Poster: A practical methodology for ML-Based EM Side Channel Disassemblers Cesar Arguello CISE University of Florida carguello1@uﬂ.edu Hunter Searle CISE University of Florida huntersearle@uﬂ.edu Sara Rampazzi CISE University of Florida srampazzi@uﬂ.edu Kevin Butler CISE University of Florida butler@uﬂ.edu Abstract—Providing security guarantees for embedded de- vices with limited interface capabilities is an increasingly crucial task. Although these devices don’t have traditional interfaces, they still generate unintentional electromagnetic signals that correlate with the instructions being executed. By collecting these traces using our methodology and leveraging a random forest algorithm to develop a machine learning model, we built an EM side channel based instruction level disassembler. The disassembler was tested on an Arduino UNO board, yielding an accuracy of 88.69% instruction recognition for traces from twelve instructions captured at a single location in the device; this is an improvement compared to the 75.6% (for twenty instructions) reported in previous similar work. Index Terms—electromagnetism, side-channel, disassembly, security 1. Introduction Embedded devices form an integral part of the modern computing ecosystem. They can be found in a myriad of applications, ranging from household appliances to security-critical industrial controllers. Securing this wide range of devices is a massive and crucial design challenge, especially with the rise in connectivity of the Internet of Things and emerging threats [1]. Many of these devices, such as fuel tank monitors or farming ﬁeld sensors, offer little insight into their internal workings due to proprietary technology or limited interfaces. Additionally, devices such as medical devices might be deployed long-term, with little or no ability to update their software against cyberthreats. This combination of longevity and minimal access create a situation where devices are susceptible to many forms of attacks, including disrupting functionality, falsifying sensor output, and increasing power consump- tion to drain batteries [2]. One proposed approach to the challenge of protecting embedded devices against these attacks is to use side- channel information. Side-channels refer to information that is leaked by unintentional signals generated in the normal operation of a processor. There are many forms of side-channel, including power, noise, electromagnetism, timing, etc [3] [4] [5]. In each case, the signal is correlated to the operations that generated them, so that information about those operations can be retrieved from the signal. Of these, power side-channels offer the clearest signal, and have consequently received more attention from re- searchers. However, they require a direct connection to the processor’s power rail. Electromagnetic signals, however, can be captured with no physical connection, making them more preferable as a side-channel security mechanism. In this work we propose an efﬁcient approach for building an electromagnetic side-channel based disas- sembler, which can identify speciﬁc instructions being executed on an embedded processor. We then use our approach to build a proof-of-concept EM-based disassem- bler to be used for implementing anomaly detection and control ﬂow mechanisms on low-cost embedded systems without the need for ﬁrmware or hardware redesign. In comparison with previous work [6], [7] that uses wiring or multiple measurement points, our approach leverages the presence in the device’s board of electronic components that generate EM emanations (e.g., ampliﬁers) correlated to the internal processor operations. Using a simple ran- dom forest algorithm for classiﬁcation, we achieve single instruction granularity with 88.69% accuracy over twelve different instructions on an ATMega328P 16MHz pro- cessor. This is an improvement over previous work [6] which required multiple measurement points and was only tested on a 4MHz processor to achiev