Machine learning to monitor operations of a device

A multi-tier machine learning engine receives signal data characterizing a monitored signal of the computing platform. The machine learning engine can include a plurality of tiers that employ frequency domain analysis on the signal data to identify an application executing on the computing platform and a module and/or loop of the identified application and employ time domain analysis on the signal data to identify timing of events within the identified module and/or loop of the identified application.

TECHNICAL FIELD

The present disclosure relates to employing machine learning to monitor operations of a computing platform.

BACKGROUND

The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines that are provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction. The definition of the IoT has evolved due to the convergence of multiple technologies, real-time analytics, machine learning, commodity sensors and embedded systems. Fields of embedded systems, wireless sensor networks, control systems, automation (including home and building automation) and others all contribute to enabling the IoT. In the consumer market, IoT technology is most synonymous with products pertaining to the concept of the “smart devices”, covering devices and appliances (such as lighting fixtures, thermostats, home security systems and cameras, and other home appliances) that support one or more common ecosystems, and can be controlled via devices associated with that ecosystem, such as smartphones and smart speakers.

An air gap, air wall or air gapping is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. Air gapping between two computing platforms indicates that the two computing platforms do not communicate directly or indirectly through a network, with a physical or logical air gap, analogous to the air gap used in plumbing to maintain water quality.

SUMMARY

One example relates to a system for monitoring operations of a computing platform. The system can include a non-transitory memory for storing machine readable instructions and a processing unit that accesses the memory and executes the machine readable instructions. The machine readable instructions can include a multi-tier machine learning engine that receives signal data characterizing a monitored signal of the computing platform. The machine learning engine can include a plurality of tiers that employ frequency domain analysis on the signal data to identify an application executing on the computing platform and a module and/or loop of the identified application and employ time domain analysis on the signal data to identify timing of events within the identified module and/or loop of the identified application.

Another example relates to a non-transitory machine readable medium having machine executable instructions. The machine executable instructions can include a hierarchical dynamic Bayesian network (DBN) that receives signal data characterizing a monitored signal of the computing platform and an interference signal. The hierarchical DBN can include a first tier that employs frequency domain analysis on the signal data to identify an application executing on the computing platform and a second tier that employs frequency domain analysis on the signal data to identify a module and/or loop of the identified application. The machine learning engine can also include a third tier that employs time domain analysis on the signal data to identify timing of events within the identified module and/or loop of the identified application. The machine learning engine can still further include a fourth tier that employs the identified timing of the events to determine control flow paths being executed by the computing platform. The first tier, the second tier and the third tier each include operations to curtail the interference signal from the signal data.

Yet another example relates to a method that can include receiving, at a multi-tier machine learning engine, signal data characterizing a monitored signal of the computing platform and an interference signal. The method can also include preprocessing, by a plurality of tiers of the multi-tier machine learning engine, the signal data. The method can further include executing frequency domain analysis on the signal data to identify a module and/or loop of an identified application executing on the computing platform and identifying timing of events within an identified module and/or loop of the identified application.

DETAILED DESCRIPTION

This disclosure relates to systems and methods for implementing a modular machine learning system that leverages samples of a monitored signal, such as radio frequency (RF) emanations from one or more electronic devices to determine the state of operations of the one or more devices. The system includes a reconfigurable machine learning framework to extract desired information from the one or more devices.

More particularly, the system described herein provides a unified approach for leveraging emanations from electronic devices for a variety of purposes. For example, when a processor (or other computing platform) is running, electrons move through a conductive medium. This produces an intermittent electromagnetic field, which generates RF emissions. The system can measure these emissions and employ techniques such as machine learning to identify the processes that led to the recorded emissions to predict the state of the one or more devices.

FIG.1illustrates a block diagram of a system50that can monitor a computing platform, which can be referred to as a device under test (DUT)52. The DUT52can be implemented, for example, as an Internet of Things (IoT) device or a field programmable gate array (FPGA). In examples where the DUT52is implemented as an IoT device, the DUT52can include a memory for storing machine readable instructions and processing unit for accessing the memory of the DUT52and executing the machine readable instructions.

The DUT52can be installed in an environment of operation54. The environment of operation54can be representative of the context in which the DUT52is designed to operate. As one example, the DUT52could represent a controller for an unmanned vehicle. In such a situation, the environment of operation54could represent other components in the unmanned vehicle. In other examples, the DUT52could be an interface or controller for a home appliance, such as a thermostat, a refrigerator or a dish washer.

As noted, the DUT52executes machine readable instructions. Execution of such machine readable instructions causes current to flow throughout circuitry of the DUT52. Current flowing through the circuitry causes electrons to move through a conductive medium, which produces an intermittent electromagnetic field that generates Radio frequency (RF) emissions. Additionally, in some examples, the DUT52can consume a changing amount of power which can also produce detectable RF signatures.

