From Capture-Recapture to No Recapture: Efficient SCAD Even After Software Updates.

Area of Science:

• Cybersecurity
• Embedded Systems
• Signal Processing

Background:

• Side-Channel-based Anomaly Detection (SCAD) uses physical signals like electromagnetic emissions for integrity checks in IoT/cyber-physical systems.
• Current SCAD methods require costly re-fingerprinting for every software update, hindering practical deployment.
• IoT devices are vulnerable to firmware tampering and post-deployment compromise.

Purpose of the Study:

• To develop a generative modeling framework for synthesizing realistic electromagnetic (EM) signals for new or updated execution paths.
• To address the limitations of manual fingerprinting in SCAD systems.
• To improve the efficiency and scalability of SCAD for evolving IoT environments.

Main Methods:

• Utilized a Conditional Wasserstein Generative Adversarial Network with Gradient Penalty (CWGAN-GP) framework.
• Trained the CWGAN-GP on real EM traces conditioned on Execution State Descriptors (ESDs) encoding instruction sequences, operands, and register values.
• Evaluated synthetic signal fidelity against real EM emissions at the instruction level.

Main Results:

• Generated synthetic EM signals achieved 85-92% similarity to real emanations.
• ESD conditioning improved signal fidelity by approximately 13%.
• Semi-supervised detectors trained on synthetic data performed comparably to those trained on real data (ROC-AUC within ±1%).
• The 1DCNNGAN model variant offered faster training and reduced memory usage compared to prior methods like ResGAN.

Conclusions:

• The proposed generative framework effectively synthesizes realistic EM signals, enabling efficient SCAD for updated software.
• This approach significantly reduces the overhead associated with re-fingerprinting in SCAD systems.
• The method shows strong potential for enhancing the security and integrity monitoring of IoT and cyber-physical systems.