Recent advances in deep learning‐based side‐channel analysis

ETRI JournalVolume 42, Issue 2 p. 292-304 ORIGINAL ARTICLEFree Access Recent advances in deep learning-based side-channel analysis Sunghyun Jin, Sunghyun Jin orcid.org/0000-0002-9521-0937 School of Cyber Security, Korea University, Seoul, Rep. of Korea Center for Information Security Technologies, Institute of Cyber Security and Privacy, Korea University, Seoul, Rep. of KoreaSearch for more papers by this authorSuhri Kim, Suhri Kim School of Cyber Security, Korea University, Seoul, Rep. of Korea Center for Information Security Technologies, Institute of Cyber Security and Privacy, Korea University, Seoul, Rep. of KoreaSearch for more papers by this authorHeeSeok Kim, HeeSeok Kim Department of Information Security, College of Science and Technology, Korea University, Sejong, Rep. of KoreaSearch for more papers by this authorSeokhie Hong, Corresponding Author Seokhie Hong shhong@korea.ac.kr orcid.org/0000-0001-7506-4023 School of Cyber Security, Korea University, Seoul, Rep. of Korea Center for Information Security Technologies, Institute of Cyber Security and Privacy, Korea University, Seoul, Rep. of Korea Correspondence Seokhie Hong, School of Cyber Security, Korea University, Seoul, Rep. of Korea. Email: shhong@korea.ac.krSearch for more papers by this author Sunghyun Jin, Sunghyun Jin orcid.org/0000-0002-9521-0937 School of Cyber Security, Korea University, Seoul, Rep. of Korea Center for Information Security Technologies, Institute of Cyber Security and Privacy, Korea University, Seoul, Rep. of KoreaSearch for more papers by this authorSuhri Kim, Suhri Kim School of Cyber Security, Korea University, Seoul, Rep. of Korea Center for Information Security Technologies, Institute of Cyber Security and Privacy, Korea University, Seoul, Rep. of KoreaSearch for more papers by this authorHeeSeok Kim, HeeSeok Kim Department of Information Security, College of Science and Technology, Korea University, Sejong, Rep. of KoreaSearch for more papers by this authorSeokhie Hong, Corresponding Author Seokhie Hong shhong@korea.ac.kr orcid.org/0000-0001-7506-4023 School of Cyber Security, Korea University, Seoul, Rep. of Korea Center for Information Security Technologies, Institute of Cyber Security and Privacy, Korea University, Seoul, Rep. of Korea Correspondence Seokhie Hong, School of Cyber Security, Korea University, Seoul, Rep. of Korea. Email: shhong@korea.ac.krSearch for more papers by this author First published: 06 February 2020 https://doi.org/10.4218/etrij.2019-0163Citations: 7 Funding information This research was supported by the part of Military Crypto Research Center (UD170109ED) funded by Defense Acquisition Program Administration (DAPA) and Agency for Defense Development (ADD). AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract As side-channel analysis and machine learning algorithms share the same objective of classifying data, numerous studies have been proposed for adapting machine learning to side-channel analysis. However, a drawback of machine learning algorithms is that their performance depends on human engineering. Therefore, recent studies in the field focus on exploiting deep learning algorithms, which can extract features automatically from data. In this study, we survey recent advances in deep learning-based side-channel analysis. In particular, we outline how deep learning is applied to side-channel analysis, based on deep learning architectures and application methods. Furthermore, we describe its properties when using different architectures and application methods. Finally, we discuss our perspective on future research directions in this field. 1 INTRODUCTION Experts estimate that the explosive growth of the Internet of Things (IoT) introduces not only a new dimension to information and communication technology but also difficult problems regarding security. As IoT devices tend to handle personal data, potential attacks must be considered when securing these devices. Side-channel analysis (SCA) is the most representative attack among potential attacks. SCA is a technique for unveiling secret information based on analyzing the data obtained from the execution of an algorithm, rather than the algorithm itself 1-3. We shall refer to such data as leakages, and examples of leakages include time, power consumption, and electromagnetic emission. The ultimate objective of SCA is to reveal the secret key of a device. This analysis is performed by exploiting the relations between leakages obtained during the execution of an algorithm and a secret key. An attacker collects leakages and analyzes them using specific models and appropriate metrics to determine the secret key. In this regard, SCA could be transformed into a classification problem. Machine learning models are mathematical functions that find patterns in data. As classifying the given data is an essential application of machine learning, machine learning techniques can be adapted to SCA. A drawback is that machine learning requires human engineering in some manner for better performance. Deep learning is a subset of machine learning that has been studied since the mid-1990s. It can extract features automatically from input data. Deep learning did not gain considerable attention when it was first proposed, owing to insufficient performance caused by a lack of computing powers and training data. In the last decade, the gradual enhancement of computing power and the advent of big data have led to vast improvements in deep learning algorithms. Recent works in the field have shown that deep learning algorithms achieve good performance in various applications, such as image recognition, speech recognition, and natural language processing. The performance of deep learning in these areas motivates its application to SCA. Deep learning automatically