Logo image
From Capture-Recapture to No Recapture: Efficient SCAD Even After Software Updates
Journal article   Open access   Peer reviewed

From Capture-Recapture to No Recapture: Efficient SCAD Even After Software Updates

Kurt A Vedros, Aleksandar Vakanski, Domenic J Forte and Constantinos Kolias
Sensors (Basel, Switzerland), Vol.26(1), 118
12/24/2025
PMID: 41516553

Abstract

generative adversarial networks side-channel analysis anomaly detection
Side-Channel-based Anomaly Detection (SCAD) offers a powerful and non-intrusive means of detecting unauthorized behavior in IoT and cyber-physical systems. It leverages signals that emerge from physical activity-such as electromagnetic (EM) emissions or power consumption traces-as passive indicators of software execution integrity. This capability is particularly critical in IoT/IIoT environments, where large fleets of deployed devices are at heightened risk of firmware tampering, malicious code injection, and stealthy post-deployment compromise. However, its deployment remains constrained by the costly and time-consuming need to re-fingerprint whenever a program is updated or modified, as fingerprinting involves a precision-intensive manual capturing process for each execution path. To address this challenge, we propose a generative modeling framework that synthesizes realistic EM signals for newly introduced or updated execution paths. Our approach utilizes a Conditional Wasserstein Generative Adversarial Network with Gradient Penalty (CWGAN-GP) framework trained on real EM traces that are conditioned on Execution State Descriptors (ESDs) that encode instruction sequences, operands, and register values. Comprehensive evaluations at instruction-level granularity demonstrate that our approach generates synthetic signals that faithfully reproduce the distinctive features of real EM emissions-achieving 85-92% similarity to real emanations. The inclusion of ESD conditioning further improves fidelity, reducing the similarity distance by ∼13%. To gauge SCAD utility, we train a basic semi-supervised detector on the synthetic signals and find ROC-AUC results within ±1% of detectors trained on real EM data across varying noise conditions. Furthermore, the proposed 1DCNNGAN model (a CWGAN-GP variant) achieves faster training and reduced memory requirements compared with the previously leading ResGAN.
url
Article Landing PageView
Published (Version of record) Open

Metrics

1 Record Views

Details

Logo image