# Application Inference using Machine Learning based Side Channel Analysis

## TL;DR

This paper demonstrates a machine learning approach to infer applications on Android devices by analyzing electromagnetic emissions and CPU frequency states, achieving high accuracy in early detection of known and unknown apps.

## Contribution

It introduces a novel supervised learning method utilizing EM side-channel features and CPU frequency states for application inference on complex SoCs, enhancing security analysis.

## Key findings

- Achieved at least 85% accuracy in detecting unknown applications.
- Demonstrated early detection capability on ARMv8 Snapdragon 820 platform.
- Showed that learning CPU frequency patterns suffices for application inference.

## Abstract

The proliferation of ubiquitous computing requires energy-efficient as well as secure operation of modern processors. Side channel attacks are becoming a critical threat to security and privacy of devices embedded in modern computing infrastructures. Unintended information leakage via physical signatures such as power consumption, electromagnetic emission (EM) and execution time have emerged as a key security consideration for SoCs. Also, information published on purpose at user privilege level accessible through software interfaces results in software only attacks. In this paper, we used a supervised learning based approach for inferring applications executing on android platform based on features extracted from EM side-channel emissions and software exposed dynamic voltage frequency scaling(DVFS) states. We highlight the importance of machine learning based approach in utilizing these multi-dimensional features on a complex SoC, against profiling-based approaches. We also show that learning the instantaneous frequency states polled from onboard frequency driver (cpufreq) is adequate to identify a known application and flag potentially malicious unknown application. The experimental results on benchmarking applications running on ARMv8 processor in Snapdragon 820 board demonstrates early detection of these apps, and atleast 85% accuracy in detecting unknown applications. Overall, the highlight is to utilize a low-complexity path to application inference attacks through learning instantaneous frequency states pattern of CPU core.