Anomaly and malware detection using side channel analysis

A system, comprising;

• a power supply receiving electric current from an alternating current (AC) source, and providing the electric current to a target device;
• a monitoring component integrated with the power supply, the monitoring component comprising a sensor and one or more processors, wherein the sensor generates a signal corresponding to an amount of the electric current provided to the target device, and the one or more processors are configured to:
• sample the signal generated by the sensor to create a plurality of current samples;
• store the plurality of current samples in a data structure in a memory element of the monitoring component;
• retrieve a subset of the plurality of current samples from the data structure stored in the memory element;
• calculate a feature sample comprising at least one of a root-mean-square value or a skew value of the subset of the plurality of current samples;
• transmit the feature sample to a remote server;
• receive a classification of the feature sample from the remote server;
• and
• generate an alarm signal responsive to the classification of the feature sample indicating an anomaly.

A system, comprising;

• a target device receiving electric current from an alternating current (AC) source via a power supply;
• a monitoring component integrated with the target device, the monitoring component comprising a sensor and one or more processors, wherein the sensor generates a signal corresponding to an amount of the electric current received by the target device, and the one or more processors are configured to:
• sample the signal generated by the sensor to create a plurality of current samples;
• store the plurality of current samples in a data structure in a memory element of the monitoring component;
• retrieve a subset of the plurality of current samples from the data structure stored in the memory element;
• calculate a feature sample comprising at least one of a root-mean-square value or a skew value of the subset of the plurality of current samples;
• transmit the feature sample to a remote server;
• receive a classification of the feature sample from the remote server;
• and
• generate an alarm signal responsive to the classification of the feature sample indicating an anomaly.

A surge protector with an integrated monitoring component, comprising:

• a plurality of connectors each configured to provide electric current to at least one target device from an alternating current (AC) source;
• a monitoring component comprising a plurality of sensors and one or more processors, wherein:
• the plurality of sensors each correspond to a respective connector of the plurality of connectors, each of the plurality of sensors configured to generate a signal corresponding to an amount of the electric current provided by the respective connector;
• and
• the one or more processors are configured to:
• sample the signals generated by the plurality of sensors to create a plurality of current samples for each of the plurality of connectors;
• store the plurality of current samples for each of the plurality of connectors in a data structure in a memory element of the monitoring component;
• retrieve a subset of the plurality of current samples corresponding to a first connector of the plurality of connectors from the data structure stored in the memory element;
• calculate a feature sample comprising a root-mean-square value or a skew value of the subset of the plurality of current samples;
• transmit the feature sample to a remote server;
• receive a classification of the feature sample from the remote server;
• and
• generate, responsive to the classification of the feature sample indicating an anomaly, an alarm signal that identifies the at least one target device receiving the electric current from the first connector.