learns features from data and generalizes the representation of data; this aspect will be of particular interest to a side-channel analyst. Accordingly, improvements in deep learning-based SCA (DLSCA) are expected. Indeed, recent studies have shown the feasibility of adapting deep learning properties to SCA for key retrieval and classification accuracy. These studies show that deep learning offers improved performance compared with classical side-channel attacks (SCAs). Hence, deep learning algorithms should be exploited in SCA. However, the performance improvement achieved by DLSCA compared with that of classical SCA is yet to be understood. Accordingly, a thorough survey of DLSCA is required. In this article, we categorize and outline recent progress in DLSCA. First, we present deep learning-based profiling SCA. Deep learning-based profiling attacks can be primarily divided into two categories, namely power modeling using regression and key guessing through trace classification. Recent work has shown that side-channel protected algorithms can be analyzed when deep learning is used to classify power traces for key guessing. We demonstrate the characteristics of DLSCA based on the architecture used for the attack. Second, we introduce new approaches to utilize deep learning for SCA. Studies have been conducted on applying deep learning to non-profiling attacks, detecting side-channel leakages, and encoding side-channel leakages for non-profiling SCA. Each method exploits the learning process of deep learning for SCA, rather than focusing solely on the input and output functions. We illustrate the elements of deep learning used in SCA for each method. Finally, we discuss our perspective on the research to be pursued in the future. Numerous studies on DLSCA have been conducted recently. However, we selected the articles based on the following criteria. This study mainly focuses on how deep learning is applied to SCA. In this regard, the articles covering the new method of applying deep learning to SCA were chosen first. We did not attempt to include articles dealing with deep learning only as part of machine learning (eg, performance comparison and data-related issues such as class imbalance 4-6). Despite the importance of these studies, owing to our specific focus and the large volume of related publications, these articles were omitted. Independently, an introductory survey article on machine learning-based SCA was published during the review period of this article 7. As a survey on machine learning-based SCA was presented systematically in 7, we recommend it to compensate for insufficient content. The rest of this article is organized as follows: Section 2 describes the deep learning algorithm, which is an essential prerequisite for the subsequent survey in this study. Section 3 introduces attacks based on SCA, such as non-profiling attacks and profiling attacks, along with their countermeasures. Section 4 introduces deep learning-based SCA techniques, which are the focus of this study. Finally, Section 5 provides our comments on the future research direction. 2 DEEP LEARNING In this section, we briefly introduce the basics of deep learning algorithms, multilayer perceptron (MLP), and convolutional neural networks (CNN; cf. 8). 2.1 Basic deep learning Deep learning was developed using artificial neural networks, which have been studied since the middle of the last century. Currently, deep learning is an active area of research owing to the advent of the big data era, the enhancement of computing power, and the development of deep learning algorithms. Numerous recent studies on deep learning have shown that deep learning techniques outperform other machine learning algorithms in the fields of image recognition, speech recognition, bioinformatics, natural language processing, and so on 9, 10. Deep learning is a subset of machine learning and is based on computational models composed of multiple processing layers that learn the representations of data with sequential abstraction 9. In other words, by abstracting the representation of data sequentially for each layer, multiple processing layers constituting the deep neural network are trained for recognition or classification. This can be performed because a neural network having one or more hidden layers and a nonlinear function can approximate arbitrary Borel measurable functions based on the universal approximation theorem 8, 11. Furthermore, in contrast to the human-dependent feature selection of machine learning, deep learning architectures can extract features automatically, resulting in more accurate machine learning models. There are several approaches to deep learning: supervised learning that learns using data with labels, unsupervised learning that learns using data without labels, and semi-supervised learning that learns using data with and without labels. In this study, we focus on deep learning architectures trained exclusively using a supervised approach. The datasets used for deep learning are classified into three types: training, validation, and test datasets. The training dataset is a set of data used in the training phase, and the test dataset is a set of data analyzed using the trained model. The validation dataset is a set of data with labels used during the training phase to determine whether the training has been performed correctly as the test dataset is not used during training. Indeed, the datasets do not have common data. Deep learning architectures are expressed in (1). A deep neural network consists of an input layer, a series of hidden layers, and an output layer. The input layer is an identity function I in (1). The hidden layer is a composite function of a linear function and a nonlinear function. A hidden layer can be expressed as Ai ◦ λi, where Ai is called an activation function. The deep learning