# Hybrid Cryptographic Monitoring System for Side-Channel Attack Detection on PYNQ SoCs

## TL;DR

This paper introduces a lightweight, real-time hybrid detection system combining statistical and machine learning methods to identify side-channel attacks on AES-128 encryption in embedded PYNQ SoCs, enhancing security without hardware modifications.

## Contribution

It presents a novel dual-detection framework that integrates statistical thresholds and ML classifiers for effective side-channel attack detection on resource-constrained embedded systems.

## Key findings

- ML approach outperforms static thresholds in accuracy
- Framework operates in real-time on embedded platforms
- No modification of AES internals required

## Abstract

AES-128 encryption is theoretically secure but vulnerable in practical deployments due to timing and fault injection attacks on embedded systems. This work presents a lightweight dual-detection framework combining statistical thresholding and machine learning (ML) for real-time anomaly detection. By simulating anomalies via delays and ciphertext corruption, we collect timing and data features to evaluate two strategies: (1) a statistical threshold method based on execution time and (2) a Random Forest classifier trained on block-level anomalies. Implemented on CPU and FPGA (PYNQ-Z1), our results show that the ML approach outperforms static thresholds in accuracy, while maintaining real-time feasibility on embedded platforms. The framework operates without modifying AES internals or relying on hardware performance counters. This makes it especially suitable for low-power, resource-constrained systems where detection accuracy and computational efficiency must be balanced.