End-Point Malware Detection Using Air-Gapped Side-Channel Analysis in ICS Field Devices

No ratings

Presented at s4 2015 by

Carlos Gonzalez

In this session, we introduce a new physics-based technology for end-point malware detection in resource-constrained platforms and field devices, such as PLCs, RTUs, protective relays, etc. The approach relies on measuring physical side-channels (e.g. electromagnetic emissions or power consumption) directly from the processor to assess execution integrity and detect malicious intrusions. The air-gapped approach is capable of directly monitoring the execution of end points, but without requiring the loading of software artifacts on the target. The approach is ideal for monitoring field devices, especially in critical infrastructure, while providing an extra layer of protection that is not afforded by traditional intrusion detection approaches. Furthermore, since PFP is completely “air-gapped,” it does not violate the principle of non-interference in terms of safety and security in critical ICS, allowing the monitoring of the most sensitive components. This approach is the result of several years of research that started at Virginia Tech. The research has been funded by several government agencies, including the NSF, US Army, US Air Force, DARPA, and DHS.