architecture can contain one or more hidden layers as in (1). The sigmoid and rectified linear unit (ReLU) functions are representative examples of the activation function of the hidden layer. The neural network abstracts the representations of data through each hidden layer sequentially. The output layer is the function S in (1), and an identity function or softmax function is commonly used as an output layer. The softmax function is defined in (2). The softmax function (or normalized exponential function) has the effect of normalizing the output nodes so that the sum of all output nodes is equal to one while maintaining the magnitude of each node. That is, the softmax function creates properties similar to a probability density function. (1)where λi represents linear functions and Ai represents nonlinear functions. (2) Learning or training in deep learning can be interpreted as a process of changing the weights of linear functions λi such that the neural network can abstract the representation of the data. The process of changing the weights is the same as solving an optimization problem using a gradient descent optimization algorithm and a backpropagation algorithm. The weights are changed to decrease an error, defined as the value of a loss function (or error function, cost function, or objective function).1 The mean squared error (MSE) and cross-entropy are commonly used as cost functions 9. Training proceeds as follows. First, the output values are calculated through the neural network in (1). Then, the loss function measures the difference between the output value and the label, where the output value refers to the value calculated from the actual input value, and the label refers to the expected output value. Subsequently, the gradient is obtained from an output of the loss function and is used to adjust each weight. This process is expressed in (3). Various optimizers, such as RMSprop and Adam algorithms, can be used to determine the optimal weights. They adjust the weights to the gradients with adaptive learning rates 9, 12, 13. (3)where Di represents data and Li represents the label corresponding to Di. In the deep learning architecture, the number of hidden layers, the number of nodes in each hidden layer, the activation function, and the optimizer algorithm are called hyperparameters. Hyperparameters are non-trainable parameters that can be used to control the behavior of the deep learning algorithm. There are various methods for optimizing hyperparameters, such as a random search, grid search, and a search using an evolutionary algorithm 14, 15. There are two typical difficult cases in the training phase. First, if the training dataset and validation dataset are small, the loss function is likely to be biased. In this case, the validation of hyperparameters will be illegitimate. A k-fold cross-validation technique can be used to reduce the bias caused by small datasets. Second, when the deep learning architecture is trained, its performance can be improved only with regard to the training dataset and not the validation dataset. This phenomenon is called overfitting, which occurs when the weights of the neural network are overtrained for the training dataset. Techniques such as weight decay 16, 17, dropout 18, batch normalization 19, and data augmentation 20 are sometimes applied to avoid overfitting. These techniques also improve the learning performance of a neural network. 2.2 Multilayer perceptron An MLP is one of the most common forms of a neural network. It is also called a feedforward neural network and has the form shown in Figure 1. Figure 1Open in figure viewerPowerPoint Multilayer perceptron architecture In MLP, the linear functions λi in (1) take all the nodes in the previous layer as input, and the dot products over each weight of λi are then computed. Owing to this operation, the layers of an MLP are called fully connected layers. The output values of the dot products are the input to the activation function Ai. This is expressed in (4). The MLP is a neural network represented by the superposition of one or more operations with the form given in (4). The output of the MLP corresponds to the output of the last operation. Depending on the learning objectives, a softmax function can be applied: (4) Although the MLP is the most common deep learning architecture, its performance decreases with distorted data. The reason for this is that the output value is determined based on the numerical value of the input data, without considering the data topology. 2.3 Convolutional neural network The prototype for the current CNN was proposed in the form of a neocognitron by Kunihiko Fukushima, based on the work on the visual cortical structure of animals by David H. Hubel and Torsten Wiesel 21, 22. In 1998, Yann LeCun and others proposed LeNet for handwriting recognition. LeNet is now considered to represent the origin of modern CNN architectures. LeNet combines the concepts of shared weights, subsampling, and backpropagation algorithms 23, 24. AlexNet is another example of a CNN structure with good results 25. When these CNN structures outperformed the traditional machine learning algorithms in visual recognition, the CNN was applied more broadly to various fields. Indeed, the CNN continues to gain popularity because of its high performance. As stated previously, the performance of the MLP degrades when a distortion occurs, as it handles numerical values without considering the topology of the input data. As the CNN uses properties such as shared weights and subsampling, it maintains the invariance of the representations of data even when distortion occurs. The CNN structure can be depicted as in Figure 2. A CNN is an architecture formed by superimposing convolutional layers and pooling layers in front of fully connected layers. The convolutional layer is a