Detection of Malicious Threats Exploiting Clock-Gating Hardware Using Machine Learning.

Area of Science:

• Computer Science
• Cybersecurity
• Embedded Systems Engineering

Background:

• Embedded systems are crucial in critical infrastructure but lack inherent security, making them vulnerable to cyber-attacks.
• Clock-gating malware exploits hardware vulnerabilities in ARM Cortex-M microcontrollers, disrupting system reliability.
• This threat necessitates advanced security solutions for embedded platforms.

Purpose of the Study:

• To develop and evaluate an Intrusion Detection System (IDS) specifically for detecting clock-gating malware.
• To assess the effectiveness of various machine learning algorithms in identifying and categorizing malware variants.
• To enhance the security and reliability of ARM Cortex-M-based embedded systems.

Main Methods:

• Implementation and comparison of six distinct IDS methodologies: K-Nearest Classifier, Random Forest, Logistic Regression, Decision Tree, Naive Bayes, and Stochastic Gradient Descent.
• Training and validation of IDSs using power consumption data from normal operation and malware attack scenarios.
• Analysis of detection accuracy against diverse clock-gating malware injection code.

Main Results:

• The developed IDSs demonstrated significant capability in detecting clock-gating malware.
• K-Nearest Classifier and Logistic Regression-based IDSs achieved particularly high detection rates, reaching up to 0.99.
• The study confirmed the effectiveness of power consumption analysis for malware detection.

Conclusions:

• The proposed Intrusion Detection Systems offer a robust defense against clock-gating malware in ARM Cortex-M embedded systems.
• Machine learning approaches, especially K-Nearest Classifier and Logistic Regression, are effective for identifying sophisticated hardware-level threats.
• Implementing these IDSs is crucial for securing critical infrastructure reliant on embedded technologies.