Cybersecurity researchers have proposed a novel approach that harnesses electromagnetic field emanations from the Internet of Things (IoT) devices as a side-channel to glean precise knowledge about the different kinds of malware targeting the embedded systems, even in scenarios where obfuscation techniques have been applied to hinder analysis.
With the rapid adoption of IoT appliances presenting an attractive attack surface for threat actors, in part due to them being equipped with higher processing power and capable of running fully functional operating systems, the latest research aims to improve malware analysis to mitigate potential security risks.
The findings were presented by a group of academics from the Research Institute of Computer Science and Random Systems (IRISA) at the Annual Computer Security Applications Conference (ACSAC) held last month.
"[Electromagnetic] emanation that is measured from the device is practically undetectable by the malware," the researchers, Duy-Phuc Pham, Damien Marion, Matthieu Mastio and Annelie Heuser, said in a paper. "Therefore, malware evasion techniques cannot be straightforwardly applied unlike for dynamic software monitoring. Also, since a malware does not have control on outside hardware-level, a protection system relying on hardware features cannot be taken down, even if the malware owns the maximum privilege on the machine."
The goal is to take advantage of the side channel information to detect anomalies in emanations when they deviate from previously observed patterns and raise an alert when suspicious behavior emulating the malware is recorded in comparison to the system's normal state.
Not only does this require no modifications on the target devices, the framework devised in the study enables the detection and classification of stealthy malware such as kernel-level rootkits, ransomware, and distributed denial-of-service (DDoS) botnets like Mirai, counting unseen variants.
Taking place over three phases, the side channel approach involves measuring electromagnetic emanations when executing 30 different malware binaries as well as performing benign video, music, picture, and camera-related activities to train a convolutional neural network (CNN) model for classifying real-world malware samples. Specifically, the framework takes as input an executable and outputs its malware label by solely relying on the side-channel information.
In an experimental setup, the researchers opted for a Raspberry Pi 2B as a target device with 900 MHz quad-core ARM Cortex A7 processor and 1 GB memory, with the electromagnetic signals acquired and amplified using a combination of an oscilloscope and a PA 303 BNC preamplifier, effectively predicting the three malware types and their associated families with an accuracy of 99.82% and 99.61% respectively.
"[B]y using simple neural network models, it is possible to gain considerable information about the state of a monitored device, by observing solely its [electromagnetic] emanations," the researchers concluded. "Our system is robust against various code transformation/obfuscation, including random junk insertion, packing, and virtualization, even when the transformation is previously not known to the system."
