Patent application EP19179156A (EP), filed 2019-06-07
Publication number: EP3582128A1
Title: SYSTEM AND METHOD FOR REMOTELY DETECTING AN ANOMALY
Abstract: The following relates generally to defense mechanisms and security systems. Broadly, systems and methods are disclosed that detect an anomaly in an Embedded Mission Specific Device (EMSD). Disclosed approaches include a meta-material antenna configured to receive a radio frequency signal from the EMSD, and a central reader configured to receive a signal from the meta-material antenna. The central reader may be configured to: build a finite state machine model of the EMSD based on the signal received from the meta-material antenna; and detect if an anomaly exists in the EMSD based on the built finite state machine model.
IPC codes: G06F  11/    22            A I
G06F  11/    36            A I
G06F  21/    55            A I
G06F  21/    56            A I
G06N  20/    10            A I
Claims: number: 1
text: A system for detecting an anomaly in an Embedded Mission Specific Device (EMSD), comprising:
number: 2
text: The system of claim 1, wherein the finite state machine model of the EMSD is built using machine learning to analyze the signal received from the meta-material antenna.
number: 3
text: The system of claim 1, wherein the central reader is further configured to:
build the finite state machine model of the EMSD based on a temperature gradient of the EMSD.
number: 4
text: The system of claim 3, wherein the finite state machine model of the EMSD is built using machine learning to analyze the temperature gradient.
number: 5
text: The system of claim 1, wherein the central reader is further configured to:
build the finite state machine model of the EMSD based on a power trace of the EMSD.
number: 6
text: The system of claim 5, wherein the finite state machine model of the EMSD is built using machine learning to analyze the power trace.
number: 7
text: The system of claim 1, wherein the central reader is further configured to build the finite state machine model by:
number: 8
text: The system of claim 1, wherein:
number: 9
text: The system of claim 1, wherein the meta-material antenna comprises a sticker configured to be placed on the EMSD.
number: 10
text: The system of claim 1, wherein the central reader is further configured identify a particular attack based on:
number: 11
text: The system of claim 1, wherein the central reader is further configured to:
in response to detection of an anomaly in the EMSD, shut down the EMSD.
number: 12
text: The system of claim 1, wherein the built finite state machine model is a normal model, and the central reader is further configured to detect if an anomaly exists in the EMSD based on a ratio between a likelihood of the normal model and a likelihood of an abnormal finite state machine model of the EMSD.
number: 13
text: A method for detecting an anomaly in an Embedded Mission Specific Device (EMSD), comprising:
number: 14
text: The method of claim 13, wherein the finite state machine model of the EMSD is built using machine learning to analyze the signal received from the meta-material antenna.
number: 15
text: The method of claim 13, further comprising building the finite state machine model of the EMSD based on a temperature gradient of the EMSD.
number: 16
text: The method of claim 15, wherein the finite state machine model of the EMSD is built using machine learning to analyze the temperature gradient.
number: 17
text: The method of claim 13, further comprising building the finite state machine model of the EMSD based on a power trace of the EMSD.
number: 18
text: The method of claim 17, wherein the finite state machine model of the EMSD is built using machine learning to analyze the power trace.
number: 19
text: A system for detecting an anomaly in an Embedded Mission Specific Device (EMSD), comprising:
number: 20
text: The system of claim 19, wherein the one or more processors are comprised in a thin client, smart phone, or laptop.
