SBIR Phase II: Anomaly and malware detection using AC power analysis

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase II project will be an improved cybersecurity posture among industries that rely on mission-critical computing systems that are difficult to patch and/or monitor. Many technical failures on these systems, including information breaches, equipment malfunctions, and malware infestations, stem from longstanding problems that go undetected. This project develops nonintrusive measurement and analytics tools that give IT operators operational visibility into high-assurance assets, increasing confidence in their correct operation. This project will reduce losses due to unscheduled maintenance across industries, improve the trustworthiness of embedded and semi-embedded systems such as software-based medical devices, and reduce the business risk of breaches and malware damage at organizations that rely on hard-to-manage devices. This project also advances the state of the art in detecting rogue software execution and other anomalies through nonintrusive side channels, such as observing power signals collected on a wall outlet. This Small Business Innovation Research (SBIR) Phase II project aims to extend operational visibility of IT departments into mission-critical computing equipment using a novel combination of nonintrusive signal collection and machine learning. From infusion pumps to Internet routers to retail point-of-sale terminals, organizations rely on fixed-purpose computing systems. With this reliance comes three key risks. First, the effects of unscheduled interruptions to critical systems ripple outward to other business areas. Second, critical systems are often incompatible with constantly changing mainstream tools such as host-based antivirus and intrusion-detection systems. Third, critical systems often lag behind other systems patch levels because they are rarely taken out of service for patching. This project addresses these challenges by providing nonintrusive monitoring for critical systems in situ, reducing the risk of unscheduled downtime due to abnormal behavior. The company's monitoring hardware and software observe software execution from the vantage point of the power line, requiring no modifications to monitored systems and extending the ability of operators to understand what critical systems are doing.