2018 Technology Innovation Program Heartbeat

Abstract

Heartbeat responds to this problem by focusing instead on the physical behavior of the device being protected, under the hypothesis that malware infection will produce a measurable change in the power consumption state of a device that can be picked up by an outside detector. All code execution uses power, so the execution of malware—especially polymorphic variants—will leave a trace on a power consumption record. The Heartbeat system collects power trace measurements directly from the hardware and so is invisible to malware and resilient to internet service interruption. By collecting power measurement data only during the periodic invocation of a single or of several system functions, Heartbeat will address several challenges that plague current anomaly-based intrusion detection systems and is operational-context agnostic.