New technique uses power anomalies to ID malware in embedded systems

April 25, 2019

Researchers from North Carolina State University and the University of Texas at Austin have developed a technique for detecting types of malware that use a system's architecture to thwart traditional security measures. The new detection approach works by tracking power fluctuations in embedded systems.

"Embedded systems are basically any computer that doesn't have a physical keyboard - from smartphones to Internet of Things devices," says Aydin Aysu, co-author of a paper on the work and an assistant professor of electrical and computer engineering at NC State. "Embedded systems are used in everything from the voice-activated virtual assistants in our homes to industrial control systems like those used in power plants. And malware that targets those systems can be used to seize control of these systems or to steal information."

At issue are so-called micro-architectural attacks. This form of malware makes use of a system's architectural design, effectively hijacking the hardware in a way that gives outside users control of the system and access to its data. Spectre and Meltdown are high-profile examples of micro-architectural malware.

"The nature of micro-architectural attacks makes them very difficult to detect - but we have found a way to detect them," Aysu says. "We have a good idea of what power consumption looks like when embedded systems are operating normally. By looking for anomalies in power consumption, we can tell that there is malware in a system - even if we can't identify the malware directly."

The power-monitoring solution can be incorporated into smart batteries for use with new embedded systems technologies. New "plug and play" hardware would be needed to apply the detection tool with existing embedded systems.

There is one other limitation: the new detection technique relies on an embedded system's power reporting. In lab testing, researchers found that - in some instances - the power monitoring detection tool could be fooled if the malware modifies its activity to mimic "normal" power usage patterns.

"However, even in these instances our technique provides an advantage," Aysu says. "We found that the effort required to mimic normal power consumption and evade detection forced malware to slow down its data transfer rate by between 86 and 97 percent. In short, our approach can still reduce the effects of malware, even in those few instances where the malware is not detected.

"This paper demonstrates a proof of concept. We think it offers an exciting new approach for addressing a widespread security challenge."

The paper, "Using Power-Anomalies to Detect Evasive Micro-Architectural Attacks in Embedded Systems," will be presented at the IEEE International Symposium on Hardware Oriented Security and Trust (HOST), being held May 6-10 in Tysons Corner, Va. First author of the paper is Shijia Wei, a Ph.D. student at UT-Austin. The paper was co-authored by Michael Orshansky, Andreas Gerstlauer and Mohit Tiwari of UT-Austin.
-end-
The work was done with support from Lockheed Martin, and from the National Science Foundation, under grants 1850373 and 1527888.

North Carolina State University

Related Malware Articles from Brightsurf:

No honor among cyber thieves
A backstabbing crime boss and thousands of people looking for free tutorials on hacking and identity theft were two of the more interesting findings of a study examining user activity on two online 'carding forums,' illegal sites that specialize in stolen credit card information.

Browser tool aims to help researchers ID malicious websites, code
Researchers have developed an open-source tool that allows users to track and record the behavior of JavaScript programs without alerting the websites that run those programs.

Tech companies not doing enough to protect users from phishing scams
Just over 15 years after the first reported incident of phishing, new research from the University of Plymouth suggests tech companies could be doing more to protect users from the threat of scams.

New computer attack mimics user's keystroke characteristics and evades detection, according to Ben-Gurion University cyber researchers
'Our proposed detection modules are trusted and secured, based on information that can be measured from side-channel resources, in addition to data transmission,' Farhi says.

Illinois researchers add 'time-travel' feature to drives to fight ransomware attacks
One of the latest cyber threats involves hackers encrypting user files and then charging ''ransom'' to get them back.

Design flaws create security vulnerabilities for 'smart home' internet-of-things devices
NC State researchers find countermeasures for designers of security systems and other smart home devices.

New technique uses power anomalies to ID malware in embedded systems
Researchers have developed a technique for detecting types of malware that use a system's architecture to thwart traditional security measures.

How a personality trait puts you at risk for cybercrime
Impulse online shopping, downloading music and compulsive email use are all signs of a certain personality trait that make you a target for malware attacks.

Research finds bots and Russian trolls influenced vaccine discussion on Twitter
Social media bots and Russian trolls promoted discord and spread false information about vaccines on Twitter using tactics similar to those at work during the 2016 United States presidential election, according to new research led by the George Washington University.

New malicious email detection method that outperforms 60 antivirus engines -- Ben-Gurion
They compared their detection model to 60 industry-leading antivirus engines as well as previous research, and found their system outperformed the next best antivirus engine by 13 percent -- significantly better than such products including Kaspersky, MacAfee and Avast.

Read More: Malware News and Malware Current Events
Brightsurf.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.