Timing analysis and timing closure are critical steps in digital circuit design. To ensure an error-free design, timing constraints are usually set-based upon the longest path delay from static timing analysis. However, a circuit could have dramatically different internal activity because of the variation of input workload. The path with the longest delay may not be active for certain input workloads, which would enable timing speculation for increased performance. This paper describes an approach to identify the greatest contributors of timing errors and mitigate those errors by replacing certain standard cells in the design. We evaluated our mitigation for several benchmark designs and demonstrated an error-free performance gain up to 37%. The entire design flow uses Synopsys electronic design automation tools and customized scripts, which can be adapted for other designs.

Business demand for bring your own device (BYOD) or guest wireless networks will continue to increase, and enterprise security programs must change to enable and secure this new environment with mobile devices. In this paper, our aim is to demonstrate an intrusion detection alternative that can identify infected mobile devices that either produce no application-sourced Wi-Fi network traffic or highly disguise their Wi-Fi network traffic. We evaluate the detection capability of this tool by attempting to discern non-infected Android mobile devices from Android mobile devices that have been infected by Trojan-based malware. Our approach has two major contributions. (1) It is a network-based tool that does not need to be installed on a device, unlike anti-virus software that can be subverted by malware. (2) Results demonstrate that the network-based tool is capable of accurately detecting a class of malware that does not generate Wi-Fi network traffic or highly disguises its Wi-Fi network traffic.

This paper presents a method of device type verification via network behavior examination. This work is compared to methods and applications like nMap or xProbe, because it is capable of discerning mobile operating systems (OS) by using both active and passive network traffic. Our approach, which is based on repeatable experiments, suggests that the three major mobile OS vendors (i.e., Android, iOS, and Microsoft) down throttle the network response of some network traffic sent to them (e.g., ICMP pings) or requested by them (e.g., streaming TCP/IP) in different ways, likely to conserve battery power. Consequently, it affects the network behavior of the devices and how they handle certain events. We took the following steps as a proof-of-concept: (1) ICMP packets are actively sent to (i.e., ping) or (2) passively received by (i.e., streaming video) Android, iOS, and Microsoft mobile devices, (3) the resulting network traffic is analyzed, and (4) machine learning methods are trained to discern among the three OS types. We demonstrate that this method works well using either actively or passively generated network traffic. This method is more flexible than methods that rely solely on MAC addresses or other historical analysis methods for the identification of mobile OS type.

This paper presents a method of device type verification via network behavior examination. This work is compared to methods and applications like nMap or xProbe, because it is capable of discerning mobile operating systems (OS) by using both active and passive network traffic. Our approach, which is based on repeatable experiments, suggests that the three major mobile OS vendors (i.e., Android, iOS, and Microsoft) down throttle the network response of some network traffic sent to them (e.g., ICMP pings) or requested by them (e.g., streaming TCP/IP) in different ways, likely to conserve battery power. Consequently, it affects the network behavior of the devices and how they handle certain events. We took the following steps as a proof-of-concept: (1) ICMP packets are actively sent to (i.e., ping) or (2) passively received by (i.e., streaming video) Android, iOS, and Microsoft mobile devices, (3) the resulting network traffic is analyzed, and (4) machine learning methods are trained to discern among the three OS types. We demonstrate that this method works well using either actively or passively generated network traffic. This method is more flexible than methods that rely solely on MAC addresses or other historical analysis methods for the identification of mobile OS type.

A wireless covert timing channel (WCTC) is an established method of concealing information within a wireless medium for the purpose of covert communications. The pervasive use of mobile devices motivates our exploration into the potential of a two-way WCTC suitable for peer-to-peer (P2P) malware, in order to raise early awareness to the threat. In this work, we demonstrate the efficacy of a two-way WCTC over local networks, the public Internet, and cellular networks. Such network scalability in a mobile-to-mobile WCTC would make the notoriously hard-to-defeat P2P command-and-control (C&C) structure a viable option for currently prevalent families of mobile banking and ransomware Trojans. Specifically, we developed an Android application with the capability to communicate with other instances of the application over local networks, the Internet, and mobile networks via a WCTC. We demonstrate the feasibility of this application through experiments that test its accuracy, speed, and overall effectiveness. The main concern is that our endpoint applications could easily be replaced with malware and P2P C&Cs. The likely result is that very-difficult-to-detect malicious network traffic would emerge, especially since popular intrusion detection systems, like Snort and FireEye, have no inherent mechanisms to detect WCTCs.

During the design of an integrated circuit, there are several opportunities for adversaries to make malicious modifications or insertions to a design. These attacks, known as hardware Trojans, can have catastrophic effects on a circuit if left undetected. This paper describes a technique for identifying hardware Trojans with logic-based payloads that are hidden within third-party intellectual property. Through comparison of two similar but untrusted designs, functional differences can be identified for all possible input combinations within a window of time. This technique was tested on multiple Trojan benchmarks and was found to be very effective, both in detectability and in speed of testing. As this technique has very low costs to implement, it represents an easy way for designers to gain a level of trust in previously untrusted designs.