specialized kind of linear operation, and it operates as shown in Figure 3. All the values for a feature map 9 are obtained through a convolutional filter. That is, all the values of the feature map are calculated using the shared weight. Then, all the values of the feature maps enter the activation function directly. The pooling layer is usually placed after the convolutional layer and activation function. The primary function of the pooling layer is to reduce the size of the feature map extracted from the convolutional layer. The pooling layer can be viewed as a resampling method, and Max pooling and average pooling are mainly used in the pooling layer. Max pooling reduces the size of the feature map by selecting the maximum value of the target range, whereas average pooling selects the average value of the target range. In the CNN architecture, the superposition of convolutional layers and pooling layers plays the role of extracting features. Figure 2Open in figure viewerPowerPoint Convolutional neural networks architecture Figure 3Open in figure viewerPowerPoint Example of a convolutional filter operation 3 SIDE-CHANNEL ANALYSIS Although the cryptographic algorithm has been proven to be secure, naive implementation can leak the secret information through side-channel leakages such as time, power consumption, and electromagnetic emissions. These unintended leakages are due to the physical properties of an electronic device. Such physically observable phenomena are determined by the operation and the data being processed. In this article, we refer to the "sampled leakage" as a trace or waveform. A captured trace contains features that reflect the operation of a device and the processed data. SCA is any attack using such phenomena from implementation. Since its introduction in 1996 by Kocher 1, SCA has been considered a practical and powerful attack. Although many factors support this consideration, a particular factor is that it is possible to adopt the divide-and-conquer approach. This approach reduces computation complexity remarkably compared with theoretical attacks against cryptographic algorithms. SCA is categorized into non-profiling and profiling attacks, according to the environment provided to an attacker. In this section, we explain the non-profiling attack, profiling attack, SCA countermeasures, and issues related to advanced attacks briefly. 3.1 Non-profiling attack Non-profiling attacks assume that an attacker can only acquire traces from the target equipment. Depending on the number of traces required for the attack, non-profiling attacks are divided into two types. The first type guesses the secret information with one or only a few traces. Simple power analysis (SPA) 1, 2 is a representative attack of the first type. SPA can deduce secret information from one or only a few traces obtained during the execution of an algorithm. The second type guesses secret information through statistical analysis. Differential power analysis (DPA) 2, correlation power analysis (CPA) 26, and mutual information analysis 27 are examples of the second type. These attacks calculate hypothetical leakages for each possible key using power models such as Hamming weight and Hamming distance. Then, the key is inferred through a comparison between actual leakages and hypothetical leakages. For this comparison, statistical methods are used, such as a calculation of the difference of the mean between groups, the correlation coefficient, and cross-entropy. As statistical methods are used for these analyses, this type of attack exploits many traces. Especially in these kinds of attacks, trace alignment is a necessary step prior to attack 3, 28, 29. 3.2 Profiling attack Profiling attacks assume that an attacker has a programmable device identical to the target device. This programmable device is called a profiling device. An attacker can use this device to learn and exploit the physical properties of the profiling device to extract the secret information of the target device. Profiling attacks include template attack 30 and stochastic model 31. Template attacks extract the information corresponding to the attack point with the profiling equipment. The subtraces of traces corresponding to the attack point form a certain distribution. Template attack assumes that such subtraces for a datum follow a multivariate Gaussian distribution. The attacker estimates the mean and covariance matrix of the subtraces for each possible intermediate data group. This process is called the profiling phase. After the profiling phase, an attacker infers data from the trace obtained from the target device through the maximum likelihood approach. This step is called the attack phase. The attacker can infer the key from the data obtained in the attack phase. Similar to non-profiling attack, it is necessary to align traces. In addition, as the number of attack points used increases, the complexity increases exponentially. To mitigate such problems, methods applying dimension reduction such as principal component analysis (PCA) and linear discriminant analysis (LDA) have been proposed 32, 33. Furthermore, to avoid numerical obstacles such as the inverse of the covariance matrix, the pooled covariance matrix has been proposed to be used for all intermediate values 34. 