delves into exploring software-based fuzzing techniques to detect vulnerabilities and enhance embedded system security. Additionally, the paper discusses strategies for improving security in IoT devices with a layered defense strategy known as Snowflake IoT. Finally, it examines approaches to securing large and complex monolithic systems. The challenges and opportunities for securing the embedded systems according to the scale and type of attacks.

The next-generation wireless networks operating in the Terahertz (THz) band have the potential to satisfy the diverse demands of their always-connected devices. Recent advances in device electronics and antenna design in the THz band herald the massive deployment of millimeter-scale Internet-of-Things (IoT) that often have limited battery capacity due to physical constraints. Consequently, the potential employment of simultaneous wireless information and power transfer (SWIPT) in the THz band emerges as a transformative paradigm shift, albeit complicated by challenges like molecular absorption loss and spectrum-efficient waveform design. In this paper, we demonstrate the applicability of low-complexity signal modulation schemes to achieve SWIPT to battery-less IoT devices in the THz band. Specifically, the comparative performances of two pulse-based THz signal modulation schemes, return-to-zero on-off keying (RZ-OOK) modulation and pulse position modulation (PPM), are analyzed for SWIPT from a transmitter to a rectenna-based receiver (RRx). To this end, tractable models are proposed for both wireless power transfer (WPT) and wireless information transfer (WIT) between the transmitter and RRx through a non-linear THz channel. The theoretical models are validated with circuit simulations comprising THz band GaAs Schottky diode to showcase the novel performance analysis of both pulse modulation schemes in terms of WPT and WIT metrics in the THz band.

Side channels within the processor mi-croarchitecture are notorious for their ability to leak information without leaving any physical traces for forensic examination. Most prior detection frame-works typically choose to continuously sample a select subset of hardware events without attempting to understand the mechanics behind the side channel activity. In this work, we propose SC-K9, a novel framework that synchronizes its sampling frequency with that of the adversary, thereby improving the detection accuracy even when the frequency of attack operations vary with specific implementations. We then deploy a hardware-based deception strategy to trick the adversary and annul its observations from the side channel activities. We illustrate our design and demonstrate its effectiveness in identifying some of the potent side channels exposed by recent speculative execution attacks. Our experimental results show that SC-K9 can effectively spot adversaries at different operational modes, and incurs very low rate of false alarms among the benign workloads.

Modern computing systems typically have multiple users sharing hardware resources. While such shared hardware have typically been performance boosters, they have also led to inadvertent side-effects such as side channels. Caches, that present the largest attack surface, have been popular among adversaries for side channel attacks. In this work, we repurpose a classic cache performance metric namely, reuse distance, to capture the activity of an adversary in cache timing channels. We design Reuse-trap, an efficient cache side channel mitigation framework to record reuse distances during victim accesses and carefully inject noise to mislead the spy from inferring the victim’s activity. Our experimental results show that we can identify adversaries with zero false positives and make timing channels suffer from over 50% bit error rate on average.

Coping with diverse channel access attacks (CAAs) has been a major obstacle to realize the full potential of wireless networks as a basic building block of smart applications. Identifying and classifying different types of CAAs in a timely manner is a great challenge because of the inherently shared nature and randomness of the wireless medium. To overcome the difficulties encountered in existing methods, such as long latency, high data collection overhead, and limited applicable range, a deep learning-based CAA detection framework is proposed in this paper. First, we show the challenges of CAA classification by analyzing the impacts of CAAs on wireless network performance using an event-driven network simulator. Second, a state-transition model is built for the channel access process at a node, whose output sequences characterize the changing patterns of the node's transmission status in different CAA scenarios. Third, a deep learning-based CAA classification framework is presented, which takes state transition sequences of a node as input and outputs predicted CAA types. The performance of three deep neural networks, i.e., fully-connected, convolutional, and Long Short-Term Memory (LSTM) network, for classifying CAAs are evaluated under our CAA classification framework in five CAA scenarios and the normal scenario without CAA. Experimental results show that LSTM outperforms the other two neural network architectures, and its CAA classification accuracy is higher than 95%. We successfully transferred the learned LSTM model to classify CAAs on other nodes in the same network and the nodes in other networks, which verifies the generality of our proposed framework.