A sensor60can be configured to sample a monitored signal61associated with the DUT52. The monitored signal61can represent RF emissions or a changing consumption of power by the DUT52. Thus, in some examples, the sensor60can be implemented as an antenna, and in other examples, the sensor60can be implemented as a power meter. In either situation, the sensor60can provide data (e.g., raw data) representing the monitored signal61(e.g., RF emissions or power consumed) to a device monitor62, which data can be referred to as signal data or as the monitored signal61. The device monitor62can be implemented as a computing platform, such as a server, a workstation, a laptop computer, a tablet computer or a hand-held computing device (e.g., smartphone). Thus, the device monitor62can include a non-transitory memory for storing machine readable instructions and a processing unit (e.g., one or more processor cores) that accesses the memory and executes the machine readable instructions.

The device monitor62can be air-gapped from the DUT52. As used herein, the term “air-gapped” refers to a logical and physical separation of the DUT52from the sensor60and the device monitor62, such that an air wall or air gapping separates the DUT52from the sensor60and the device monitor62is physically isolated from the DUT52.

The device monitor62can include a multi-tier machine learning engine70programmed to identify correlations in the monitored signal with known processes. The identification of the correlations with the known processes allows the multi-tier machine learning engine70to monitor real-time changes in patterns of the monitored signal to determine whether the DUT52is operating properly or whether the DUT52is potentially executing unauthorized code, such as malicious code (e.g., a virus, malware and/or a denial of service (DoS) attack).

Other components of the environment of operation54, including, but not limited to external electrical components, can induce interference that is included in the monitored signal61. Thus, every tier of the multi-tier machine learning engine70(or some subset thereof) can each include operations (e.g., filtering operations) to curtail the interference present in the monitored signal61. As one example one or more tiers of the multi-tier machine learning engine can include a signal preconditioning operation, a signal whitening operation and/or other noise canceling operations to curtail the impact of the interference in the monitored signal61.

The multi-tier machine learning engine70can be implemented, for example, as a hierarchical Dynamic Bayesian Network (DBN). The multi-tier machine learning engine70can operate in multiple domains of time and frequency. More particularly, different tiers of the multi-tier machine learning engine70can focus on one of the time domain, for instance by using Hyperdimensional Bayesian Time Mapping (HyperBaT), the frequency domain with spectral analysis such as short-time Fourier transform (STFT), or a hybrid time/frequency domain approach such as an average magnitude difference function (AMDF), to produce a model-based machine learning framework for exploiting measurements in the monitored signal61, which can correspond to RF emanations or power consumption by the DUT52.

In some examples, as noted, the multi-tier machine learning engine70is implemented as a hierarchical DBN to evaluate the monitored signal61associated with the DUT52. In some examples, the multi-tier machine learning engine70has four tiers, but in other examples, there could be more or less tiers. The four tiers operate in concert to detect the state of the DUT52while the DUT52executes code. Each tier in the multi-tier machine learning engine70executes a different machine learning algorithm. In examples where the multi-tier machine learning engine70is implemented as a hierarchical DBN, each tier executes a different DBN. Moreover, data is passed between the tiers to reinforce and/or adapt to changing conditions.

Prior to monitoring the monitored signal61, the tiers of the multi-tier machine learning engine70is trained with sample data of a measured signal from a test device. This data can be unlabeled, partially-labeled, or labeled. The test device has the same hardware as the DUT52. In some examples, the test device is the DUT52, and in other examples, the DUT52can be a clone of the test device.

During training, the test device executes authorized code, and the monitored signal is sampled. As used herein, the term “authorized code” refers to any application, module and/or sub-module that has been authorized for execution by the test device and the DUT52. The authorized code includes machine readable instructions for executing expected operations of the test device and DUT52. Examples of authorized code include an operating system, original embedded code, validated applications, etc. In some examples, during training, the monitored signal can be sampled during times that the test device executes specific instances of unauthorized code. This allows the system to identify particular intrusions, rather than reporting in a binary manner of “authorized” or “unauthorized” code execution. As used herein, the term “unauthorized code” represents any application (e.g., program), module or sub-module that has not been authorized to execute on the DUT52. Examples of unauthorized code include, but are not limited to viruses, malware, denial of service (DoS) attacks, etc. Stated differently, the multi-tier machine learning engine70is trained with authorized code and can be trained with unauthorized code to allow the multi-tier machine learning engine70to recognize both.

More particularly, the multi-tier machine learning engine70include a first tier that employs basic computation on frequency domain measurements to predict what application the DUT52is executing. The multi-tier machine learning engine70also includes a second tier programmed to employ the knowledge of the application from the first tier and combines this knowledge with frequency domain measurements to predict which module/loop of the application is executed by the DUT52. The multi-tier machine learning engine70further includes a third tier that executes time-domain analysis to leverage repetition in the time domain measurements of the monitored signal61from the DUT52to predict a relatively precise timing of events within each module/loop of the programing being executed by the DUT52. Further still, the multi-tier machine learning engine70includes a fourth tier that executes additional time-domain analysis on the identified application, the module/loop of the application and the predicted timing of events to determine the precise control flow paths being executed by the DUT52.

