Watch me, but don't touch me! contactless control flow monitoring via electromagnetic emanations

Abstract

Trustworthy operation of industrial control systems depends on secure and real-time code execution on the embedded programmable logic controllers (PLCs). The controllers monitor and control the critical infrastructures, such as electric power grids and health-care platforms, and continuously report back the system status to human operators. We present Zeus, a contactless embedded controller security monitor to ensure its execution control low integrity. Zeus leverages the electromagnetic emission by the PLC circuitry during the execution of the controller programs. Zeus’s contactless execution tracking enables non-intrusive monitoring of security-critical controllers with tight real-time constraints. Those devices often cannot tolerate the cost and performance overhead that comes with additional traditional hardware or software monitoring modules. Furthermore, Zeus provides an air-gap between the monitor (trusted computing base) and the target (potentially compromised) PLC. This eliminates the possibility of the monitor infection by the same attack vectors. Zeus monitors for control low integrity of the PLC program execution. Zeus monitors the communications between the human-machine interface and the PLC, and captures the control logic binary uploads to the PLC. Zeus exercises its feasible execution paths, and ingerprints their emissions using an external electromagnetic sensor. Zeus trains a neural network for legitimate PLC executions, and uses it at runtime to identify the control low based on PLC’s electromagnetic emissions. We implemented Zeus on a commercial Allen Bradley PLC, which is widely used in industry, and evaluated it on real-world control program executions. Zeus was able to distinguish between diferent legitimate and malicious executions with 98.9% accuracy and with zero overhead on PLC execution by design.

Publication
In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security
Sriharsha Etigowni
Sriharsha Etigowni
Post Doctoral Research Associate

My research interests include Cyber-Physical Security, Embedded System Security and Industrial Control System Security.