Low-overhead and Non-invasive Electromagnetic Side-Channel Monitoring for Forensic-ready Industrial Control Systems

Low-overhead and Non-invasive Electromagnetic Side-Channel Monitoring for Forensic-ready Industrial Control Systems

Speakers: Buddhima Weerasinghe, Doctoral researcher, University of Colombo

Conference: DFDS

YouTube: https://www.youtube.com/watch?v=hI2DFDoLujk

Overview

In an era where cyberattacks on critical infrastructure are increasingly sophisticated and devastating, the need for robust, non-intrusive security monitoring in Industrial Control Systems (ICS) has never been more urgent. This talk, presented by Buddhima Weerasinghe, a doctoral researcher from the University of Colombo, introduces a novel approach to enhance the forensic readiness of ICS environments through electromagnetic side-channel analysis (EMSCA). The research, based on Weerasinghe's undergraduate final year project, explores the potential of monitoring unintentional electromagnetic (EM) radiation emitted by wired Ethernet cables to detect malicious network activity.

The core premise of the research is that network traffic, whether benign or malicious, generates distinct EM radiation patterns that can be captured and analyzed without direct interaction with the network or devices. This non-intrusive methodology offers significant advantages for legacy ICS, which often lack the computational resources and storage for traditional, high-overhead logging and monitoring solutions. By operating at the physical layer, EMSCA provides an early threat detection mechanism that is inherently resilient to encryption and can complement existing security measures, ultimately contributing to a more forensically ready and resilient critical infrastructure.

Background

▶ Watch: What is Electromagnetic Side-Channel Analysis? (0:50)

The concept of Electromagnetic Side-Channel Analysis (EMSCA) forms the bedrock of this research. EMSCA is a domain dedicated to studying the unintentional electromagnetic radiation emitted by computing devices, ranging from laptops and mobile phones to network cables. Its key advantage lies in its non-intrusive nature; it does not require direct connection to the monitored network or device, thereby avoiding any disruption or additional load on the system. This characteristic is particularly valuable for Industrial Control Systems (ICS), which manage critical infrastructure such as power grids, waste management, transportation networks, and process automation systems like nuclear power plants and oil refineries. These systems are predominantly wired, making them susceptible to EM radiation leakage.

Previous research in this field has primarily fallen into two categories: exploiting EM radiation from Ethernet cables for offensive purposes, such as creating covert channels (e.g., papers like "Latenna" and "Trust the Wire"), and using EMSCA for malicious activity detection in general computing devices like mobile phones and IoT devices (e.g., "Midens"). Weerasinghe's work uniquely bridges these two areas by applying the principles of EM radiation exploitation from Ethernet cables to the domain of malicious activity detection, specifically within ICS environments.

The imperative for this research stems from the inherent vulnerabilities and operational constraints of ICS. Attacks on critical infrastructure can have catastrophic consequences, including harm to human lives, widespread production downtimes, and significant economic losses. Therefore, beyond merely preventing attacks, it is crucial for ICS to be forensically ready—designed to proactively support efficient and effective digital forensic investigations. Forensic readiness allows for rapid incident response, quick root cause analysis, compliance with regulatory standards, and the provision of robust evidence for legal authorities.

However, achieving forensic readiness in ICS presents significant challenges. Many legacy ICS devices possess limited logging capabilities and storage, making continuous monitoring and recording of critical system events, such as network traffic and PLC commands, computationally expensive and impractical. Traditional logging solutions can introduce substantial overhead, potentially compromising the stability and performance of these delicate systems. This is precisely where low-overhead, non-invasive techniques like EMSCA offer a compelling solution, providing a means to continuously monitor network traffic patterns without burdening the underlying ICS infrastructure or adding network complexity.