It is understood that although the example of the multi-tier machine learning engine70is described as having four tiers, there are other possible example implementations. For instance, some example implementations could employ two or three tiers. Other example implementations could employ five or more tiers. The tiers of the multi-tier machine learning engine70can be trained independently, such that each tier operates as a swappable module that can be replaced and/or adjusted as machine learning algorithms continue to evolve. In such a situation, changes to one such tier do not inherently impact another tier.

The multi-tier machine learning engine70can evaluate the results of each of the first tier, the second tier, the third tier and the fourth tier (or some subset or superset thereof) to evaluate the state of the DUT52to predict if the DUT52is executing unauthorized code. In some situations, the multi-tier machine learning engine70can be programmed to determine that the DUT52is potentially executing unauthorized code in response to determining that the determined control flow paths being executed by the DUT52deviates from an expected pattern by more than a threshold level. In response to predicting that the DUT52is executing unauthorized code, the multi-tier machine learning engine70can generate an alert84that uniquely identifies the DUT52and the predicted unauthorized code. In some examples, the multi-tier machine learning engine70is able to identify the unauthorized code that is potentially executing on the DUT52. In other examples, the multi-tier machine learning engine70determines that the unauthorized code is unrecognized.

In some examples, the alert84can be provided to an external system (e.g., via a network) to inform a user that the DUT52is potentially executing unauthorized code. In response, the user can inspect the DUT52and take corrective action, if necessary. Such corrective action can include, but is not limited to removing the DUT52from the environment of operation54, clearing a memory of the DUT52and/or reinstalling authorized code, etc.

Furthermore, in some examples, the user can generate an inspection report88that characterizes observations and/or corrective action taken by the user. In some examples, the inspection report88may include information that identifies a type of unauthorized code (e.g., virus, malware or DoS attack). Additionally, in some situations, the inspection report88could include information indicating that no unauthorized code was detected on the DUT52. The inspection report88can be provided to the multi-tier machine learning engine70and used as feedback to improve the accuracy of the multi-tier machine learning engine70. For example, if the multi-tier machine learning engine70predicts that the DUT52is executing unauthorized code, but the inspection report88indicates that the DUT52is only executing authorized code, the multi-tier machine learning engine70can adjust weights and/or parameters within the multi-tier machine learning engine70to reflect the results indicated in the inspection report88.

Over time, statistical models employed by the multi-tier machine learning engine70can be adapted for specific scenarios or adjusted for known alterations. For instance, in situations where the monitored signal61represents RF emissions, the RF emissions may be shifted in frequency based on a processor clock speed of the DUT52changing over time. However, the statistical models employed by multi-tier machine learning engine70can estimate the clock speed and then shift the modeled spectrum appropriately.

Accordingly, the device monitor62can monitor operations on the DUT52without directly communicating with the DUT52(e.g., air gapped). Additionally, because the multi-tier machine learning engine70includes the operations to curtail interference present in the monitored signal61, the multi-tier machine learning engine70can accurately monitor operations of the DUT52when the DUT52is executing in a production environment without the need for external shielding.

FIG.2illustrates a block diagram of another system100that can monitor a computing platform, which can be referred to as a DUT102. The system100can be employed to implement the system50ofFIG.1. In some examples, the DUT102is an IoT device or an FPGA. In examples where the DUT102is implemented as an IoT device, the DUT102can include a memory for storing machine readable instructions and a processing unit for accessing the memory of the DUT102and executing the machine readable instructions.

The DUT102can be installed in an environment of operation103. The environment of operation103can be representative of the context in which the DUT102is designed to operate. In one example, the DUT102can represent a controller or interface for a smart home appliance, such as a smart thermostat, a smart refrigerator or a smart washing machine. In this situation, the environment of operation103could represent other components of the smart home appliance. In other examples, the DUT102could represent a controller for an unmanned vehicle, such as a terrestrial vehicle or an aircraft. In such a situation, the environment of operation103could represent other components in the unmanned vehicle.

As noted, the DUT102executes machine readable instructions. Execution of such machine readable instructions causes current to flow throughout circuitry of the DUT102. Current flowing through the circuitry causes electrons move through a conductive medium, which produces an intermittent electromagnetic field that generates RF emissions represented as104. Additionally, in some examples, the DUT102can consume a changing amount of power within a power signal106.

A sensor110can be configured to detect the RF emissions104or the changing consumption of the power signal106by the DUT102corresponding to a monitored signal108. Thus, in some examples, the sensor110can be implemented as an antenna. In other examples, the sensor110can be implemented as a power meter. In either situation, the sensor110can provide data (e.g., raw data) representing the monitored signal108(e.g., RF emissions or power consumed) to a device monitor116. In some examples, the sensor110can provide data characterizing the monitored signal108to the device monitor116directly. In other examples, the sensor110can provide the device monitor116with the data characterizing the monitored signal108via a network117. The network117can be implemented as a public network (e.g., the Internet), a private network (e.g., a local area network) or a combination thereof (e.g., a virtual private network.

