Facilitating Electromagnetic Side-Channel Analysis for IoT Investigation: Evaluating the EMvidence Framework

Sayakkara, Asanka; Le-Khac, Nhien-An; Scanlon, Mark

doi:10.1016/j.fsidi.2020.301003

Cited by 9 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The identification of running software activities on computing devices has been previously demonstrated on multiple work. For example, it is possible to identify cryptographic operations [8], sorting algorithms [12], and specific known software behaviours [13] on embedded systems such as Arduino and Raspberry Pi devices. Chawla et al performed application inference on a SoC processor running Android operating system by utilising a combination of EM radiation and dynamic voltage frequency scaling (DVFS) information from the CPU driver [14].…”

Section: Related Workmentioning

confidence: 99%

Forensic Insights From Smartphones Through Electromagnetic Side-Channel Analysis

Sayakkara

Le-Khac

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

The increasing use of smartphones has increased their presence in legal and corporate investigations. Unlike desktop and laptop computers, forensic analysis of smartphones is a challenging task due to their limited interfaces to retrieve information of forensic value. Electromagnetic side-channel analysis (EM-SCA) has been recently proposed as an alternative window to acquire forensic insights from computers, in particularly from Internet of Things devices. Along this line, this work experimentally evaluates the potential of extracting information of forensic value from smartphones through their EM radiation. Initially, a group of smartphones representing a diverse set of system-on-chip (SoC) processors were used to acquire EM radiation traces. Later, deep learning models were trained to detect various internal software behaviours running on the SoCs. The results of this work indicates that a wide variety of insights can be extracted from smartphones through EM side-channel, increasing the potential opportunities for digital forensic investigators.INDEX TERMS Digital forensics, smartphone forensics, electromagnetic side-channel, software behaviour detection, deep learning model.

show abstract

Section: Related Workmentioning

confidence: 99%

Forensic Insights From Smartphones Through Electromagnetic Side-Channel Analysis

Sayakkara

Le-Khac

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Since EM-SCA works when the target DUT is currently powered on, it suits well to the triage examination phase of an investigation. It has been shown experimentally that various forensic insights can be acquired through EM-SCA techniques from embedded devices, such as Arduino and Raspberry Pi, and smartphones [5], [10], [19].…”

Section: Related Workmentioning

confidence: 99%

“…EMvidence 1 is an open-source framework, which is developed to facilitate the application of EM-SCA in digital forensics [10]. It follows an extensible architecture where only the core functionalities are included by default, such as capturing and managing EM data.…”

Section: Emvidence Framework For Iot Forensicsmentioning

confidence: 99%

“…A potential approach to overcome this barrier and enable the real-world use of EM-SCA for IoT forensics is to facilitate the process by providing tools or frameworks. For example, the EMvidence framework proposes to facilitate the development of EM-SCA techniques to acquire forensic insights from IoT devices and smartphones by a large and independent community of developers [10]. When individual developers focus on specific DUTs to acquire EM radiation data and develop EM-SCA techniques, such implementations can be distributed -as extensible plug-ins to the EMvidence framework -to potential users who are in need of acquiring forensic insights from those types of device.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Electromagnetic Side-Channel Analysis for IoT Forensics: Challenges, Framework, and Datasets

Sayakkara

Le-Khac

2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Electromagnetic (EM) side-channel radiation from Internet of Things (IoT) devices are shown to be effective at acquiring forensic insights during digital investigations. These EM radiation patterns can be analysed with the help of machine learning algorithms to detect internal behaviours of IoT devices, which can be relevant to an investigation. However, the real-world application of EM sidechannel analysis for digital forensic purposes is obstructed by the lack of suitable tools and the technical expertise among law-enforcement communities. Although certain frameworks, such as EMvidence, exist to cater this requirement, the sheer diversity of the IoT ecosystem makes it difficult to support a sufficiently large collection of devices that are commonly encountered in forensic investigations. The work presented in this paper makes multiple contributions towards addressing this problem. Initially, a detailed discussion on the challenges of applying EM side-channel analysis in practical digital forensic purposes is provided, where the practical difficulties are illustrated. Then, it was shown that the existing EM side-channel analysis frameworks, such as EMvidence, can be used to overcome the diversity of IoT devices in forensics by equipping them with extensible plug-ins targeting the internal system-on-chips (SoC) of each device type. These plug-ins are expected to incorporate trained machine learning models, which are capable of recognising patterns of specific IoT device SoCs. However, the development of such plug-ins requires sufficiently diverse EM datasets from IoT devices. Facilitating this requirement, this work presents a comprehensive EM side-channel dataset representing a diverse collection of popular IoT devices and smartphones. The presented dataset is used to demonstrate the potential usage of machine learning models to recognise device behaviour.

show abstract

“…is situation demands alternative approaches to forensically inspect IoT devices. Among various techniques, sidechannel attacks (SCAs) have been demonstrated to be a promising digital forensics approach [11][12][13].…”

Section: Introductionmentioning

confidence: 99%

Assessment of Addition-Chain-Based Masked S-Box Using Deep-Learning-Based Side-Channel Attacks

Ming

Zhou

2022

Security and Communication Networks

View full text Add to dashboard Cite

Masking schemes are considered to be effective countermeasures to protect Internet-of-Things devices from side-channel attacks. Deep-learning-based side-channel attacks (DL-SCAs) have been demonstrated to be very effective targeting on masked implementations. In this paper, we investigate the resistance of a popular computation-based masking scheme against DL-SCAs, that is, the addition-chain-based one. We find that addition chain introduces computations of intermediate monomials over F 2 n with smaller output sizes, which decreases its resistance against DL-SCAs. Specifically, we first use mutual information metric to evaluate the side-channel resistance of different monomials from an information theory point of view. Next, we further propose the Kullback–Leibler divergence ratio as an evaluation metric to analyze the impact of monomial output size on DL-SCAs. The measurement values show that the monomial with smaller output size is less-resistant against DL-SCAs. Then we conduct simulated and practical experiments respectively to verify it. In simulated experiments, we perform DL-SCAs on first-order masked implementations with different noise levels and training trace numbers. The results demonstrate that monomials with smaller output size are more vulnerable. Moreover, with the increase (resp. decrease) in noise level (resp. training trace number), the resistance difference of these monomials becomes more significant. In addition, we obtain similar results through simulated experiments on second-order masked scenario. In practical experiments based on an ARM Cortex-M4 architecture, we collect power and electromagnetic traces in consideration of low and high noise levels. The results show that the number of required traces for targeting the S-Box output is at least three times as much that for targeting the weakest monomial.

show abstract

Facilitating Electromagnetic Side-Channel Analysis for IoT Investigation: Evaluating the EMvidence Framework

Cited by 9 publications

References 12 publications

Forensic Insights From Smartphones Through Electromagnetic Side-Channel Analysis

Forensic Insights From Smartphones Through Electromagnetic Side-Channel Analysis

Electromagnetic Side-Channel Analysis for IoT Forensics: Challenges, Framework, and Datasets

Assessment of Addition-Chain-Based Masked S-Box Using Deep-Learning-Based Side-Channel Attacks

Contact Info

Product

Resources

About