Key Findings

▶ Watch: Experimental setup and unique dataset creation (5:20)

The research yielded several significant findings that underscore the viability and potential of electromagnetic side-channel monitoring for ICS security:

• Validation of Hypothesis: The fundamental hypothesis that EM radiation reflects malicious network traffic was successfully validated. Distinct and discernible patterns in EM traces were observed for different types of network attacks compared to benign traffic.
• Frequency-Specific Detection: The study demonstrated that specific electromagnetic frequencies are optimal for detecting malicious activity. For instance, 240 MHz was identified as the frequency at which DOS HTTP flood traffic exhibited the most significant dissimilarity from benign traffic, making it highly distinguishable. This highlights the importance of precise frequency tuning for effective monitoring.
• Criticality of Probe Placement: The physical placement of the EM antenna (probe) proved to be a critical factor in detection accuracy. The research showed a drastic drop in accuracy when the antenna was moved even 1 cm away from the monitored Ethernet cable, emphasizing that direct physical contact or extremely close proximity is essential for reliable signal capture.
• Attack-Specific Signatures: Detection accuracy varied significantly across different attack types. DOS HTTP flood was the most recognizable attack, followed by DOS TCP flood, and then DOS UDP flood. This suggests that each attack type generates a unique electromagnetic signature, which can be leveraged for classification.
• Impact of Observation Time: The phase of an attack during which EM traces are collected can influence detection accuracy. The middle phase of an attack generally exhibited higher detectability compared to the beginning or end, though acceptable accuracy levels were maintained across all phases for most attacks.
• Sampling Rate Optimization: While a high sampling rate (e.g., 20 MHz) generates a large volume of data, the study found that for certain machine learning models (specifically Random Forest Classifier and Support Vector Machines), detection accuracy for HTTP flood attacks did not significantly drop even when the sampling rate was reduced to 10 MHz or 4 MHz. This finding is crucial for deploying solutions on resource-constrained devices, allowing for a trade-off between data volume and processing capability. However, the Multi-Layer Perceptron (MLP) model showed a decrease in accuracy with reduced sampling rates.
• Environmental Sensitivity: Environmental factors were shown to significantly affect the emitted EM radiation patterns and, consequently, the detection accuracy. Testing the same setup in different physical locations within the lab, and with a different victim device, resulted in distinct radiation patterns and varying detection accuracies. This implies that real-world deployments would likely require initial calibration and potentially continuous adaptation to local environmental conditions.
• Machine Learning Efficacy: Among the tested lightweight machine learning algorithms, the Random Forest Classifier with Ada Boosting consistently demonstrated superior performance in classifying malicious network activities based on EM radiation patterns, achieving higher accuracy, precision, and recall compared to Multi-Layer Perceptron and Support Vector Machines.

Technical Deep Dive

▶ Watch: Machine learning for automated attack detection accuracy (9:30)

The technical methodology employed in this research was meticulously designed to validate the hypothesis that EM radiation from Ethernet cables can effectively reveal malicious network activity. The approach involved a systematic process of signal capture, data set creation, frequency identification, and machine learning-based analysis.

The experimental setup comprised both hardware and software components. For hardware, a simple point-to-point network was established. A desktop PC served as the attacker, targeting a broadband router designated as the victim. These two devices were connected via a standard Cat6 Ethernet cable. To capture the EM radiation, a HackRF One Software Defined Radio (SDR) device was used in conjunction with an H-loop antenna. Crucially, the H-loop antenna was placed in direct physical contact with the Ethernet cable to maximize signal capture fidelity. For automation, the same attacking device was used to record the EM traces, although the speaker noted that a separate device could also be used.

Software Defined Radios (SDRs) are instrumental in this setup, as they shift most radio functionalities (like modulation, demodulation, and amplification) from hardware to software, offering immense flexibility. The HackRF One captures data using complex in-phase and quadrature-phase (I/Q) sampling, meaning each sample is a complex value representing two components. The research utilized a high sampling rate of 20 MHz (20 million samples per second). This high rate, while providing rich data, also resulted in substantial data volumes: 30 seconds of capture yielded approximately 4.47 GB of data.

A significant challenge identified by the researchers was the absence of publicly available electromagnetic trace datasets for network traffic. To overcome this, they had to create their own. They leveraged the CIC IoT 2023 dataset from the Canadian Institute of Cyber Security, which provides 33 reproducible traffic patterns in PCAP file format. These PCAP files were replayed to simulate realistic attacks. For this proof-of-concept, three specific attack types were selected: DOS HTTP Flood, DOS UDP Flood, and DOS TCP Flood, alongside benign network traffic.