The device monitor116can be implemented as a computing platform, such as a server, a workstation, a laptop computer, a tablet computer or a hand-held computing device (e.g., smartphone). Thus, the device monitor116can include non-transitory memory118that can store machine readable instructions. The non-transitory machine readable memory118can be implemented, for example, as volatile or nonvolatile random access memory (RAM), such as flash memory, a hard-disk drive, a solid state drive or a combination thereof. The processing unit120(e.g., one or more processor cores) can access the memory118and execute the machine-readable instructions.

The device monitor116can be air-gapped from the DUT102. Thus, the sensor110and the device monitor116is both logically and physically separated from the DUT102. The memory118can include framework for a hierarchical DBN122that can be employed to implement the multi-tier machine learning engine70ofFIG.1. The hierarchical DBN122can be programmed to identify correlations in the monitored signal108with known processes. The identification of the correlations with the known processes allows the hierarchical DBN122to monitor real-time changes in patterns of the monitored signal108to determine whether the DUT102is operating properly or whether the DUT102is potentially executing an unauthorized operation, such as malicious code (e.g., a virus, malware or a DoS attack). Similarly, the identification of the correlations with the known processes allows the hierarchical DBN122to monitor real-time changes in patterns of the monitored signal108to determine whether the DUT102is operating properly or whether the DUT102potentially has unauthorized hardware (e.g., a bug) installed thereon.

The hierarchical DBN122can operate in different domains of time and frequency. More particularly, the hierarchical DBN122can contemporaneously focus on time domain analysis, spectral domain analysis and hybrid time/frequency domain analysis to leverage measurements in the monitored signal108, which can correspond to the RF emissions104or the power consumption from the power signal106by the DUT102.

The hierarchical DBN122can include, HMMs (Hidden Markov Models) that are employable on tiers of the hierarchical DBN122. Moreover, the hierarchical DBN122allows the monitored signal108(e.g., characterizing RF emissions or power consumption) to be represented in a probabilistic framework. This allows the integration of multiple types of measurements at a variety of frequency and time resolutions. In some examples, tiers of the hierarchical DBN122can be programmed to leverage different time and frequency domains with a range of resolutions by creating a tier (e.g., a module) for each of the domains. Each such tier can be programmed with specially designed algorithms for the respective domain, such that the hierarchical DBN122can integrate information together which results in a predictive power that is greater than the sum of the individual tiers.

In some examples, as noted, the hierarchical DBN122is employed to evaluate the RF emissions104from the DUT102that are characterized in the monitored signal108. In some examples, the hierarchical DBN122has four tiers, but in other examples, there could be more or less tiers. The four tiers operate in concert to detect the state of the DUT102while the DUT102executes code. Each tier in the hierarchical DBN122executes a different DBN based machine learning algorithm. Moreover, data is passed between the tiers to reinforce and/or adapt to changing conditions. Prior to evaluating the monitored signal108, the tiers of the multi-tier the hierarchical DBN122can be trained with sample data of a measured signal from a test device. The test device has the same hardware as the DUT102. In some examples, the test device is the DUT102, and in other examples, the DUT102can be a clone of the test device.

During training, the test device executes authorized code, and the monitored signal is sampled. As used herein, the term “authorized code” refers to any application, module and/or sub-module that has been authorized for execution by the test device and the DUT102. The authorized code can include machine readable instructions for executing expected operations of the test device and DUT102. Examples of authorized code include an operating system, original embedded code, validated applications, etc. Thus, the hierarchical DBN122can detect unknown unauthorized code because the features in the RF emissions differ from the models of authorized code.

Additionally, during training, the monitored signal can be sampled during times that the test device executes specific instances of known unauthorized code. Examples of unauthorized code include, but are not limited to viruses, malware, DoS attacks, etc. Stated differently, the hierarchical DBN122can be trained with both authorized code and unauthorized code to allow the hierarchical DBN122to recognize both.

The hierarchical DBN122includes N number of tiers, where N is an integer greater than or equal to two. Other components of the environment of operation103, including, but not limited to external electrical components, can induce interference that is included in the monitored signal108. Thus, the N number of tiers of the hierarchical DBN122(or some subset thereof) can include operations (e.g., filtering operations) to curtail the interference present in the monitored signal61. As one example, one or more of the N number of tiers of the hierarchical DBN122can include a signal preconditioning operation, a signal whitening operation and/or other noise canceling operations to curtail the impact of the interference in the monitored signal108. Additionally or alternatively, machine learning operations executed within one or more of the N number of tiers in the hierarchical DBN122can include operations that facilitate noise cancelation.