Graphics Processing Units (GPU) play a major role in speeding up computational tasks of the users, especially in applications such as high volume text and image processing. Recent works have demonstrated the security problems associated with GPU that do not erase the remnant data left behind by previous applications prior to OS context switching. In these attacks, adversaries are able to allocate their memory region on the same memory region used by previous applications and are able to steal their secrets. To overcome this problem, one needs to erase every modified memory page, and this process incurs very high latencies (order of several seconds to even minutes). In this work, we propose EraseMe, a lightweight, content-aware memory-cleansing framework that identifies and erases the sensitive memory pages left behind by victim applications. Our preliminary evaluation shows that EraseMe is able to increase the difficulty of image reconstruction by over 10× for the attacker.

Physically shared micro-architecture can be exploited by adversaries to communicate covertly via timing modulation without leaving any physical traces. Among different micro-architecture units, caches provide one of the largest attack surfaces because it is frequently accessed by multiple processes and it cannot be disabled. In this work, we show that by collecting cache occupancy traces, we can distinguish adversary from benign workloads through multiple signal processing techniques. When two processes are communicating by creating conflict misses, they would take cache memory space from each other. Consequently. the cache occupancies of two involved processes would be negatively correlated. Besides, the activity of the adversary in occupying the victim's cache space would be repetitive as a result of long-term, continuous transmission of secret information in a covert manner. By filtering the non-negatively correlated part and analyzing the repetitiveness of cache occupancy trace, we can achieve zero false negative rate and 4% false positive rate in cache timing channel detection.

Most commercial multi-core processors incorporate hardware coherence protocols to support efficient data transfers and updates between their constituent cores. While hardware coherence protocols provide immense benefits for application performance by removing the burden of software-based coherence, we note that understanding the security vulnerabilities posed by such oft-used, widely-adopted processor features is critical for secure processor designs in the future. In this paper, we demonstrate a new vulnerability exposed by cache coherence protocol states. We present novel insights into how adversaries could cleverly manipulate the coherence states on shared cache blocks, and construct covert timing channels to illegitimately communicate secrets to the spy. We demonstrate 6 different practical scenarios for covert timing channel construction. In contrast to prior works, we assume a broader adversary model where the trojan and spy can either exploit explicitly shared read-only physical pages (e.g., shared library code), or use memory deduplication feature to implicitly force create shared physical pages. We demonstrate how adversaries can manipulate combinations of coherence states and data placement in different caches to construct timing channels. We also explore how adversaries could exploit multiple caches and their associated coherence states to improve transmission bandwidth with symbols encoding multiple bits. Our experimental results on commercial systems show that the peak transmission bandwidths of these covert timing channels can vary between 700 to 1100 Kbits/sec. To the best of our knowledge, our study is the first to highlight the vulnerability of hardware cache coherence protocols to timing channels that can help computer architects to craft effective defenses against exploits on such critical processor features.

Covert timing channels are a class of information leakage attacks where two processes, namely the trojan and spy, collude with intent to stealthily exfiltrate privileged information even when the underlying system security policy prohibits any direct communication between the two processes. In this paper, we present a new type of covert timing channel that exploits the access timing difference between various caches in Non-Uniform Memory Access (NUMA)-based architectures, especially multi-socket CPUs. We demonstrate a realistic covert timing channel implemented on a dual-socket Intel Xeon server. We then explore use of statistical analysis techniques to characterize and quantify the presence of covert timing channel activity. Our experimental results show that such quantification techniques could be a useful first step in formulating an effective defense against NUMA-based covert timing channels.