The initial phase of data collection involved identifying the optimal emitting frequency. Just as a radio needs to be tuned to a specific frequency, Ethernet cables leak data at particular frequencies. The researchers scanned a frequency range from 30 MHz to 260 MHz while simulating a DOS HTTP flood alongside benign traffic. They collected traces for approximately three hours, resulting in a dataset size of around 100 GB. To pinpoint the most effective frequency, they applied a dissimilarity analysis algorithm, specifically Normalized Cross-Correlation. This analysis revealed that at 240 MHz, the EM patterns for benign and attack traffic were most dissimilar, making the attack traffic highly distinguishable.

Once the optimal frequency of 240 MHz was identified, traces were then collected at this specific frequency for all three chosen attack types (DOS HTTP, DOS UDP, DOS TCP) and benign traffic. This phase involved collecting data for approximately two hours, leading to a dataset of approximately 1TB. Visual inspection of these plotted traces confirmed distinct patterns, with HTTP flood being particularly distinguishable.

To automate the detection process and provide quantitative measures, machine learning (ML) algorithms were employed. The researchers selected three lightweight classifiers suitable for potential deployment on resource-constrained devices:

1. Random Forest Classifier with Ada Boosting: This ensemble method combines multiple decision trees, with Ada Boosting enhancing the performance of weaker classifiers. It demonstrated the best overall accuracy.
2. Multi-Layer Perceptron (MLP): A basic feedforward artificial neural network.
3. Support Vector Machines (SVM): A supervised learning model used for classification and regression analysis.

The performance of these models was evaluated using accuracy, precision, and recall, with top-1 testing accuracy as the primary metric. The results confirmed that DOS HTTP flood was the most recognizable, with Random Forest with Ada Boosting consistently outperforming the other two algorithms.

Several crucial scenarios were investigated to understand the practical aspects and limitations of this approach:

• Probe Location: The impact of antenna placement was tested by varying the distance from the cable: in direct contact, 1 cm away, and 10 cm away. The results showed a drastic drop in detection accuracy when the antenna was not in direct contact, highlighting the sensitivity of EM signal capture.
• Attack Phase (Splitting into Thirds): To determine if specific phases of an attack were more detectable, the collected traces were divided into start, middle, and end segments. The middle phase generally showed higher accuracy, but detection was feasible across all phases.
• Sampling Rate Reduction: To address concerns about data volume and computational overhead for resource-constrained devices, the sampling rate was progressively reduced from 20 MHz to 10 MHz and then to 4 MHz. For HTTP flood, Random Forest and SVM maintained high accuracy even at lower sampling rates, demonstrating potential for optimization. MLP, however, saw a decline.
• Environmental Effects: Recognizing that EM environments are dynamic, the entire hardware setup was moved to different locations within the lab, and the victim device was also swapped. This revealed that environmental factors significantly altered the EM radiation patterns, impacting detection accuracy and suggesting that real-world systems might require dynamic calibration.

Demo / Proof of Concept

▶ Watch: Critical impact of probe placement on accuracy (10:30)

The talk presented the findings of a proof-of-concept research, demonstrating the theoretical and practical feasibility of using electromagnetic side-channel analysis for network attack detection in wired Ethernet environments. While the presentation did not include a live demonstration of the system in action, the experimental setup and methodology described, along with the detailed results, constitute the proof of concept. The speaker effectively showcased that EM radiation from network cables can be captured, analyzed, and used to classify malicious traffic patterns with a measurable degree of accuracy. The research successfully moved from hypothesis to empirical validation, providing a foundational understanding for future development of dedicated monitoring solutions.

Defensive Implications

▶ Watch: Future work: Enhancing models and expanding threat detection (15:40)

The findings of this research carry significant defensive implications for the security and forensic readiness of Industrial Control Systems. The proposed methodology offers a unique, low-overhead, and non-invasive approach to enhance threat detection capabilities in environments traditionally difficult to secure with conventional methods.

