# US 10,872,149 B1 · Anomaly detection based on side-channel emanations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,149 B1 - Document ID: US10872149B1 - Status: Granted - Kind: B1 - Application number: 16/045,368 - Filed: 2018-07-25 - Granted: 2020-12-22 - Earliest claimed: 2017-07-25 - Assignees: Perspecta Labs Inc. - Applicants: Vencore Labs, Inc. - Inventors: Scott Alexander; Josephine Micallef; Joshua Morman; Euthimios Panagos; Marc Pucci; Simon Tsang - Web page: https://patentgrep.com/patent/US10872149B1 ## CPC - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/567: {using dedicated hardware} - G06F 21/562: {Static detection} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A computer program product, a computer-implemented method, and a computer system include a processor(s) that obtains side channel emanations from a device. The processor(s) analyzes the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns. The processor(s) generates a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, where the NFA captures states and state transitions of the device. The processor(s) identifies an anomaly in the device, based on deviation in emanations from the device. ## Claims ### Claim 1 A computer-implemented method, comprising: obtaining, by one or more processors, side channel emanations from a device; analyzing, by the one or more processors, the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns; generating, by the one or more processors, a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, wherein the NFA captures states and state transitions of the device, and wherein correlating the distinct emanation patterns with states of the device further comprises: mapping, by the one or more processors, emissions comprising the emanation patterns to device states to generate device state labels; and identifying, by the one or more processors, an anomaly in the device, based on deviation in emanations from the device. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: disabling, by the one or more processors, network communications from the device, based on identifying the anomaly. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: alerting, by the one or more processors, a user of the device to the anomaly. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the device is an Internet of Things device. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the distinct emanation patterns and the timing characteristics comprise statistics properties of time spent in each emanation pattern of the distinct emanation patterns. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the states and the state transitions comprise timing characteristics. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the device comprises at least one of: an embedded microcontroller or an embedded microprocessor. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein identifying the anomaly comprises detecting a deviation in emanations from the device at a micro-benchmark, the method further comprising: analyzing, by one or more processors, execution of program logic on a device by the device processor; generating, by the one or more processors, based on observed differences in emanations from the device, one or more micro-benchmarks, wherein the one or more micro-benchmarks comprise segments of processor instructions or known code; and monitoring, by the one or more processors, emanations from the device, wherein the monitoring identifies the deviation in emanations from the device at the micro-benchmark from expected emanations from the device at the micro-benchmark. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the identifying further comprises: monitoring, by the one or more processors, side channel emanations from the device, wherein the device is communicatively coupled to one or more computing resources in a computer system, wherein the monitoring further comprises: isolating, by the one or more processors, side channel emanations from the device, from emissions of devices physically adjacent to the device; amplifying, by the one or more processors, the side channel emanations from the device; and converting, by the one or more processors, the side channel emanations from the device, into a data format for the one or more computing resources. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the anomaly based on the deviation in emanations from the device is selected from the group consisting of: an unexpected state transitions in the NFA and a given amount of time spent in a specific state. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the mapping comprises labelling unrecognized emissions of the emissions as unknown. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the anomaly based on the deviation in emanations from the device due to the unrecognized emissions. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein the device comprises a printer. ### Claim 14 A computer program product comprising: a non-transitory computer readable storage medium readable by one or more processors and storing instructions for execution by the one or more processors for performing a method comprising: obtaining, by the one or more processors, side channel emanations from a device; analyzing, by the one or more processors, the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns; generating, by the one or more processors, a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, wherein the NFA captures states and state transitions of the device, and wherein correlating the distinct emanation patterns with states of the device further comprises: mapping, by the one or more processors, emissions comprising the emanation patterns to device states to generate device state labels; and identifying, by the one or more processors, an anomaly in the device, based on deviation in emanations from the device. ### Claim 15 (depends on 14) The computer program product of claim 14, the method further comprising an action selected from the group consisting of: disabling, by the one or more processors, network communications from the device, based on identifying the anomaly; and alerting, by the one or more processors, a user of the device to the anomaly. ### Claim 16 (depends on 14) The computer program product of claim 14, wherein the anomaly based on the deviation in emanations from the device is selected from the group consisting of: an unexpected state transitions in the NFA and a given amount of time spent in a specific state. ### Claim 17 (depends on 14) The computer program product of claim 14, wherein identifying the anomaly comprises detecting a deviation in emanations from the device at a micro-benchmark, the method further comprising: analyzing, by one or more processors, execution of program logic on a device by the device processor; generating, by the one or more processors, based on observed differences in emanations from the device, one or more micro-benchmarks, wherein the one or more micro-benchmarks comprise segments of processor instructions or known code; and monitoring, by the one or more processors, emanations from the device, wherein the monitoring identifies the deviation in emanations from the device at the micro-benchmark from expected emanations from the device at the micro-benchmark. ### Claim 18 A system comprising: a memory; one or more hardware processors in communication with the memory; and program instructions executable by the one or more processors via the memory to perform a method, the method comprising: obtaining, by the one or more processors, side channel emanations from a device; analyzing, by the one or more processors, the side channel emanations to identify distinct emanation patterns and timing characteristics, wherein the timing characteristics are associated with transitions between the distinct emanation patterns; generating, by the one or more processors, a non-deterministic finite automaton (NFA) by correlating the distinct emanation patterns with states of the device, wherein the NFA captures states and state transitions of the device, and wherein correlating the distinct emanation patterns with states of the device further comprises: mapping, by the one or more processors, emissions comprising the emanation patterns to device states to generate device state labels; and identifying, by the one or more processors, an anomaly in the device, based on deviation in emanations from the device. ### Claim 19 (depends on 18) The system of claim 18, wherein identifying the anomaly comprises detecting a deviation in emanations from the device at a micro-benchmark, the method further comprising: analyzing, by one or more processors, execution of program logic on a device by the device processor; generating, by the one or more processors, based on observed differences in emanations from the device, one or more micro-benchmarks, wherein the one or more micro-benchmarks comprise segments of processor instructions or known code; and monitoring, by the one or more processors, emanations from the device, wherein the monitoring identifies the deviation in emanations from the device at the micro-benchmark from expected emanations from the device at the micro-benchmark. ### Claim 20 (depends on 18) The computer system of claim 18, wherein the anomaly based on the deviation in emanations from the device is selected from the group consisting of: an unexpected state transitions in the NFA and a given amount of time spent in a specific state.