Covert channels provide a secret communication medium between two malicious processes to exfiltrate information stealthily that violates the security policy of a system. In this paper, we demonstrate a new covert timing channel attack that exploits the CPU operating frequencies with different power governors in real system environment. In particular, we establish how two colluding processes-a trojan and a spy can modulate the CPU frequency to create a powerful, high-capacity and robust covert channel. We implement this covert channel both in a single threaded and simultaneous multi-threading (SMT) environment and show the feasibility of such a communication. Our experiments on Intel Xeon server platform demonstrate dynamic frequency scaling covert channels that can achieve up to 20 bits/second.

The ability to perform distributed estimation across a neighborhood of nodes when the impulse responses present at each node are related by an unknown time delay and scaling is presented in this work. The time delay estimation is performed by correlating estimates of the unknown impulse response from neighboring nodes. The estimated time delay corresponds to the shift associated with the peak of this correlation. Next combination of neighboring nodes is performed by reweighting node estimates. This reweighting factor is calculated by forming the ratio of the norm of estimated impulse response in a reference node with the norm of the estimated impulse response in a neighboring node. Simulation results demonstrating improved convergence performance for a cooperative network when estimating the time delay and amplitude weights relative to the performance of a non-cooperative network are depicted.

In this letter we propose simple and robust features to distinguish continuous-phase frequency shift keying from quadrature amplitude modulation and phase shift keying modulations. The features are based on sample mean and sample variance of the imaginary part of the product of two consecutive complex signal values. Root raised cosine pulses are used to generate the linearly modulated signals. Support vector machines are employed to distinguish the signals. One benefit of using support vector machines is that it requires very few realizations for training. Moreover, no a priori information is required about carrier amplitude, carrier phase, carrier offset, symbol rate, pulse shape, initial symbol phase (timing offset) and channel impulse response. Effectiveness of the features and signal separation by support vector machines is tested by observing the joint effects of additive white Gaussian noise, carrier offset, lack of symbol and sampling synchronization, and either fast or slow fading. In the course of doing that, the proposed classifier is compared to the wavelet based classifier, equipped by support vector machines.

Diffusion strategies for learning across networks which minimize the transient regime mean-square deviation across all nodes are presented. The problem of choosing combination coefficients which minimize the mean-square deviation at all given time instances results in a quadratic program with linear constraints. The implementation of the optimal procedure is based on the estimation of weight deviation vectors for which an algorithm is proposed. Additionally, the optimization that uses relaxed constraints is considered. The proposed methods were validated through simulations for different estimation distribution strategies and input signals. The results show a potential for significant improvement of the convergence speed.

A complex proportionate-type normalized least mean square algorithm is derived by minimizing the second norm of the weighted difference between the current estimate of the impulse response and the estimate at the next time step under the constraint that the adaptive filter a posteriori output is equal to the measured output. The weighting function is assumed positive but otherwise arbitrary and it is directly related to the update gains. No assumptions regarding the input signal are made during the derivation. Different weights (i.e., gains) are used for real and imaginary parts of the estimated impulse response. After additional assumptions special cases of the algorithm are obtained: the algorithm with one gain per impulse response coefficient and the algorithm with lower computational complexity. The learning curves of the algorithms are compared for several standard gain assignment laws for white and colored input. It was demonstrated that, in general, the algorithms with separate gains for real and imaginary parts have faster convergence.

In previous work, a water-filling algorithm was proposed which sought to minimize the mean square error (MSE) at any given time by optimally choosing the gains (i.e. step-sizes) each time instance. This work relied on the assumption that the input signal was white. In this paper, an algorithm is derived which operates when the input signal is colored. The proposed algorithm minimizes the mean square weight deviation which is important in many applications such as system identification. Additionally, it is shown that by minimizing the mean square weight deviation, an upper bound on the MSE is also minimized. The proposed algorithm offers improved misalignment and learning curve convergence rates relative to other standard algorithms.

In this work, the conditional probability density function of the current weight deviations given the preceding weight deviations is generated for a wide array of proportionate type least mean square algorithms. The conditional probability density function is derived for colored input signals when noise is present as well as when noise is absent. Additionally, the marginal conditional probability density function for weight deviations is derived. Finally, potential applications of the derived conditional probability distributions are discussed and an example finding the steady-state probability distribution is presented.

