The increasing complexity and connectivity of modern embedded systems highlight the importance of runtime monitoring to ensure correctness and security. This poses a significant challenge, since monitoring tools can break extra-functional requirements such as timing constraints. Non-intrusive program tracing through side-channel analysis techniques have recently appeared in the literature and constitute a promising approach. Existing techniques, however, exhibit important limitations. In this paper, we present a novel technique for non-intrusive program tracing from power consumption, based on a signals and system analysis approach: we view the power consumption signal as the output of a system with the power consumption of training samples as input. Using spectral analysis, we compute the impulse response to identify the system; the intuition is that for the correct training sample, the system will appear close to a system that outputs a shifted copy of the input signal, for which the impulse response is an impulse at the position corresponding to the shift. We also use the Control Flow Graph from the source code to constrain the classifier to valid sequences only, leading to substantial performance improvements over previous works. Experimental results confirm the effectiveness of our technique and show its applicability to runtime monitoring. The experiments include tracing programs that execute randomly generated sequences of functions as well as tracing a real application developed with SCADE. The experimental evaluation also includes a case-study as evidence of the usability of our technique to detect anomalous execution through runtime monitoring.

中文翻译：

---

通过功耗进行非侵入式运行时监控，以加强嵌入式系统中的安全和安保属性

现代嵌入式系统日益增加的复杂性和连接性凸显了运行时监控以确保正确性和安全性的重要性。这带来了重大挑战，因为监控工具可以打破额外的功能需求，例如时序约束。通过旁道分析技术进行的非侵入式程序跟踪最近出现在文献中，并构成了一种有前途的方法。然而，现有技术表现出重要的局限性。在本文中，我们基于信号和系统分析方法提出了一种从功耗进行非侵入式程序跟踪的新技术：我们将功耗信号视为系统的输出，并将训练样本的功耗作为输入。使用频谱分析，我们计算脉冲响应以识别系统；直觉是，对于正确的训练样本，系统将看起来接近于输出输入信号的移位副本的系统，对于该系统，脉冲响应是与移位对应的位置处的脉冲。我们还使用源代码中的控制流图将分类器限制为仅有效序列，从而比以前的工作显着提高性能。实验结果证实了我们技术的有效性，并表明其适用于运行时监控。实验包括跟踪执行随机生成的函数序列的程序以及跟踪使用 SCADE 开发的真实应用程序。实验评估还包括一个案例研究，作为我们的技术通过运行时监控检测异常执行的可用性的证据。