System and method for remotely detecting an anomaly

Patent metadata

Field	Value
Publication number	US-11636200-B2
Application number	US-201816004571-A
Country	US
Kind code	B2
Filing date	Jun 11, 2018
Priority date	Jun 11, 2018
Publication date	Apr 25, 2023
Grant date	Apr 25, 2023

Abstract

The following relates generally to defense mechanisms and security systems. Broadly, systems and methods are disclosed that detect an anomaly in an Embedded Mission Specific Device (EMSD). Disclosed approaches include a meta-material antenna configured to receive a radio frequency signal from the EMSD, and a central reader configured to receive a signal from the meta-material antenna. The central reader may be configured to: build a finite state machine model of the EMSD based on the signal received from the meta-material antenna; and detect if an anomaly exists in the EMSD based on the built finite state machine model.

First claim

The invention claimed is:

1. A system for detecting an anomaly in an Embedded Mission Specific Device (EMSD), comprising:
a meta-material antenna configured to receive a radio frequency signal from the EMSD;
a central reader configured to receive a signal from the meta-material antenna, the central reader further configured to:
build a finite state machine model of the EMSD based on the signal received from the meta-material antenna; and
detect if an anomaly exists in the EMSD based on the built finite state machine model.

2. The system of claim 1 , wherein the finite state machine model of the EMSD is built using machine learning to analyze the signal received from the meta-material antenna.

3. The system of claim 1 , wherein the central reader is further configured to build the finite state machine model by:
forming a plurality of clusters of execution traces from a set of execution traces; and
computing a separate finite state automation (FSA) for each cluster within the plurality of clusters.

4. The system of claim 1 , wherein:
the meta-material antenna length and width are both less than λ/40; and
λ is a wavelength of operation of the meta-material antenna which is in the megahertz (MHz) range.

5. The system of claim 1 , wherein the meta-material antenna comprises a sticker configured to be placed on the EMSD.

6. The system of claim 1 , wherein the central reader is further configured identify a particular attack based on:
a library of attack vectors and their corresponding instruction sequences; and
the finite state machine model.

7. The system of claim 1 , wherein the central reader is further configured to:
in response to detection of an anomaly in the EMSD, shut down the EMSD.

8. The system of claim 1 , wherein the built finite state machine model is a normal model, and the central reader is further configured to detect if an anomaly exists in the EMSD based on a ratio between a likelihood of the normal model and a likelihood of an abnormal finite state machine model of the EMSD.

9. The system of claim 1 , wherein the central reader is further configured to:
build the finite state machine model of the EMSD based on a temperature gradient of the EMSD.

10. The system of claim 9 , wherein the finite state machine model of the EMSD is built using machine learning to analyze the temperature gradient.

11. The system of claim 1 , wherein the central reader is further configured to:
build the finite state machine model of the EMSD based on a power trace of the EMSD.

12. The system of claim 11 , wherein the finite state machine model of the EMSD is built using machine learning to analyze the power trace.

13. A method for detecting an anomaly in an Embedded Mission Specific Device (EMSD), comprising:
receiving, with a meta-material antenna, a radio frequency signal from the EMSD;
with a central reader:
receiving a signal from the meta-material antenna;
building a finite state machine model of the EMSD based on the signal received from the meta-material antenna; and
detecting that an anomaly exists in the EMSD based on the built finite state machine model.

14. The method of claim 13 , wherein the finite state machine model of the EMSD is built using machine learning to analyze the signal received from the meta-material antenna.

15. The method of claim 13 , further comprising building the finite state machine model of the EMSD based on a temperature gradient of the EMSD.

16. The method of claim 15 , wherein the finite state machine model of the EMSD is built using machine learning to analyze the temperature gradient.

17. The method of claim 13 , further comprising building the finite state machine model of the EMSD based on a power trace of the EMSD.

18. The method of claim 17 , wherein the finite state machine model of the EMSD is built using machine learning to analyze the power trace.

19. A system for detecting an anomaly in an Embedded Mission Specific Device (EMSD), comprising:
a meta-material antenna configured to receive a radio frequency signal from the EMSD;
one or more processors configured to receive a signal from the meta-material antenna, the one or more processors further configured to:
build a finite state machine model of the EMSD based on the signal received from the meta-material antenna; and
detect if an anomaly exists in the EMSD based on the built finite state machine model.

20. The system of claim 19 , wherein the one or more processors are comprised in a thin client, smart phone, or laptop.

Assignees

• Palo Alto Res Ct Inc

Inventors

• Daniel George
• Feldman Alexander
• Saha Bhaskar
• Ganguli Anurag
• Casse Bernard D
• De Kleer Johan
• Rane Shantanu
• Matei Ion

Classifications

• G06F21/556 Primary

  involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755) · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F11/3013

  where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems (testing or monitoring of control systems or parts thereof G05B23/02) · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F11/3058

  Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations (thermal management in cooling arrangements of a computing system G06F1/206) · CPC title