Instruction Level Program Tracking Using Electromagnetic Emanations

摘要

Monitoring computer system activities on the instruction level provides more resilience to malware attacksbecause these attacks can be analyzed better by observing the changes on the instruction level. Assuming thesource code is available, many training signals can be collected to track the instruction sequence to detect whethera malware is injected or the system works properly. However, training signals have to be collected with highsampling rate to ensure that the signi cant features of these signals do not vanish. Since the clock frequenciesof the current computer systems are extremely high, we need to have a commercial device with high samplingrate, i.e. 10GHz, which either costs remarkably high, or does not exist. To eliminate the de ciencies regardingthe insu cient sampling rate, we propose a method to increase the sampling rate with the moderate commercialdevices for training symbols. In that respect, we rst generate some random instruction sequences which existin the inspected source code. Then, these sequences are executed in a for-loop, and emanated electromagnetic(EM) signals from the processor are collected by a commercially available device with moderate sampling rate,i.e. sampling rate is much smaller than the clock frequency. Lastly, we apply a mapping of the gathered samplesby utilizing modulo of their timings with respect to execution time of overall instruction sequence. As the nalstep, we provide some experimental results to illustrate that we successfully track the instruction sequence byapplying the proposed approach.