Anomaly detection based on side-channel emanations

A computer program product comprising:

• a non-transitory computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising:
• obtaining, by the one or more processors, side channel emanations from a device;
• analyzing, by the one or more processors, the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns;
• generating, by the one or more processors, a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, wherein the NFA captures states and state transitions of the device, and wherein correlating the distinct emanation patterns with states of the device further comprises:
• mapping, by the one or more processors, emissions comprising the emanation patterns to device states to generate device state labels;
• and
• identifying, by the one or more processors, an anomaly in the device, based on deviation in emanations from the device.

A system comprising:

• a memory;
• one or more hardware processors in communication with the memory;
• and program instructions executable by the one or more processors via the memory to perform a method, the method comprising:
• obtaining, by the one or more processors, side channel emanations from a device;
• analyzing, by the one or more processors, the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns;
• generating, by the one or more processors, a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, wherein the NFA captures states and state transitions of the device, and wherein correlating the distinct emanation patterns with states of the device further comprises:
• mapping, by the one or more processors, emissions comprising the emanation patterns to device states to generate device state labels;
• and
• identifying, by the one or more processors, an anomaly in the device, based on deviation in emanations from the device.