Office action: search_report, dated 2019-12-18
Prior art cited: ref_id: - CALLAN, ROBERTALENKA ZAJICMILOS PRVULOVIC: "Proceedings of the 42nd Annual International Symposium on Computer Architecture", 2015, ACM, article "FASE: finding amplitude-modulated side-channel emanations"
ref_type: npl
severity: background
ref_id: - TROPP, J.: "Greed is good: Algorithmic results for sparse approximation", IEEE TRANSACTIONS ON INFORMATION THEORY, vol. 50.10, 2004, pages 2231 - 2242, XP011119302, DOI: doi:10.1109/TIT.2004.834793
ref_type: npl
severity: background
ref_id: - DUARTE, M.F. ET AL.: "Distributed compressed sensing of jointly sparse signals", ASILOMAR CONF. SIGNALS, SYS., COMPUT., 2005
ref_type: npl
severity: background
ref_id: - RABINER, LAWRENCE R.BIING-HWANG JUANG: "ASSP Magazine", vol. 3.1, 1986, IEEE, article "An introduction to hidden Markov models", pages: 4 - 16
ref_type: npl
severity: background
ref_id: - PARK, SUNG CHEOLMIN KYU PARKMOON GI KANG: "Signal Processing Magazine", vol. 20.3, 2003, IEEE, article "Super-resolution image reconstruction: a technical overview", pages: 21 - 36
ref_type: npl
severity: background
ref_id: - LI, JINGYUANTEJASWI TAMMINEDIGUY YOSIPHONANURAG GANGULILEI ZHANGJOHN A. STANKOVICJACOB YADEGAR: "Wireless Health 2010", 2010, ACM, article "Remote physiological monitoring of first responders with intermittent network connectivity", pages: 64 - 73
ref_type: npl
severity: background
ref_id: - ELDARDIRY, HODA ET AL.: "Multi-source fusion for anomaly detection: using across-domain and across-time peer-group consistency checks", JOURNAL OF WIRELESS MOBILE NETWORKS, UBIQUITOUS COMPUTING, AND DEPENDABLE APPLICATIONS (JOWUA), vol. 5.2, 2014, pages 39 - 58
ref_type: npl
severity: background
ref_id: - S. FORRESTS. A. HOFMEYRA. SOMAYAJI: "Intrusion Detection using Sequences of System Calls", JOURNAL OF COMPUTER SECURITY, vol. 6, 1998, pages 151 - 180
ref_type: npl
severity: background
ref_id: - FORRESTI. KRKAY. BRUNN. MEDVIDOVIC ET AL.: "Automatic mining of specifications from invocation traces and method invariants", PROCEEDINGS OF THE 22ND ACM SIGSOFT INTERNATIONAL SYMPOSIUM ON FOUNDATIONS OF SOFTWARE ENGINEERING, (FSE-22, vol. 2014, 16 November 2014 (2014-11-16), pages 178 - 189
ref_type: npl
severity: background
ref_id: - M. ACHARYAT. XIEJ. PEIJ. XU: "Mining API Patterns as Partial Orders from Source Code: From Usage Scenarios to Specifications", PROCEEDINGS OF THE 6TH JOINT MEETING OF THE EUROPEAN SOFTWARE ENGINEERING CONFERENCE AND THE ACM SIGSOFT INTERNATIONAL SYMPOSIUM ON FOUNDATIONS OF SOFTWARE ENGINEERING, 2007
ref_type: npl
severity: background
ref_id: - G. AMMONSR. BODIKJ. R. LARUS: "Mining Specification", PROCEEDINGS OF THE 35TH ANNUAL ACM SIGPLAN-SIGACT SYMPOSIUM ON PRINCIPLES OF PROGRAMMING LANGUAGES, 2002
ref_type: npl
severity: background
ref_id: - M. ERNSTJ. COCKRELLW. GRISWOLDD. NOTKIN: "Dynamically discovering likely program invariants to support program evolution", IEEE TRANSACTION ON SOFTWARE ENGINEERING, vol. 27, no. 2, February 2001 (2001-02-01), pages 99 - 123
ref_type: npl
severity: background
ref_id: - D. LOS.-C. KHOOC. LIU: "Mining temporal rules for software maintenance", JOURNAL OF SOFTWARE MAINTENANCE AND EVOLUTION: RESEARCH AND PRACTICE, vol. 20, no. 4, 2008, pages 227 - 247
ref_type: npl
severity: background
ref_id: - ASHISH GEHANIDAWOOD TARIQ: "SPADE: Support for Provenance Auditing in Distributed Environments", 13TH ACM/IFIP/USENIX INTERNATIONAL CONFERENCE ON MIDDLEWARE, 2012
ref_type: npl
severity: background
ref_id: - GODEFROID, PATRICE: "Proceedings of the 2nd international workshop on Random testing: co-located with the 22nd IEEE/ACM International Conference on Automated Software Engineering (ASE 2007", 2007, ACM, article "Random testing for security: blackbox vs. whitebox fuzzing"
ref_type: npl
severity: background
ref_id: - FARZAN, AZADEHANDREAS HOLZERHELMUT VEITH: "Software Testing, Verification and Validation (ICST), 2015 IEEE 8th International Conference on", 2015, IEEE, article "Perspectives on White-Box Testing: Coverage, Concurrency, and Concolic Execution"
ref_type: npl
severity: background