The core defensive strategy proposed is the deployment of EM monitoring nodes strategically throughout the ICS infrastructure. These nodes would be purpose-built devices capable of:

1. Capturing EM radiation: Using specialized antennas in close proximity or direct contact with critical network cables.
2. Running analysis algorithms: Implementing lightweight machine learning models (like the Random Forest Classifier with Ada Boosting) to continuously analyze captured EM traces.
3. Detecting anomalies: Identifying deviations from established benign EM patterns that signify potential network attacks.
4. Triggering forensic mechanisms on demand: Upon detection of an anomaly, these nodes would not directly intervene in the network but would alert operators and/or activate other forensic tools, such as packet sniffers, to collect detailed network traffic for deeper investigation. This "on-demand" activation minimizes the overhead of continuous full-packet capture, which is often prohibitive in ICS.

These monitoring nodes could be placed at various critical levels of the ICS architecture:

• Industrial workstations: Where human operators interact with the system.
• Human-Machine Interfaces (HMI): Control panels for managing processes.
• PLCs (Programmable Logic Controllers), IEDs (Intelligent Electronic Devices), and RTUs (Remote Terminal Units): Core control devices.
• Sensors and Actuators: The field level where physical processes are directly controlled.

The advantages of this approach for ICS defense are manifold:

• No Extra Network Load: Unlike traditional network-based intrusion detection systems (IDS) or extensive logging, EM monitoring operates entirely out of band. It does not introduce any additional traffic, latency, or computational burden on the ICS network itself, which is crucial for systems with strict real-time performance requirements.
• Independent Operation: The monitoring nodes operate independently of the monitored system. This means they do not interfere with the operational integrity or uptime of critical processes. System shutdowns are not required for monitoring or forensic data collection at the EM level.
• Resilience to Encryption: As EMSCA analyzes the physical manifestation of data transmission rather than the data content itself, it remains effective even when network traffic is encrypted. This bypasses a significant challenge for many traditional security tools.
• Early Threat Detection: By operating at the physical layer, EM monitoring can potentially detect anomalies at a very early stage, possibly before they manifest as logical network events that higher-layer security tools would recognize.
• Enhanced Forensic Readiness: This system directly contributes to forensic readiness by providing an independent, tamper-resistant source of evidence for post-incident analysis. By triggering packet sniffers only when anomalous EM activity is detected, it ensures that high-fidelity forensic data is collected precisely when needed, without the overhead of continuous, ubiquitous capture. This allows for rapid incident response, root cause analysis, and compliance with industry regulations.

While the research is a proof of concept, the defensive implications are clear: EM side-channel monitoring offers a promising, non-traditional security layer that can significantly bolster the resilience and forensic capabilities of legacy and modern ICS environments, addressing critical gaps where conventional security measures fall short.

Key Takeaways

• Non-Intrusive, Low-Overhead Detection: Electromagnetic side-channel analysis provides a unique, non-intrusive, and low-overhead method for detecting network attacks in wired Industrial Control Systems (ICS), offering resilience to encryption and operating at the physical layer.
• Enhanced Forensic Readiness for ICS: Strategic deployment of EM monitoring nodes can significantly improve the forensic readiness of legacy ICS, enabling early threat detection and on-demand activation of forensic mechanisms without burdening critical infrastructure.
• Attack-Specific EM Signatures: Different network attack types generate distinct electromagnetic radiation patterns, which can be effectively classified using lightweight machine learning models, with Random Forest Classifier with Ada Boosting showing superior performance.
• Critical Deployment Considerations: Effective EM monitoring requires precise antenna placement (in direct contact with the cable) and careful calibration due to significant environmental sensitivity, which can alter radiation patterns and detection accuracy.
• Sampling Rate Optimization for Resource Constraints: For certain ML models (e.g., Random Forest, SVM), detection accuracy for specific attacks (e.g., HTTP flood) can be maintained even at reduced sampling rates, offering a path for deployment on resource-constrained ICS devices.
• Future Work and Expansion: The research highlights the need for further development, including enhancing ML models, testing in mixed traffic environments, expanding the threat model to cover more ICS-specific attacks, and developing dedicated, robust monitoring hardware.

About the Speaker(s)

Buddhima Weerasinghe is a doctoral researcher at the University of Colombo School of Computing in Sri Lanka. This presented paper is based on the final year research conducted during his undergraduate degree, showcasing his early contributions to the field of cybersecurity. He is currently in a transitional period, having recently completed his undergraduate studies and preparing to commence his PhD in September. His co-authors for this research were Asangakara Kasundi and Mars Canada.