Reverse engineering smart card malware using side channel analysis with machine learning techniques

Djonon Tsague, HippolyteTwala, B2017-06-072017-06-072016-12Djonon Tsague, H. and Twala, B. 2016. Reverse engineering smart card malware using side channel analysis with machine learning techniques. 2016 IEEE International Conference on Big Data (Big Data), 5-8 December 2016, Bethesda, MD, USA. DOI: 10.1109/BigData.2016.7841039978-1-4673-9006-4http://ieeexplore.ieee.org/document/7841039/DOI: 10.1109/BigData.2016.7841039http://hdl.handle.net/10204/9159Copyright: 2016 EE Publishers. Due to copyright restrictions, the attached PDF file only contains the abstract of the full text item. For access to the full text item, please consult the publisher's website.From inception, side channel leakage has been widely used for the purposes of extracting secret information, such as cryptographic keys, from embedded devices. However, in a few instances it has been utilized for extracting other information about the internal state of a computing device. In this paper, we exploit side channel information to recover large parts of the Sykipot malware program executed on a smart card. We present the first methodology to recover the program code of a smart card malware by evaluating its power consumption only. Besides well-studied methods from side channel analysis, we apply a combination of dimensionality reduction techniques in the form of PCA and LDA models to compress the large amount of data generated while preserving as much variance of the original data as possible. Among feature extraction techniques, PCA and LDA are very common dimensionality reduction algorithms that have successfully been applied in many classification problems like face recognition, character recognition, speech recognition, etc. with the chief objective being to eliminate insignificant data (without losing too much information) during the pre-processing step. In addition to quantifying the potential of the created side channel based disassembler, we highlight its diverse and unique application scenarios.enSide channel leakageElectromagnetic templatesPrincipal components analysisLinear discriminant analysisMultivariate Gaussian distributionk-Nearest neighbours algorithmReverse engineeringReverse engineering smart card malware using side channel analysis with machine learning techniquesConference PresentationDjonon Tsague, H., & Twala, B. (2016). Reverse engineering smart card malware using side channel analysis with machine learning techniques. IEEE. http://hdl.handle.net/10204/9159Djonon Tsague, Hippolyte, and B Twala. "Reverse engineering smart card malware using side channel analysis with machine learning techniques." (2016): http://hdl.handle.net/10204/9159Djonon Tsague H, Twala B, Reverse engineering smart card malware using side channel analysis with machine learning techniques; IEEE; 2016. http://hdl.handle.net/10204/9159 .TY - Conference Presentation AU - Djonon Tsague, Hippolyte AU - Twala, B AB - From inception, side channel leakage has been widely used for the purposes of extracting secret information, such as cryptographic keys, from embedded devices. However, in a few instances it has been utilized for extracting other information about the internal state of a computing device. In this paper, we exploit side channel information to recover large parts of the Sykipot malware program executed on a smart card. We present the first methodology to recover the program code of a smart card malware by evaluating its power consumption only. Besides well-studied methods from side channel analysis, we apply a combination of dimensionality reduction techniques in the form of PCA and LDA models to compress the large amount of data generated while preserving as much variance of the original data as possible. Among feature extraction techniques, PCA and LDA are very common dimensionality reduction algorithms that have successfully been applied in many classification problems like face recognition, character recognition, speech recognition, etc. with the chief objective being to eliminate insignificant data (without losing too much information) during the pre-processing step. In addition to quantifying the potential of the created side channel based disassembler, we highlight its diverse and unique application scenarios. DA - 2016-12 DB - ResearchSpace DP - CSIR KW - Side channel leakage KW - Electromagnetic templates KW - Principal components analysis KW - Linear discriminant analysis KW - Multivariate Gaussian distribution KW - k-Nearest neighbours algorithm KW - Reverse engineering LK - https://researchspace.csir.co.za PY - 2016 SM - 978-1-4673-9006-4 T1 - Reverse engineering smart card malware using side channel analysis with machine learning techniques TI - Reverse engineering smart card malware using side channel analysis with machine learning techniques UR - http://hdl.handle.net/10204/9159 ER -