In this article, we illustrate that the boundary of a general-purpose node can be extended into the network by extracting information from network traffic generated by that general-purpose node to infer the state of its hardware components. This information is represented in a delay signature latent within the network traffic. In contrast, the traditional approach to determine the internal state of a node’s resources meant that a software application with internal processes had to be resident on the node. The aforementioned delay signature is the keystone that provides a correlation between network traffic and the internal state of the source node. We characterize this delay signature by (1) identifying the different types of assembly language instructions that source this delay and (2) describing how architectural techniques, such as instruction pipelining and caching, give rise to this delay signature. In theory, highly utilized nodes (due to multiple threads) will contain excessive context switching and contention for shared resources. One important shared resource is main memory, and excessive use of this resource by applications and internal processes eventually leads to a decrease in cache efficiency that eventually stalls the instruction pipeline. Our results support this theory; specifically, we have observed that excessive context switching in active applications increases the effective memory access time and wastes precious CPU cycles, thus adding additional delay to the execution of load, store, and other instructions. Because the operating system (OS) kernel accesses memory to send network packets, the delay signature is induced into network traffic in situations where user-level utilization is high. We demonstrate this theory in two case studies: (1) resource discovery in cluster grids and (2) network-based detection of bitcoin mining on compromised nodes.

As fabrication technology scales towards smaller transistor sizes and lower critical charge, single-event radiation effects are more likely to cause errant behavior in multiple, physically adjacent devices in modern integrated circuits (ICs), and with higher operating frequencies, this risk increasingly impacts design logic over memory as well. In order to increase future system reliability, circuit designers need greater awareness of multiple-transient charge-sharing effects during the early stages of their design flow with standard cell placement and routing. To measure the propagation and observability of multiple transients from single radiation events, this work uses several intra-pipeline combinational logic circuits at the 32nm technology node, investigates several different standard cell placements of each design, and analyzes those placements with a novel, physically realistic transient injection and simulation method. It is shown that (1) this simulation methodology, informed by experimental data, provides an increased realism over other works in traditional fault injection fields, (2) different placements of the same circuit where standard cells are grouped by logical hierarchy can result in different reliability behavior and benefits especially useful within the area of approximate computing, and (3) improved reliability through charge-sharing transient mitigation can be gained with no area penalty and minimal speed and power penalties by adjusting the placement of standard cells.

Many experimental hardware Trojans from the literature explore the potential threat vectors, but do not address the stealthiness of the malicious hardware. If a Trojan requires a large amount of area or power, then it can be easier to detect. Instead, a more focused attack can potentially avoid detection. This paper explores the cost in both area and power consumption of several small, focused attacks on an Intel 8051 microcontroller implemented with a standard cell library. The resulting cost in total area varied from a 0.4% increase in the design, down to a 0.150% increase in the design. Dynamic and leakage power showed similar results.

Despite the increasing threat of hardware Trojans in modern circuits, there is currently a lack of Trojans available with which to test anti-Trojan techniques. This paper presents both a defensive technique designed to aid in the detection of Trojans in integrated circuits, as well as a design ideology to confound similar defensive techniques. The defense structure was awarded 2nd place in the 2009 Embedded Systems Challenge (ESC) competition, and Trojans following the attack ideology were submitted to the same competition the following year.

Modern circuits incorporate many components that are designed by outside sources. Unfortunately, these external designs introduce a new vector of attacking a circuit through the introduction of malicious hardware. Identifying such an insertion in external intellectual property is difficult, as the labor cost and time required to investigate these designs manually is prohibitive. Additionally, due to state explosion, it is impossible to exhaustively test every possible input combination. This paper describes a method of automatically comparing two different circuits with similar functionality, in order to verify that these two designs do what they are supposed to do, and nothing more. The designs are compared by unrolling the state logic internally, so that the design outputs are represented in terms of prior inputs. This technique is advantageous as neither design needs to be a known safe design, making the task of finding similar circuits simple. Additionally, this converts the state explosion dilemma into a more easily computable Boolean satisfiability problem. The technique has been evaluated using several benchmark circuits, including circuits that contain malicious modifications.

We present the details of a novel method for passive resource discovery in cluster grid environments, where resources constantly utilize internode communication. Our method offers the ability to nonintrusively identify resources that have available CPU cycles; this is critical for lowering queue wait times in large cluster grid networks. The benefits include: 1) low message complexity, which facilitates low latency in distributed networks, 2) scalability, which provides support for very large networks, and 3) low maintainability, since no additional software is needed on compute resources. Using a 50-node (multicore) test bed (DETERlab), we demonstrate the feasibility of our method with experiments utilizing TCP, UDP, and ICMP network traffic. We use a simple but powerful technique that monitors the frequency of network packets emitted from the Network Interface Card (NIC) of local resources. We observed the correlation between CPU load and the timely response of network traffic. A highly utilized CPU will have numerous, active processes which require context switching. The latency associated with numerous context switches manifests as a delay signature within the packet transmission process. Our method detects that delay signature to determine the utilization of network resources. Results show that our method can consistently and accurately identify nodes with available CPU cycles (<;70 percent CPU utilization) through analysis of existing network traffic, including network traffic that has passed through a switch (noncongested). Also, in situations where there is no existing network traffic for nodes, ICMP ping replies can be used to ascertain this resource information.

Resource discovery is an important problem in distributed computing, because the throughput of the system is directly linked to its ability to quickly locate available resources. Current solutions are undesirable for discovering resources in large computational clusters because they are intrusive, chatty (i.e., have per-node overhead), or maintenance-intensive. In this paper, we present a novel method that offers the ability to non-intrusively identify resources that have available memory; this is critical for memory-intensive cluster applications such as weather forecasting and computational chemistry. The prime benefits are fourfold: (1) low message complexity, (2) scalability, (3) load balancing, and (4) low maintainability. We demonstrate the feasibility of our method with experiments using a 50-node test-bed (DETERlab). Our technique allows us to establish a correlation between memory load and the timely response of network traffic from a node. Results show that our method can accurately (92%-100%) identify nodes with available memory through analysis of existing network traffic, including network traffic that has passed through a switch (non-congested).