# Data Exfiltration through Electromagnetic Covert Channel of Wired Industrial Control Systems
## 4 Detecting Radiation Frequency
### Dissimilarity Analysis  
In order to build a covert channel to infiltrate data, there should be a way to represent bit-level 0 and 1 on the EM radiation patterns. If the two EM radiation patterns are significantly different from each other, it would be possible to demodulate data from the EM radiation with minimum errors. Therefore, after the dataset is collected, a dissimilarity analysis was employed to find two network traffic patterns that create the most dissimilar radiation from the cable. Once it is identified, these patterns can be used to modulate the bit-level 1 and 0 representations. In order to quantify the dissimilarity among different EMR patterns, three metrics were empirically evaluated--namely cosine similarity, Pearson correlation, and cross-correlation. The findings of these metrics are compared with each other below to find the best pairs of network traffic patterns.  
In order to perform a comparison between the dissimilarity metrics and identify the two network traffic patterns that are producing a significantly distinguishable EMR signature, it is necessary to have a well-defined process. For this purpose, a leakage frequency analysis algorithm is introduced as illustrated in Algorithm 1. This algorithm takes the Fast Fourier Transformation (FFT) of the EM trace files and uses the three aforementioned similarity metrics on the FFTs. The metrics are recorded for subsequent layer analysis. When calculating the FFTs of the two EM trace files, and slight differences in their size can cause a problem. To overcome this issue, the shortest file length is considered as the window size for the FFT.  
After the dissimilarity algorithm was run over the collected EM data set, the two network traffic patterns that produced the most dissimilar EM radiation patterns were selected to represent the bit-level 1 and 0. As will be described further in Section 6, the two patterns that were selected are P0 and P1. Figure 2 illustrates the waveform of those two EM trace files that correspond to network traffic patterns P0 (in orange colour) and P1 (inblue colour). A clear difference is observable between the two packet patterns in these two EM radiation waveforms. Due to this difference, the emitting frequency for the Cat5 UTP cable is identified as 220 MHz. Similarly, the best patterns to modulate binary 1 and 0 are chosen as P0, i.e., when the medium is idle, and P1, i.e., when UDP packets with non-zero payloads were sent. Furthermore, the results from the dissimilarity algorithm revealed that cross-correlation is the best metric to analyse the dissimilarity between the two signals.  
```
0: Data = Data set containing pattern traces.
0: Best patterns pair with minimum similarity.
1:for\(freq\gets start\_end\)do
2:for\(pattern_{i}\leftarrow\)Data\([freq]\)do
3:for\(pattern_{i}\leftarrow\)Data\([freq]\)do
4:\(windowSize\leftarrow\minLength(pattern_{i},pattern_{j})\)
5:\(fif_{i}\gets getFFT(pattern_{i},windowSize)\)
6:\(fft_{i}\gets getFFT(pattern_{i},windowSize)\)
7:\(cosineSimilarity\leftarrow\)
8:\(getCosineSimilarity(fft_{i},fft_{j})\)
9:\(pearsonCorrelation\gets getPearsonCor(fft_{i},fft_{j})\)
10:\(xor\leftarrow\)\(crossCorrelate(fft_{i},fft_{j})\)
11:\(results[\ ]\leftarrow\)\((pattern_{i},pattern_{j},\)\(cosineSimilarity,pearsonCorrelation,xor)\)
12:endfor
13:endfor
14:endfor
15:\(Output\gets minimumSimilarity(results[\ ])\)
```  
**Algorithm 1** Leakage frequency analysis algorithm  
Figure 2: Comparison of waveform of traffic patterns P0 & P1 at 220 Mhz.