In this paper, we present a proportionate-type normalized least mean square algorithm which operates by choosing adaptive gains at each time step in a manner designed to maximize the joint conditional probability that the next-step coefficient estimates reach their optimal values. We compare and show that the performance of the joint maximum conditional probability density function (PDF) one-step algorithm is superior to the proportionate normalized least mean square algorithm when operating on a sparse impulse response. We also show that the new algorithm is superior to a previously introduced algorithm which assumed that the conditional PDF could be represented by the product of the marginal conditional PDFs, i.e., that the weight deviations are mutually conditionally independent.

In this paper, we propose three new proportionate-type NLMS algorithms: the water filling algorithm, the feasible water filling algorithm, and the adaptive μ-law proportionate NLMS (MPNLMS) algorithm. The water filling algorithm attempts to choose the optimal gains at each time step. The optimal gains are found by minimizing the mean square error (MSE) at each time with respect to the gains, given the previous mean square weight deviations. While this algorithm offers superior convergence times, it is not feasible. The second algorithm is a feasible version of the water filling algorithm. The adaptive MPNLMS (AMPNLMS) algorithm is a modification of the MPNLMS algorithm. In the MPNLMS algorithm, the parameter μ of the μ-law compression is constant. In the AMPNLMS algorithm the parameter μ is allowed to vary with time. This modification allows the algorithm more flexibility when attempting to minimize the MSE. Compared with several feasible algorithms, the AMPNLMS algorithm has the fastest MSE decay for almost all times.

We propose a new low complexity and fast converging frequency-domain adaptive algorithm for sparse system identification. This is achieved by exploiting the MMax and SP tap-selection criteria for complexity reduction and fast convergence respectively. We incorporate these tap-selection techniques into the multi-delay filtering (MDF) algorithm in order to reduce the delay inherent in frequency-domain algorithms. We illustrate two such approaches and discuss the tradeoff between convergence performance and computational complexity for these approaches. Simulation results show an improvement in convergence rate for the proposed algorithm over MDF with reduced complexity. The proposed algorithm achieves a convergence performance close to that of the recently proposed but substantially more complex improved proportionate MDF algorithm.

To date no theoretical results have been developed to predict the performance of the proportionate normalized least mean square (PNLMS) algorithm or any of its cousin algorithms such as the µ-law PNLMS (MPNLMS), and the ε-law PNLMS (EPNLMS). In this paper we develop an analytic approach to predicting the performance of the simplified PNLMS algorithm which is closely related to the PNLMS algorithm. In particular we demonstrate the ability to predict the Mean Square Output Error of the simplified PNLMS algorithm using our theory.

In this paper we study the effect of carrier offset on a feature distinguishing binary phase shift keying and quadrature phase shift keying. The feature is based on the subtraction of two consecutive signal values and the kurtosis of the absolute value of this subtraction. The paper compares performance of the proposed feature to a cumulant based feature when both are used in a support vector machine classifier. Also the paper compares the proposed-feature based classification to the maximum likelihood classification and to the quasi-log-likelihood ratio classifier. The simulation results showed that the proposed feature classifier has a robust performance with respect to carrier offset compared to the other above mentioned classifiers.

We specify the general form of proportionate-type NLMS adaptive algorithms and show that for sufficiently small adaptation stepsize parameter, the algorithms can be exponentially stable, globally convergent and robust to unmodeled dynamics and measurement noise. Also, we show that for small adaptation stepsize parameter and stationary inputs, behavior of proportionate-type NLMS algorithms can be modeled by proportionate-type steepest descent algorithms. This motivates designing of proportionate-type NLMS adaptive algorithms by looking at the adjoint proportionate-type steepest descent algorithms.

