diff --git a/PhD/research_proposal/frontpages.tex b/PhD/research_proposal/frontpages.tex index fdfea4e..9a9bb73 100644 --- a/PhD/research_proposal/frontpages.tex +++ b/PhD/research_proposal/frontpages.tex @@ -65,8 +65,8 @@ The following served on the Examining Committee for this thesis. The decision of \noindent \begin{tabbing} Internal-External Member: \= \kill % using longest text to define tab length -Internal Mamber: \> Mark Crowley \\ -\> Professor, Dept. Electrical and Computer Engineering\\ +Internal-External Member: \> Diogo Barradas\\ +\> Assistant Professor, Cheriton School of Computer Science\\ \> University of Waterloo \\ \end{tabbing} \bigskip @@ -83,7 +83,7 @@ Internal Member: \> Catherine Gebotys\\ \noindent \begin{tabbing} Internal-External Member: \= \kill % using longest text to define tab length -Internal Member: \> Patrick Mitran\\ +Internal Member: \> Mark Crowley\\ \> Professor, Dept. Electrical and Computer Engineering\\ \> University of Waterloo \\ \end{tabbing} @@ -108,8 +108,24 @@ Supervisor: \> Sebastian Fischmeister \\ \addcontentsline{toc}{chapter}{Abstract} \begin{center}\textbf{Abstract}\end{center} -This is the abstract. +Most current Intrusion Detection Systems (IDSs) share the flaw of requiring the cooperation of the system to protect. +Whether the IDS is a software or hardware component, they don't perform the detection independently and require the system to protect to execute or call them. +This is a critical flaw as it allows attackers to avoid detection by forging input data, forging detection results, or bypassing the IDS altogether. +This is particularly problematic for firmware-level attacks that enable control of the most critical components of the machine, making the attacks especially difficult to detect, mitigate, and remove. +This observation leads to the conclusion that we cannot entrust machines to assess their integrity. +To remain trustworthy, the IDS must be independent of the machine to protect and require no cooperation to perform the detection. +The main challenge with such a system is getting access to relevant data. +Network-based IDS fit in this category and exhibit complete independence, but their input data --- network communication from the machine --- is only relevant for a small subset of attacks. + +This thesis proposes to explore another family of IDSs called physics-based IDS that leverages side-channel information. +Side-channel information is a perfect candidate for intrusion detection. +The generation of this information is, by definition, involuntary. +Hence, their measurement requires no communication with the machine to protect. +Moreover, if chosen carefully, side-channel information can provide insight into all activities performed by the machine. +Finally, side-channel information remains practical to measure on virtually any embedded system, providing a solution that is not only theoretical but also applicable in the real world. + +This proposal describes the exploratory work already achieved in the domain of physics-based IDS and outlines the main problems to study to evaluate the potential of this technology. \cleardoublepage \phantomsection % allows hyperref to link to the correct page