REMOTE: Robust External Malware Detection Framework by Using Electromagnetic Signals

Cyber-physical systems (CPS) are controlling many critical and sensitive aspects of our physical world while being continuously exposed to potential cyber-attacks. These systems typically have limited performance, memory, and energy reserves, which limits their ability to run existing advanced malware protection, and that, in turn, makes securing them very challenging. To tackle these problems, this paper proposes, <italic/><sc>Remote</sc><italic/>, a new robust framework to detect malware by externally observing Electromagnetic (EM) signals emitted by an electronic computing device (e.g., a microprocessor) while running a known application, in real-time and with a low detection latency, and without any a priori knowledge of the malware. <sc>Remote</sc> does not require any resources or infrastructure on, or any modifications to, the monitored system itself, which makes <sc>Remote</sc> especially suitable for malware detection on resource-constrained devices such as embedded devices, CPSs, and Internet of Things (IoT) devices where hardware and energy resources may be limited. To demonstrate the usability of <sc>Remote</sc> in real-world scenarios, we port <italic>two</italic> real-world programs (an embedded medical device and an industrial PID controller), each with a meaningful attack (a code-reuse and a code-injection attack), to <italic>four</italic> different hardware platforms. We also port shellcode-based DDoS and Ransomware attacks to <italic>five</italic> different standard applications on an embedded system. To further demonstrate the applicability of <sc>Remote</sc> to commercial CPS, we use <sc>Remote</sc> to monitor a <italic>Robotic Arm</italic>. Our results on all these different hardware platforms show that, for all attacks on each of the platforms, <sc>Remote</sc> successfully detects each instance of an attack and has <inline-formula><tex-math notation="LaTeX">$<$</tex-math><alternatives><mml:math><mml:mo><</mml:mo></mml:math><inline-graphic xlink:href="sehatbakhsh-ieq1-2945767.gif"/></alternatives></inline-formula>0.1 percent false positives. We also systematically evaluate the robustness of <sc>Remote</sc> to interrupts and other system activity, to signal variation among different physical instances of the same device design, to changes over time, and to plastic enclosures and nearby electronic devices. This evaluation includes hundreds of measurements and shows that <sc>Remote</sc> achieves excellent accuracy (<inline-formula><tex-math notation="LaTeX">$<$</tex-math><alternatives><mml:math><mml:mo><</mml:mo></mml:math><inline-graphic xlink:href="sehatbakhsh-ieq2-2945767.gif"/></alternatives></inline-formula>0.1 percent false positive and <inline-formula><tex-math notation="LaTeX">$>$</tex-math><alternatives><mml:math><mml:mo>></mml:mo></mml:math><inline-graphic xlink:href="sehatbakhsh-ieq3-2945767.gif"/></alternatives></inline-formula>99.9 percent true positive rates) under all these conditions. We also compare <sc>Remote</sc> to prior work <italic>EDDIE</italic> <xref ref-type="bibr" rid="ref1">[1]</xref> and <italic>SYNDROME</italic> <xref ref-type="bibr" rid="ref2">[2]</xref>, and demonstrate that these prior work are unable to achieve high accuracy under these variations.