Theorem-based, data-driven, cyber event detection

Nonlinear dynamics and graph theory may provide a theorem-based path to improve design security and aid detection of anomalous events in cyber applications. Using side-channel information such as power taken from underlying computer components and analyzing noisy data such as timing, we ask the question of whether such data can reveal anomalous activity or verify the changing dynamics of an underlying computer system. Takens' theorem in nonlinear dynamics allows reconstruction of topologically invariant, time-delay-embedding states from the computer dynamics in a sufficiently high-dimensional space. The resultant dynamical states are vertices, and the state-to-state transitions are edges in a graph. Graph theorems guarantee topologically invariant measures to quantify the dynamical changes, based on the applications that are executing. This paper highlights recent applications of the phase-space analysis technique in the non-cyber realm (forewarning of biomedical events and equipment failures), and proposes new applications that would bolster cyber event detection.