Systems, methods, and apparatuses for intrusion detection and analytics using power characteristics such as side-channel information collection

An apparatus, comprising:

• a power management circuit configured to be operatively coupled to a processor, the power management circuit configured to send to the processor a first power signal and a second power signal that is an altered version of the first power signal and based on a regulatory function of the power management circuit;
• a sensor in communication with or included within at least one of the power management circuit or the processor, the sensor configured to detect a first side-channel information of the processor based on the first power signal and a second side-channel information of the processor based on the second power signal;
• and
• a notification circuit in communication with the sensor, the notification circuit configured to send a notification signal indicative of an anomaly of the processor when at least one of the first side-channel information or the second side-channel information indicate the anomaly of the processor.

A method, comprising:

• sending a first signal to a plurality of devices that are common in device type, each device from the plurality of devices having a detector configured to detect a side-channel information from that device during operation;
• receiving, from each device from the plurality of devices and after that device receives the first signal to that device, a second signal that represents side-channel information from that device;
• defining, using unsupervised learning, a baseline for the device type of the plurality of devices based on the side-channel information for each device from the plurality of devices;
• updating a database with the baseline for the device type of the plurality of devices, the database including a plurality of baselines including the baselines, each baseline from the plurality of baselines being for a device type from a plurality of device types.