The paper considers features based on the multiplication of two consecutive signal values. Furthermore, three new classifiers using the features are proposed: fixed threshold tree classifier, dynamic threshold tree classifier and support vector machine (SVM) classifier. It is shown that the multiplication produces dependence of the features on the symbol rate. In order to quantify the effects of this dependence, the paper studies the performance of the newly proposed classifiers as well as the maximum likelihood (ML) classifier (Wei, W., 1998; Wei and Mendel, J.M., 2000), the qLLR classifier (Polydoros, A. and Kim, K., 1990), and the cumulants based classifier (Swami, A. and Sadler, B.M., 2000). Simulations show that the SVM classifier has promising results in the sense that it is closest to the theoretically optimal results obtained by the ML classifier.

A proportionate normalized least mean square (PNLMS) algorithm has been proposed for sparse impulse response identification. It provides fast initial convergence, but it begins to slow down dramatically after the initial period. We analyze the coefficient adaptation process of the steepest descent algorithm and derive how to calculate the optimal proportionate step size in order to achieve the fastest convergence. The results bring forward a novel view of the concept of proportion. We propose a μ-law PNLMS (MPNLMS) algorithm using an approximation of the optimal proportionate step size. Line segment approximation and partial update techniques are discussed to bring down the computational complexity.

In this paper, we propose two new sparse adaptive filtering algorithms using partial update. By taking advantage of both impulse response sparseness and partial update, we design different criteria to determine which coefficients to be updated in order to improve the performance of typical partial update algorithms. Compared with the normalized least mean square (NLMS), selective partial update NLMS (SPUNLMS) and proportionate NLMS (PNLMS++) algorithm, the proposed partial update sparse NLMS (PSNLMS) algorithms achieve faster convergence speed with even less computational complexity. Simulation results show that they perform well in applications where identification of long sparse impulse responses is needed. Network echo cancellation is a typical example.

The main goal of this paper is to establish an objective measure of non-linear processor (NLP) control quality for echo suppression after echo cancellation, as a basis for an optimal design of NLP control. As tools for reaching the goal, mathematical modeling and analysis of echo cancellation and suppression are used. Since the optimality assumes knowledge of the parameters of the echo cancellation process, the effects of the uncertain parameters on the objective measure of NLP control quality are studied. The performance of NLP control is investigated under ideal and non-ideal circumstances.

We propose an approach to the linear minimum-mean-square-error (MMSE) prediction of a discrete-time fractional Brownian motion (DT-FBM) traffic arrival process, a long range dependent traffic model that well represents the characteristics of observed Internet traces. Linear multi-step forecasts of the future values of the DT-FBM process and the corresponding prediction errors are first derived. We then proposed sliding window finite-memory predictors suitable for practical implementation. Simulations using real-life traffic traces are performed to compare the proposed finite-memory DT-FBM predictors with fractional autoregressive integrated moving average predictors and an empirical predictor. We find that the multi-scale sliding window DT-FBM predictor achieves best performance on forecasting the future traffic level.

We report the first statistical analysis of Internet backbone traffic, based on traces with levels of aggregation 10 times larger and timestamp accuracy 1000 times better than in previous studies. We analyze the first three moments, marginal distributions and correlation structures of packet size, packet inter-arrival time, byte count and packet count, and find that the highly aggregated Internet backbone traffic is still long-range dependent and self-similar. In fact, all time series examined (packet size, inter-arrival time, byte count, packet count) exhibit long-range dependency and self-similarity. In addition to the now-classical analysis at large time-scales (> 100 ms), we report the first statistically relevant results on the short-term correlation ([50 /spl mu/s, 10 ms]) of byte and packet count processes. We also study fitness of various analytical models to the traffic traces. The empirical queuing analysis confirms the long-range dependence detected through direct analysis by showing that the queue behavior at high level of aggregation still diverges greatly from that predicted by Poisson model. As expected, statistical multiplexing gains improve the queuing performance, leading to economy of scale.

In this paper, we propose a simple, effective and robust method based on the statistical moments of instantaneous features to classify digital modulation signals. This method adopts a tree structure scheme and uses different features in each branch to make full use of distinguishing modulation type's characteristics. The proposed method is capable of differentiating ASK2, ASK4, FSK2, FSK4, PSK2 and PSK4 signals at the output of typical high frequency channel with white Gaussian noise, multi-path delay and Doppler shift. Unlike most other existing methods, our method assumes no prior information of the incoming signal (symbol rate, carrier frequency, amplitude etc.). Extensive simulation results demonstrate that this approach is robust in various practical situations.