More particularly, the hierarchical DBN122include a first tier130that employs basic computation on frequency domain measurements to predict what application (e.g., program) the DUT102is executing. The hierarchical DBN122also includes a second tier132programmed to employ the knowledge of the application from the first tier and combines the knowledge of the application with frequency domain measurements to predict which module/loop of the application executed by the DUT102. The hierarchical DBN122further includes a third tier134that executes time-domain analysis to leverage repetition in the time domain measurements of the monitored signal108from the DUT102to predict a relatively precise timing of events within each module/loop of the programing being executed by the DUT102. Further still, the hierarchical DBN122includes an Nth tier136that executes additional time-domain analysis on the identified application, the module/loop of the application and the predicted timing of events to determine the precise control flow paths being executed by the DUT102. In the example illustrated, the Nth tier136can be a fourth tier. However, in other examples, there may be intervening tiers between the operations executed by the described Nth tier136and the third tier134and/or other tiers in the hierarchical DBN122. Additionally or alternatively, the specific operations of the Nth tier136(time-domain analysis on the identified application) may be different in situations where there are more or less than four tiers in the hierarchical DBN122.

The hierarchical DBN122can evaluate the results of each of the first tier130, the second tier132, the third tier134and the Nth tier136to determine a state of the DUT102to predict if the DUT102is executing unauthorized code. In response to predicting that the DUT102is executing unauthorized code, the hierarchical DBN122can generate an alert140that uniquely identifies the DUT102and the predicted unauthorized code. In some examples, the hierarchical DBN122is able to identify the unauthorized code that is potentially executing on the DUT102. In other examples, the hierarchical DBN122determines that the unauthorized code is unrecognized. Similarly, the hierarchical DBN122may generate an indication that the DUT102is executed unauthorized code in situations where unauthorized hardware (e.g., a bug) has been installed on the DUT102. In some situations, the hierarchical DBN122can be programmed to determine that the DUT102is potentially executing unauthorized code in response to determining that the determined control flow paths being executed by the DUT102deviates from an expected pattern by more than a threshold level.

In some examples, the alert140can be provided to an end-user device150. The end-user device150can be a computing platform, such as a desktop computer, a laptop computer, tablet computer or a smart phone. The end-user device150can include a display for outputting information. In some examples, the end-user device150can execute a client application to interface with the device monitor116. In other examples, the end-user device150and the device monitor116can be implemented as a single, integrated device. Moreover, the end-user device150can include a display152. In response to receipt of the alert140, the end-user device150can output information that uniquely identifies DUT102and indicates that the DUT102is potentially executing unauthorized code.

Over time, statistical models employed by the hierarchical DBN122can be adapted for specific scenarios or adjusted for known alterations. For instance, in situations where the monitored signal108represents the RF emissions104, the RF emissions104may be shifted in frequency based on a processor clock speed of the DUT102changing over time. However, the statistical models employed by the hierarchical DBN122can estimate the clock speed and then shift the modeled spectrum appropriately.

Using the framework of the hierarchical DBN122enables each module (including each tier of the hierarchical DBN122) to be developed and tested independently while ensuring a unified system. Accordingly, algorithms in each module can be updated over time as advancements in machine learning are made without impacting other tiers of the hierarchical DBN122. As one example, the second tier132can employ a blind source separation technique developed specifically for the frequency domain measurements to remove interference from the monitored signal108. This allows the second tier132to robustly process and curtail signal interference present in the monitored signal108and varying noise levels while continuing to find the emission models within the data from the monitored signal108. Further, in some examples, the third tier134can incorporate speech processing techniques such as time correlation and average magnitude difference function to extract repetitive signals within the time domain for precise module timing measurements. Additionally, the Nth tier136includes novel signal comparison techniques, such as HyperBat that specifically tailored for the time domain tracking of the monitored signal108.

Furthermore, algorithm enhancements for each of the tiers (or some subset or superset thereof) of the hierarchical DBN122can be designed and implemented with a Bayesian probabilistic output that is directly adaptable to the framework of the hierarchical DBN122. Such a hierarchical framework allows the approach to be scaled to meet a variety of needs. For example, a low-resource system that does not require fine temporal resolution could just implement the first tier130and the second tier132. Conversely, a computing platform with sufficient resources could use every tier of the N tiers, of the hierarchical DBN122. In the example illustrated operations of four tiers of the hierarchical DBN122are described in detail, but in some examples, there may be five or more tiers.

The hierarchical DBN122can be trained through semi-supervised and unsupervised learning. In the unsupervised case, the data characterizing the monitored signal can be clustered using a clustering algorithm, such as Hierarchical Density-Based Spatial Clustering of Applications and Noise (HDBSCAN) with the Earth-Mover's Distance as the metric in the frequency domain and HyperBaT in the time domain. These algorithms were demonstrated to produce the same control flow structure as the semi-supervised learning methods, where only a portion of the data is labeled (<0.1%) during the training. The primary difference between the two cases is the amount of data employed during the training procedure. Conversely, implementing the hierarchical DBN122as a semi-supervised machine learning allows for a-priori knowledge to be fully utilized. For example, during training, code structure160implemented as a control flow graph or sample code (e.g., pseudocode or code that can be compiled) of the authorized code or unauthorized code employed in the training data to generate a transition matrix employed by a HMM can be derived prior to training the hierarchical DBN122.

