# Data Exfiltration through Electromagnetic Covert Channel of Wired Industrial Control Systems
## 5 Covert Channel Design and Implementation
### Reception through Cover Channel  
Algorithm 3 illustrates the procedure of demodulating transmitted data from the captured EMR data, which is based on a simple template matching technique. It uses normalized cross correlation to match the patterns to decode the data. In the algorithm, Lines 1 to 5 initialise the required variables and parameters. Inside the main loop, Line 7 picks the next available portion (the size is equal to the window size) from the input array, i.e., _signalFile_. Each window is appended to an array called _samples_. If any preprocessing is required, e.g., taking FFT/Power-Spectral Density, it can be done to the window before appending it to the samples. Lines 9-12 of the algorithm attempts to detect the preamble. If the preamble is not detected and there are enough samples to detect it, then it will proceed to detect a preamble in the _samples_. The _detectPreamble_ procedure compares the current samples array with a predefined preamble template to check if the _samples_ array looks similar to a preamble. As it was discovered by experimentation in Section 4, cross-correlation performs better in comparing two EM radiation patterns. Therefore, it was used for the comparison between the current sample array and the preamble template. If the result passes a defined threshold value, it is considered that a preamble is detected. Once a preamble is detected, the whole _samples_ array is cleared.  
Once the preamble is detected and there are enough samples to decode a bit, Line 14 will decode the bit. The _decodeBit_ procedure works in a similar manner to _detectPreamble_. It also takes the cross-correlation to compare the samples to check if it looks similar to a 1 or 0. It takes the cross-correlation with both templates 0 and 1 and picks the highest value to classify the decoded bit into a 1 or a 1. This value should also pass a predefined threshold value. Once a bit is decoded, it is added to _demodulateArray_. When the _demodulatedArray_ reaches enough bits for a frame, Lines 18-20 of the algorithm detect and correct errors in the demodulated signal and decode the frame. In the decoding stage, it will validate the CRC, and if it is successful, the bits will be decoded to resolve the original message.  
The software code used for the implementation and evaluation of the work presented as part of this paper are available in an open source GitHub repository ([[https://github.com/shakhtisachintha/em-covert-channel](https://github.com/shakhtisachintha/em-covert-channel)]([https://github.com/shakhtisachintha/em-covert-channel](https://github.com/shakhtisachintha/em-covert-channel)) (accessed on 20 January 2023)).  
```
0: signalFile, sampleRate, windowSize, bitTime, preambleSize
0: Collection of decoded frames
1:\(enabled\leftarrow False\)
2:\(windowsPerBit\leftarrow\) bitTime\(*\)\(sampleRate/windowSize\)
3:\(demodulatedArray\)\([\)\(]\leftarrow[\)\(]\)
4:\(decodedFrames\leftarrow[\)\(]\)
5:\(samples\leftarrow[\)\(]\)
6:while\(signalFile.hasNext()\)do
7:\(window\leftarrowsignalFile.getNextWindow(windowSize)\)
8:\(samples.append(window)\)
9:if\(notenabled\) &\(enoughSamplesForPreamble(\(preambleSize\)) then
10:\(enabled\gets detectPreamble(samples)\)
11:\(samples.pop(0)\)
12:endif
13:if\(enabled\) &\(enoughSamplesForBit(windowsPerBit)\) then
14:\(bit\gets decodeBit(samples)\)
15:\(demodulatedArray.append(bit)\)
16:endif
17:if\(enoughBitsPerFrame(demodulatedArray)\) then
18:\(frame\gets errorCorrect(demodulatedArray)\)
19:\(frame\gets decodeFrame(frame)\)
20:\(decodedFrames.append(frame)\)
21:endif
22:endwhile
23:\(Output\leftarrow\) decoded\(Frames\)
```  
**Algorithm 3** EM signal demodulation algorithm