Detect Network API-related Call Modifications of Embedded Systems through EM-SCA.

Abstract

ABSTRACT In the rapidly evolving landscape of Industry 4.0, embedded devices play a pivotal role in connecting cyber-physical systems and enabling real-time data exchange. However, this interconnectedness also exposes IoT ecosystems to significant threats, including malicious code injections and unauthorized network API calls that can exfiltrate sensitive information. This thesis investigates the feasibility of employing EM-SCA as a non-invasive method to detect and quantify such firmware tampering in embedded systems. By capturing EM signals from a NodeMCU device during both legitimate (manufacturer-authenticated) and unauthenticated API executions, distinct emission patterns are identified. A NodeMCU microcontroller to simulate both authenticated and unauthenticated network API exchanges within a controlled environment. EM emissions were monitored using an H-loop probe and HackRF One SDR device, targeting prominent frequency leakage bands. Statistical analysis, employing t-tests at a 95% confidence interval, identified significant EM signature deviations between authenticated and compromised firmware conditions. SVM classifiers achieved over 81% accuracy in distinguishing these states, while a refined analysis focusing solely on request payload modifications attained 79% accuracy. A Neural Network model further improved detection performance, reaching 82% accuracy for identifying subtle data leakage variations. These findings demonstrate the efficacy of EM-based side-channel monitoring as a robust, non-invasive approach for real-time malicious code detection in constrained IoT environments.