Implementing the hierarchical DBN122also enables automated learning and inference. In particular, the hierarchical DBN122can be programmed to employ available data to infer models and, thus, train statistical models of the monitored signal108(characterizing the RF emissions104or the power consumption of the power signal106) of the DUT102based on provided observations. For example, the hierarchical DBN122can employ an HMM to infer a statistical model of the observations with no expert knowledge or labels for training data. The inferred model for the hierarchical DBN122can be enhanced by expert knowledge of the system100as well.

In some examples, in response to information characterizing the alert140, the end-user device150can instruct a user to inspect the DUT102. In response, the user can inspect the DUT102and take corrective action, if necessary. Such corrective action can include, but is not limited to removing the DUT102from the environment of operation103, clearing a memory of the DUT102and reinstalling authorized code, etc.

Furthermore, in some examples, the user can employ the end-user device150to generate an inspection report that characterizes observations and/or corrective action taken by the user. In some examples, the inspection report may include information that identifies a type of unauthorized code (e.g., virus or DoS attack). Additionally, in some situations, the inspection report could include information indicating that no unauthorized code was detected on the DUT102. The inspection report can be provided to the hierarchical DBN122and used as feedback to improve the accuracy of the hierarchical DBN122. For example, if the hierarchical DBN122predicts that the DUT102is executing unauthorized code, but the inspection report indicates that the DUT102is only executing authorized code, the hierarchical DBN122can update weights and/or parameters within the hierarchical DBN122to reflect the results indicated in the inspection report.

By employment of the system100, the device monitor116can operate as security for the DUT102. In particular, in situations where the DUT102is implemented as a relatively simple computing platform (e.g., an IoT device), the DUT102may lack cyber security measures to thwart or impeded access by an unauthorized user (e.g., a hacker). In such a situation, the device monitor116via the hierarchical DBN122can be employed to detect situations where an operational state of the DUT102has changed such that unauthorized code is potentially being executed on the DUT102. Similarly, the hierarchical DBN122can be employed to detect situations where an operational state of the DUT102has changed such that unauthorized hardware has been installed on the DUT102.

In view of the foregoing structural and functional features described above, example methods will be better appreciated with reference toFIGS.3-5and7. While, for purposes of simplicity of explanation, the example method ofFIGS.3-5and7is shown and described as executing serially, it is to be understood and appreciated that the present examples are not limited by the illustrated order, as some actions could in other examples occur in different orders, multiple times and/or concurrently from that shown and described herein. Moreover, it is not necessary that all described actions be performed to implement a method.

FIG.3illustrates a flowchart for an example method200for training a semi-supervised HMM (Hidden Markov Model). The method200can be employed, for example, by a hierarchical DBN, such as the hierarchical DBN122ofFIG.2and/or the multi-tier machine learning engine70ofFIG.1. More particularly, the HMM can be employed to implement the first tier130, the second tier132, the third tier134and/or the Nth tier136of the hierarchical DBN122ofFIG.2.

At205, inputs can be received at the hierarchical DBN. A chart210depicts an example of data that can be embedded in the inputs. The data in the chart210plots signal strength of a frequency as a function of time from a test device (e.g., the DUT102ofFIG.2or the DUT52ofFIG.1). In one example, the signal can be a measured signal from a sensor (e.g., the sensor110ofFIG.2or the sensor60ofFIG.1) characterizing an RF signal or consumption of a power signal. The input at205has unlabeled features. Additionally, the input at205includes one (or more) labeled time points per possible state for the test device.

At215, the hierarchical DBN executes initial clustering on the input to identify potential categories of data. At220, the clustered input is provided to the HMM for training. Additionally, at225, data characterizing (e.g., data characterizing flowcharts) of authorized code stored on the DUT and/or unauthorized code is provided to the HMM for training. At230, the HMM outputs results that are compared against test data.

At235, the HMM outputs an estimated state for each time point included in the input data. A chart240depicts an example of an estimated state for each time point in the input data. The estimated state can identify, for example, an application executing on the test device, a module and/or loop of the identified application and/or a timing of events within the identified module and/or loop of the identified application.

FIG.4illustrates a flowchart of an example method300for employing a hierarchical DBN to detect unauthorized code (e.g., a virus, malware or a DoS attack) executing on a DUT. The hierarchical DBN can be implemented as the hierarchical DBN122ofFIG.2and/or the multi-tier machine learning engine70ofFIG.1. The DUT can be implemented as the DUT102ofFIG.2and/or the DUT52ofFIG.1.

At305, a trained HMM is trained for each application monitored by the hierarchical DBN to provide a set of trained HMMs. Each HMM (or some subset or superset thereof) can be trained with the method200ofFIG.2. An array of trained HMM (each represented as A) are provided at310.

At315, data characterizing a monitored signal (e.g., an RF signal or consumption of a power signal) from the DUT is provided to the hierarchical DBN. At320, the hierarchical DBN evaluates the monitored signal to estimate a clock harmonic for the DUT. At325, the hierarchical DBN employs the estimated clock harmonic for the DUT to shift each model of in the array of HMM to account for the estimated clock harmonic of the DUT. This shifting allows for hardware other than the DUT to be employed as a test device by accounting for manufacturing tolerances of the clock harmonic. This shifting can alternatively or additionally compensate for the clock frequency drifting over time, for example from temperature changes.