This paper describes three algorithms for automatic radio station detection based on the shape of power spectrum. The objective is to find the number of active stations and for each of them to estimate the bandwidth and carrier frequency. All three algorithms are grouping spectrum components into clusters that are assumed to correspond to active radio stations. The first algorithm finds local centers of mass and puts cluster boundaries in the middle between the neighboring centers of mass. The second algorithm determines the noise level and defines a threshold based on the level. Clusters are found based on the spectrum above the threshold. The third algorithm uses adaptive multiple thresholds for separating spectrum components in height and distance. Clustering is done at different height levels. The performances of algorithms are compared it the case of two active stations whose carrier frequencies and relative powers are arbitrarily chosen.

Questions have previously been raised about the existence of an analytic signal with positive instantaneous frequency when the form of the analytic signal is prescribed. Here, it is shown that the complex function a(t)exp[j(/spl omega//sub 0/t+m(t))] is an analytic signal when m(t) is a real periodic function and a(t) is a band-limited real function with the maximum bandwidth depending on /spl omega//sub 0/ and the fundamental frequency of m(t). That implies as a special case m(t) which is simultaneously a periodic and piecewise polynomial. Positivity of the instantaneous frequency is simply obtained by requiring that the absolute value of the first derivative of m(t) is smaller than /spl omega//sub 0/.

A parameterization of the cone around a given vector in N-dimensional vector space is derived. Vectors obtained by changing the parameter values can not escape the cone. The constraint is useful when it is known that an optimal vector of filter coefficients is close in direction with the given vector. Adaptive filtering algorithms that use the steepest descent method and stochastic gradient approximation are developed for the case of filter coefficients constrained in the cone. There is no need for monitoring the constraint since it is always satisfied by the construction. Two optimization criteria are explicitly considered: the least mean square and constant modulus. The cone constrained constant modulus algorithm (CMA) is applied to the problem of user detection in a synchronous direct sequence code division multiple access system. Its convergence is compared with the plain CMA and back projection CMA. Under severe conditions the cone constrained CMA is the only one which locks to the desired user.

The uncertainty relation is introduced by using operators which are not necessarily self-adjoint. In general, the uncertainty (lower) limit is different for different functions. Operators are found that define the second moments and the uncertainty limit for their product such that the limit is the same for functions obtained from each other by applying unitary support-size preserving operators, e.g. by shifting in time and frequency. In this case, for all functions of finite energy the limit is related to the minimum support size in the time-frequency domain. Moreover, it is possible to find the discrete-time counterpart of the classical uncertainty relation for continuous-time functions. The operator calculus presents results from signal analysis in a more standard form extensively used in quantum mechanics.

Long-distance telephone communications of good quality require absence of echoes. The physical characteristics of an echo path are time varying and the impulse responses measured at different times can differ from each other. This means that an echo canceller must track the changes. Using a small number of coefficients in Haar-wavelet-based models we can efficiently identify echo paths which have certain typical impulse response shapes. The modeling error energy obtained is low (less than 2%). A simple wavelet-based LMS adaptive filter can be used for on-line estimation of the coefficients. A low number of time-consuming computations is obtained per input sample due to the usage of Haar wavelets. This number is less than the ones obtained by the FIR of DFT domain based modeling.

It is shown how time-varying systems can be modeled in several different ways by discrete-time wavelets. Interpretation of physical meanings, possible efficiency and other characteristics of the modeling are considered. System identification minimizing the mean square output error is studied. Optimal coefficients and the corresponding minimum MS error are found and they are time-varying. A least-mean-square adaptive filtering algorithm is derived for on-line filtering and system identification. Theoretically and by simulations the advantages of using wavelet-based filtering are shown: separation of adaptation effects from unknown time-varying system behavior and fast convergence. Adaptive coefficients estimated by a recursive-least-square algorithm can tend towards constants.>