Traditionally, host-based defenses are limited to transmitting alerts and attestation data over a standard network or other communication channel. Unfortunately, these channels themselves and the network devices that forward traffic can be compromised by sophisticated attackers. Out-of-band communication channels are needed in order to have a final layer of defense that is resilient in the case of attackers compromising devices and the entire network infrastructure. In this paper, we present practical applications of utilizing existing device LEDs to transmit host-based defense attestation data to low cost sensors made of COTS components. We demonstrate these techniques multiple widely deployed embedded devices including a PLC module, a ruggedized switch, and an enterprise router. These example devices cover a variety of major embedded device instruction set architectures and operating systems providing evidence that this technique is scalable and practical.
We propose using out-of-band emanations from embedded devices in order to detect malicious code execution. We passively monitor involuntary electromagnetic (EM) emissions from embedded devices to find and detect new signals. We demonstrate the efficacy and feasibility of an EM emanation based anomaly detection system using commercial off-the-shelf (COTS) software defined radio (SDR) hardware to detect code execution on an industrial control system (the Allen-Bradley 1756-EWEB module). We have developed a fully automated training and testing framework for this anomaly detection system. In this paper, we describe the system architecture, the cliff-detection algorithm used to process the received emanations, the testing setup and procedures, and our results. When trained on one set of EWEB modules and tested on a separate set, we present an experimental prototype capable of detecting unknown (attack) code execution with 98% accuracy at 100% detection rate. We present data supporting the robustness of these results across 16 physical device instances and with training recordings taken months apart from testing recordings.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.