At330, each tier of the hierarchical DBN executes code tracking on the data characterizing the monitored signal to attempt to correlate an instance of authorized or unauthorized code with a pattern in the monitored signal. The code tracking can identify, for example, an application executing on the test device, a module and/or loop of the identified application, a timing of events within the identified module and/or loop of the identified application and/or a control flow path for the identified events in the identified module and/or loop of the identified application. At335, the hierarchical DBN generates an alert if the hierarchical DBN detects that unauthorized code is potentially executing on the DUT. The hierarchical DBN can employ a statistical threshold indicated at340that characterizes hardware (e.g., circuit board and/or or die) reference files that characterize the DUT. Results of the detection can be characterized in a receiver operating characteristic (ROC) curve345.

By employment of the method200ofFIG.2along with the method300ofFIG.3, a-priori information about authorized code and/or unauthorized code that may be executed by the DUT, as indicated by the injection of the code structure225ofFIG.2employed to train each HMM. Additionally, as noted, manufacturing tolerances can cause deviation in expected emissions due to changes in clock frequency. However, the hierarchical DBN shifts models (HMMs) based on an estimate clock harmonic at325to account for these manufacturing tolerances.

Furthermore, the hierarchical DBN is programmed to allow data to flow in multiple directions (e.g., top-down, down-top, forward-backward and backward-forward) to allow for an extended online analysis window of the monitored signal. Further, by leveraging the code structure and/or an some operations (e.g., filtering operations), the hierarchical DBN curtails noise in the monitored signal, such that unauthorized code can be detected in the DUT without requiring shielding (e.g., a Faraday cage) surrounding the DUT.

FIG.5illustrate a diagram depicting the flow of data within a hierarchical DBN400to detect unauthorized code (e.g., a virus, malware or a DoS attack) executing on a DUT. The hierarchical DBN can be implemented as the hierarchical DBN122ofFIG.2and/or the multi-tier machine learning engine70ofFIG.1. The DUT can be implemented as the DUT102ofFIG.2and/or the DUT52ofFIG.1.

The hierarchical DBN400can include three, or more, tiers. In particular, the hierarchical DBN400can include a first tier402can be employed to implement the first tier130and/or the second tier132of the hierarchical DBN122ofFIG.2. The hierarchical DBN400can also include a second tier404that can be employed to implement the third tier132ofFIG.2. Further, the hierarchical DBN400can include a third tier406. In some examples, the third tier406can implement the Nth tier136ofFIG.2.

The hierarchical DBN400can include a data processing layer410. The data processing layer410can include a windowing and preprocessing sub-layer414and feature extraction sub-layer418. Additionally, a monitored signal420can be provided to the data processing layer410.

The first tier402processes a timeframe (e.g., about 40 milliseconds to 1 second) of the monitored signal420. The first tier402includes short-time Fourier transform (STFT)424operating in the windowing and preprocessing sub-layer414to filter the monitored signal420and to transform the monitored signal into the frequency domain. The STFT is employed to determine the sinusoidal frequency and phase content of local sections of the monitored signal420as the monitored signal420changes over time. The STFT424can divide the monitored signal into shorter segments of equal length and then compute a Fourier transform separately on each shorter segment to reveal the Fourier spectrum on each shorter segment. The output of the STFT424is provided to a feature extractor428of the feature extraction sub-layer418in the first tier402. The feature extractor428extracts predefined features of the output of the STFT424.

Contemporaneously, the second tier404process a sub-timeframe of the monitored signal. The sub-timeframe can be less than the timeframe monitored by the first tier402. As one example operation, the second tier404can include an average magnitude difference function (AMDF) that employs speech processing techniques to compare segments of the monitored signal420(that includes an interference signal) with other segments offset by a trial period to find a match. In other examples, other functions and/or algorithms are employable for the second tier404. Moreover, the AMDF430can operate near the time-domain. The output of the AMDF430is provided to a feature extractor434of the feature extraction sub-layer418in the second tier404. The feature extractor434extracts predefined features of the output of the AMDF430.

In another contemporaneous operation, the third tier406process a sub-timeframe of the monitored signal. The sub-timeframe can be less than the timeframe monitored by the second tier404and the first tier402. The third tier406includes time domain operations440. The time domain operations440can evaluate a process a relatively small segment of the monitored signal420to curtail interference that may be present in the monitored signal420. The output of the time domain operations440is provided to a feature extractor444of the feature extraction sub-layer418in the third tier406. The feature extractor444extracts predefined features of the output of the time domain operations440.

A modeling layer448of the hierarchical DBN400can include tiers of DBNs that can operate in concert. Moreover, data can flow between the tiers of the hierarchical DBN400within the modeling layer448.

