Detect Information Leakage Research Articles

HT-PGFV: Security-Aware Hardware Trojan Security Property Generation and Formal Security Verification Scheme

Property-driven hardware verification provides a promising way to uncover design vulnerabilities. However, developing security properties that check for highly concealed security vulnerabilities remains a significant challenge. In this paper, we propose a scheme, called HT-PGFV, to implement hardware Trojan security property assertion automatic generation and formal security verification for Trojan-infected designs. In our scheme, we develop a hardware Trojan security property assertion generation method for automated hardware which can extract hardware Trojan security properties from Trojan-infected designs by performing the three main steps of Trojan-infected signal identification based on feature matching, influence-cone-analysis-based Trojan path identification, and information flow trace mining, and formulate them as SystemVerilog assertions. In addition, we develop a formal security verification method based on information flow analysis which can formally verify hardware Trojan security properties and detect hardware Trojans violating information flow security policies by checking the security of information flows via our developed RT-level hardware information flow security models. The proposed method is demonstrated on several Trojan benchmarks from Trust-Hub. Experimental results show that our scheme can generate hardware Trojan security property assertions for Trojan-infected designs and detect information leakage and functionality change hardware Trojans activated by external inputs or internal conditions.

Detecting Information Leakage Against Chinese Wall Policy Based on the Unfolding Technique of Colored Petri Nets

Detecting Information Leakage Against Chinese Wall Policy Based on the Unfolding Technique of Colored Petri Nets

Detection of the Information Leakage Channel from Multimode Optical Fiber Using a Silicone Photomultiplier

Currently, fiber-optic communication lines are widely used for data transmission. Despite the fact that the information signal propagates inside the optical fiber, covered with a protective shell, there are various ways to form information leakage channels from such fibers. The power control of the information signals transmitted over an optical fiber is one of the most common ways to detect an information leakage channel. This paper determines the parameters of a fiber-optic communication line based on multimode optical fibers for which silicon photomultipliers to detect information leakage channels can be used. The dependences of the branched power on the fiber bending diameter are presented. It has been found that the bending diameter increase leads to the branched power decrease and a decrease in the ability of the photodetector to detect power loss in the optical fiber. The value of the branched power of optical radiation with a wavelength of 850 nm is greater than for 650 nm for all studied bending diameters. It has been established that an increase in the optical radiation power introduced into the fiber to 10 mW makes it possible to detect power loss up to –0.005 dB for an optical radiation wavelength of 850 nm, and –0.142 dB for a wavelength of 650 nm. The results of this article can be used in systems for protecting information transmitted over fiber-optic communication lines.

Hardware Trojan Detection Using Effective Property-Checking Method

Hardware Trojans refer to additional logic maliciously implanted by attackers in integrated circuits (ICs). Because of the potential security threat of hardware Trojans, they have attracted extensive attention to security issues. As a formal verification method, property checking has been proved to be a powerful solution for hardware Trojan detection. However, existing property-checking methods are limited by the unity of security properties and the model explosion problem of formal models. The limitations above hinder the practical applications of these methods. To alleviate these challenges, we propose an effective property-checking method for hardware Trojan detection. Specifically, we establish the formal model based on the principle of finite state machine (FSM), and the method can alleviate the model explosion problem. For property writing, we extract the core behavior characteristics of hardware Trojans and then generate properties for the verification of certain types of hardware Trojans. Experimental results demonstrate that our approach is applicable to detect information leakage and denial of service (DoS) hardware Trojans by verifying security properties.

A high-level information flow tracking method for detecting information leakage

In this paper, we note that the hardware Trojans that leak information through the unspecified output pins are difficult to detect by functional testing or side-channel signal analysis. Especially, the Trojans that leak the information through the side channel has proven stealthy to be detected. To solve this problem, we propose a feature matching method based on information flow tracking at high abstraction level. In this paper, the Trojans features are summarized with the format of high-level information flow tracking, which can be used to detect the Trojans. Experimental results show that our method can successfully identify the above-mentioned Trojans from Trust-hub, DeTrust, and OpenCores in less than 20 ms, showing significantly lower time complexity compared with the existing works.

Способы обнаружения утечки информации по радиоканалам связи

Способы обнаружения утечки информации по радиоканалам связи

Selecting Critical Data Flows in Android Applications for Abnormal Behavior Detection

Nowadays, mobile devices are widely used to store and process user privacy and confidential data. With the popularity of Android platform, the cases of attacks against users’ privacy-sensitive data within Android applications are on the rise. Researchers have developed sophisticated static and dynamic analysis tools to detect information leakage. These methods cannot distinguish legitimate usage of sensitive data in benign apps from the intentional sensitive data leakages in malicious apps. Recently, malicious apps have been found to treat sensitive data differently from benign apps. These differences can be used to flag malicious apps based on their abnormal data flows. In this paper, we further find that some sensitive data flows show great difference between benign apps and malware. We can use these differences to select critical data flows. These critical flows can guide the identification of malware based on the abnormal usage of sensitive data. We present SCDFLOW, a tool that automatically selects critical data flows within Android applications and takes these critical flows as feature for abnormal behavior detection. Compared with MUDFLOW, SCDFLOW increases the true positive rate of malware detection by 5.73%~9.07% on different datasets and causes an ignorable effect on memory consumption.

Design of Function for Tracing Diffusion of Classified Information for IPC on KVM

The leaking of information has increased in recent years. To address this problem, we previously proposed a function for tracing the diffusion of classified information in a guest OS using a virtual machine monitor (VMM). This function makes it possible to grasp the location of classified information and detect information leakage without modifying the source codes of the guest OS. The diffusion of classified information is caused by the file operation, child process creation, and inter-process communication (IPC). In a previous study, we implemented the proposed function for a file operation and child process creation excluding IPC using a kernel-based virtual machine (KVM). In this paper, we describe the design of the proposed function for IPC on a KVM without modifying the guest OS. The proposed function traces the local and remote IPCs inside the guest OS from the outside so as to trace the information diffusion. Because IPC with an outside computer might cause an information leakage, tracing the IPCs enables the detection of such a leakage. We also report the evaluation results including the traceability and performance of the proposed function.