ref_id: - GONZALEZ-SANCHEZ, A.ABREU, R.GROSS, H. G.VAN GEMUND, A. J.: "Spectrum-Based Sequential Diagnosis", August 2011, AAAI
ref_type: npl
severity: background
ref_id: - CAMPOS, J.ABREU, R.FRASER, G.D'AMORIM, M.: "2013 IEEE/ACM 28th International Conference on", November 2013, IEEE, article "Entropy-based test generation for improved fault localization. In Automated Software Engineering (ASE", pages: 257 - 267
ref_type: npl
severity: background
ref_id: - EISENBARTH, THOMASCHRISTOF PAARBJORN WEGHENKEL: "Transactions on computational science X", 2010, SPRINGER, article "Building a side channel based disassembler", pages: 78 - 99
ref_type: npl
severity: background
ref_id: - STANDAERT, FRANGOIS-XAVIERCEDRIC ARCHAMBEAU: "Cryptographic Hardware and Embedded Systems-CHES 2008", 2008, SPRINGER, article "Using subspace-based template attacks to compare and combine power and electromagnetic information leakages", pages: 411 - 425
ref_type: npl
severity: background
ref_id: - HORN, ROGER A.CHARLES R. JOHNSON: "Matrix analysis", 2012, CAMBRIDGE UNIVERSITY PRESS
ref_type: npl
severity: background
ref_id: - LAURENT, JOHANN ET AL.: "Proceedings of the conference on Design, automation and test in Europe", vol. 1, 2004, IEEE COMPUTER SOCIETY, article "Functional level power analysis: An efficient approach for modeling the power consumption of complex processors"
ref_type: npl
severity: background
ref_id: - RETHINAGIRI, SANTHOSH KUMAR ET AL.: "Proceedings of the 6th Workshop on Rapid Simulation and Performance Evaluation: Methods and Tools", 2014, ACM, article "System-level power estimation tool for embedded processor based platforms"
ref_type: npl
severity: background
ref_id: - PARSLEY, M.: "Semiconductor Thermal Measurement and Management Symposium, 1991. SEMI-THERM VII. Proceedings., Seventh Annual IEEE", 1991, IEEE, article "The use of thermochromic liquid crystals in research applications, thermal mapping and non-destructive testing"
ref_type: npl
severity: background
ref_id: - DABIRI, D.: "Digital particle image thermometry/velocimetry: a review", EXP. FLUIDS, vol. 46, 2009, pages 191 - 241, XP019711203
ref_type: npl
severity: background
ref_id: - XIE, JIERUIMANDIS S. BEIGI: "Multimedia and Expo, 2009. ICME 2009. IEEE International Conference on", 2009, IEEE, article "A scale-invariant local descriptor for event recognition in 1 d sensor signals"
ref_type: npl
severity: background
ref_id: - YE, LEXIANGEAMONN KEOGH: "Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining", 2009, ACM, article "Time series shapelets: a new primitive for data mining"
ref_type: npl
severity: background
ref_id: - HILLS, JON ET AL.: "Classification of time series by shapelet transformation", DATA MINING AND KNOWLEDGE DISCOVERY, vol. 28.4, 2014, pages 851 - 881
ref_type: npl
severity: background
ref_id: - DONOHO, D.L.MICHAEL ELAD: "Optimally sparse representation in general (nonorthogonal) dictionaries via L1 minimization", PROCEEDINGS OF THE NATIONAL ACADEMY OF SCIENCES, vol. 100.5, 2003, pages 2197 - 2202
ref_type: npl
severity: background
ref_id: - FUCHS, J.: "On sparse representations in arbitrary redundant bases", IEEE TRANSACTIONS ON INFORMATION THEORY, vol. 50.6, 2004, pages 1341 - 1344
ref_type: npl
severity: background
ref_id: US2016342791A1
ref_type: patent
severity: background
ref_id: WO2018052446A1
ref_type: patent
severity: background
ref_id: WO2014144857A2
ref_type: patent
severity: background
ref_id: - TARRAH R GLASS-VANDERLAN ET AL: "A Survey of Intrusion Detection Systems Leveraging Host Data", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, 16 May 2018 (2018-05-16), XP080878725
ref_type: npl
severity: background
ref_id: US2006092079A1
ref_type: patent
severity: background
ref_id: WO2014144857
ref_type: patent
severity: background
ref_id: US2016342791
ref_type: patent
severity: background
ref_id: WO2018052446
ref_type: patent
severity: background
ref_id: - TARRAH R GLASS-VANDERLAN ET AL, "A Survey of Intrusion Detection Systems Leveraging Host Data", ARXIV.ORG, CORNELL UNIVERSITY LIBRARY, 201 OLIN LIBRARY CORNELL UNIVERSITY ITHACA, NY 14853, (20180516), XP080878725 [I] 1-20 * sections 1.1, 3.2, 4. *
ref_type: npl
severity: background
Final disposition: pending (2019-12-18)