The output of the feature extractor428in the first tier402is provided to a first HMM450of the hierarchical DBN400. The first HMM450can represent a plurality of HMMs that executes spectral analysis of the monitored signal420in the frequency domain. More particularly, the first HMM450is configured to employ frequency domain analysis on the feature set extracted of the monitored signal420extracted by the feature extractor428to identify an application executing on the computing platform. Additionally, in some examples, the first HMM450can identify a module of the identified application, loops and/or loop progression within the identified application.

The output of the feature extractor434in the first tier402is provided to a second HMM454of the hierarchical DBN400. The second HMM454is configured to employ time domain analysis on the feature set extracted of the monitored signal420extracted by the feature extractor434to identify an application executing on the computing platform. Additionally, in some examples, the first HMM450can identify code progression that characterizes timing of events within the identified module and/or loop of the identified application.

The output of the feature extractor444in the third tier406is provided to a third HMM460of the hierarchical DBN400. The third HMM460is configured to determine operation progression within the identified module and/or loop of the identified application. More particularly, the third HMM460can employ time domain analysis on the feature set extracted of the monitored signal420extracted by the feature extractor444to determine control flow paths within the timing of events the identified module and/or loop of the identified application being executed by the DUT.

Outputs for the modeling layer448can be examined to determine whether the DUT that provided the monitored signal420potentially has unauthorized code executing thereon. In such a situation, an alert can be generated in a manner described herein.

FIG.6illustrates a diagram of an example system500for identifying particular types of hardware in an environment of operation502. The environment of operation can include N number of DUTs504, where N is an integer greater than one (e.g., a plurality of computing platforms). In such a situation, each of the DUTs504can be computing platforms, such as mobile devices (e.g., smart phones, tablet computers, laptop computers, etc.) or desktop devices (e.g., a desktop computer, a server, etc.). Additionally, in some examples, the DUTs504may be different types of the computing platforms. For instance, the first DUT504(DUT1) may be a smart phone and the Nth DUT504(DUT N) may be a tablet computer.

The system500includes a sensor510that can monitor RF signals emitted by the N number of DUTs504, indicated as a monitored signal512. The sensor510can provide data (e.g., raw data) characterizing the monitored signal512to a device monitor520. The device monitor520can be implemented with a computing platform similar to the device monitor62ofFIG.1and/or the device monitor116ofFIG.2. The device monitor520and the sensor510can be air-gapped from the N number of DUTs504.

The device monitor520can include a hierarchical DBN524that can analyze the data characterizing the monitored signal512to identify the hardware of the N number of DUTs504, or some subset thereof. The hierarchical DBN524can be implemented in a manner similar to the hierarchical DBN122ofFIG.2. Thus, the hierarchical DBN524can process multiple concurrent RF emissions to identify an RF signature of each of the N number of DUTs504(or some subset thereof). The RF signature can be matched with a known signature of a similar computing platform to identify each instance of the similar computing platform. The hierarchical DBN524can output a list of detected devices530. In some examples, the list of detected devices can also include information identifying software executing on a respective device (e.g., an operating system).

In some examples, by employing the system500, the sensor510can be placed in an inconspicuous location, and the sensor510can provide the device monitor with the data characterizing the monitored signal512via a network. In such a situation, the hierarchical DBN524can identify the number and type of the N number of DUTs504(or some subset thereof). For instance, in one such scenario, the hierarchical DBN524might determine that the first DUT504is a particular model iPhone executing a particular version of iOS. In this same scenario, the hierarchical DBN524might determine that the Nth DUT504is a particular model tablet computer executing a particular version of the Android operating system. Accordingly, the hierarchical DBN524can be employed to identify the types of hardware employed to implement the DUTs504without requiring direct communication with any of the N number of DUTs504.

FIG.7illustrates an example of a method600for monitoring operations of a DUT or multiple DUTs. The method600can be implemented, for example, with the device monitor62ofFIG.1, the device monitor116ofFIG.2and/or the device monitor520ofFIG.6. At605a hierarchical DBN (e.g., the hierarchical DBN122ofFIG.1and/or the hierarchical DBN524ofFIG.6can receive signal data characterizing a monitored signal of the computing platform and an interference signal. At610, the hierarchical DBN can preprocess, by a plurality of tiers of the multi-tier machine learning engine, the signal data in a manner described with respect to410ofFIG.5.

At615, a first tier (e.g., the first tier402ofFIG.5) the hierarchical DBN can execute frequency domain analysis on the signal data to identify an application executing on the computing platform. At620, the first tier (e.g., also the first tier402ofFIG.5) of the hierarchical DBN can also execute frequency domain analysis on the signal data to identify a module and/or loop of an identified application executing on the computing platform. At625, a second tier (e.g., the second tier404ofFIG.5) can employ time domain analysis to identifying timing of events within an identified module and/or loop of the identified application. At625, a third tier (e.g., the third tier406ofFIG.5) can employ time domain analysis to determine control flow paths being executed by the corresponding DUT. At635, results of the hierarchical DBN can be output. Such results can indicate, for example that one or more of the DUTs is executing unauthorized code (e.g., through an alert). Alternatively, the results can include a list of hardware employed to implement the one or more DUTs and/or software (e.g. an operating system) executing on the corresponding DUT.