Systems, methods and devices for intrusion detection and analysis using power characteristics such as side channel information

摘要

Several embodiments described herein relate to a system that collects and learns normal side channel normal behavior, processes it to reveal important features, and provides subsequent collected and processed data And comparing the operation for abnormal operation, reporting such operation to the management center, this information is displayed at the management center, and a predetermined operation can be executed when abnormal operation is observed. In some instances, physical side channels (as well as power consumption or indirect means of program execution, such as electromagnetic radiation and other physical signals) may use an external monitor to evaluate execution status in a processor or digital circuit, It can be used to detect extremely accurately when illegal execution confuses the normal operation of the target system (eg computer system etc).