3.3 Countermeasures Side-channel analysis countermeasures are categorized into masking and hiding 3. First, masking countermeasures render statistical analysis impossible by randomizing the intermediate values 35, 36. To make intermediate values appear random, actual random values are selected from a uniform distribution and are then combined with the intermediate values. Random values conceal all the intermediate values during cryptographic operations. The random values are then removed during the last step to produce the intended output. Second, hiding countermeasures reduce the signal-to-noise ratio (SNR) to make leakages unrelated to data or operations. They are realized through misalignment by injecting random jitters and a change in internal operation order 37-39. An alternative method is producing constant waveforms regardless of the processed data using hardware dual-rail or software encoding techniques 40-43. Just as naive implementations can be vulnerable to SCA, side-channel vulnerabilities can occur in the implementation of SCA countermeasures. Hence, realizations of SCA countermeasures must be implemented and evaluated through methods such as test vector leakage assessment (TLVA) 44. Despite these countermeasures, SCA attackers can attack using advanced methods with more complexity. Second-order and higher order differential power analyses have been proposed to defeat masking countermeasures. Second-order and higher-order power analyses are methods based on the property that the actual leakages corresponding to the intermediate value can be extracted by combining the samples of the trace relating to the intermediate value 45, 46. However, these second-order and higher order attacks require finding points to be combined, which involves human engineering, that is the performance of the attack depends on the maturity of the attacker. Moreover, as noise is included in the traces, an attacker cannot obtain 100% of the actual leakage corresponding to the intermediate value. Furthermore, noise exponentially increases the number of traces required for an attack. To perform SCA to defeat hiding countermeasures, increasing the SNR is necessary. The SNR can be improved through pre-processing steps such as noise reduction, alignment, and superimposition of the waveforms 3, 28, 29, 47-49. 4 DEEP LEARNING-BASED SIDE-CHANNEL ANALYSIS Leakage pre-processing is essential in SCA, as sampled leakage is noisy and statistical methods must be applied to multiple traces. Misaligned traces or noise in the collected traces decrease the correlation between the traces and the processed data of the device. Therefore, noise reduction, alignment, and dimension reduction must be performed prior to SCA. Moreover, points of interest (POI)—significant features in the trace—must be selected. In short, pre-processing and POI selection are the most critical steps that affect the performance of SCA. Similarly, SCA using machine learning techniques, such as k-means clustering, support vector machine, and random forest, also requires pre-processing and POI selection. As pre-processing and POI selection require human engineering, they significantly impact the results 50-56. By contrast, deep learning techniques select features automatically from data. Therefore, when deep learning is applied to SCA, it is less affected by pre-processing and POI selection. Indeed, studies have shown that, when deep learning is adopted, it is possible to analyze data without the steps required by classical SCA and machine learning-based SCA. The general learning strategy for DLSCA is shown in Figure 4. The traces are used as input data, and the intended output values that an attacker wishes to extract from the trace are used as the labels. The labels can be viewed as output values of the Sbox or the Hamming weight of the Sbox output value. The form of the label changes depending on the learning objective. In the case of classification, as the Sbox output values or their Hamming weights are categorical data, they can be converted by one-hot encoding (one-hot code) and used as labels 9. In the case of regression, the values themselves can be used. In Figure 4, S(Pi + K) is an output of SubByte of exclusive-or between input and key such as advanced encryption standard (AES) SubBytes for classification. Figure 4Open in figure viewerPowerPoint Example of a structure from deep learning-based side-channel attack. Traces and intermediate values are used as data and labels, respectively In this section, we describe the application methods and characteristics of DLSCA based on deep learning architectures, namely, the MLP, CNN, and recent approaches. The DLSCA introduced in this section used the classification property of deep learning, unless explicitly stated otherwise. 4.1 MLP-based profiling side-channel analysis The MLP was the first neural network architecture applied to SCA owing to its structural simplicity. Studies have shown that the MLP can potentially enhance the performance of SCA. The first MLP-based SCA was performed by using regression to characterize leakage. More recently, MLP has been mostly used to classify the intermediate value of the trace. Yang and others were the first to use the MLP as regression to characterize the power model of the Sbox output of the AES 57. The choice of power models has a significant impact on the performance of attacks such as CPA. The Hamming weight and Hamming distance models are frequently used as a power model. For a leakage model, leakage characterization and average traces are occasionally used, because they are more similar to the actual leakage model than the Hamming weight or Hamming distance 3, 58, 59. In 57, an MLP was trained using the Sbox output value and real power trace as the data and label, respectively. Then, the trained MLP was used as a power model function to improve the performance of CPA. Martinasek and others were the first to use an MLP to categorize the Sbox output value from a trace 60. They trained an MLP against an unprotected AES with its power traces and Sbox outputs. Since then, earlier works of MLP-based SCA have not used raw traces but have used pre-processed traces through average trace reduction, a wavelet transform, and PCA to improve the performance of the attack 61-63. However, later works have confirmed that a DLSCA can achieve good performance even when raw traces are used as input data. For exampl