The rapid expansion of digital technologies and interconnected systems has brought about an unprecedented need for safeguarding sensitive information against an array of hardware security threats. Among these threats are Hardware Trojan insertion, Reverse Engineering Side-Channel Attacks, and SAT attacks, which pose substantial risks to the confidentiality and integrity of various devices, ranging from smart cards to cloud computing infrastructures. This thesis presents a comprehensive examination of these security threats, encompassing their underlying principles, attack methodologies, and existing countermeasures, with a specific focus on analyzing the effectiveness of countermeasures and exploring potential future trends. To address these hardware security challenges, the thesis surveys current state-of-the-art AI/ML hardware accelerators, evaluating their resilience to hardware errors and mitigation strategies, while advocating for a multi-faceted approach to ensuring hardware system integrity. Additionally, the study addresses the evolution and impact of side-channel attacks, elucidating the exploitation of power consumption patterns, fault injection techniques, and physical characteristics of systems. The research proposes robust countermeasures and security-aware Electronic Design Automation (EDA) tools, leveraging STT-MRAM-based LUTs and routing-based obfuscation to design reconfigurable and interconnected logic blocks, offering reliable, low-power, and SAT-hard instances. Additionally, an EDA tool flow is established for automating the placement of lock blocks and optimizing security, achieving enhanced protection with minimal power and area overhead. Furthermore, the study highlights the importance of verification methodologies, particularly the Universal Verification Methodology (UVM), for checking design specifications. By providing a comprehensive overview of hardware security threats and their corresponding countermeasures, this thesis contributes to the development of more secure hardware designs, underscoring the necessity of a multi-faceted approach to safeguarding hardware system integrity.

The increasing cost of manufacturing the complex Integrated Circuits (ICs) and ever-rising competition to shorten time-to-market have given rise to the trend of fabless manufacturing. Moreover, the addition of various players in the product manufacturing lifecycle has endangered the security of Intellectual Property (IP). “Logic locking” and “IC camouflaging” are amongst the most prevalent protection schemes that can thwart various hardware security threats. However, the state-of-the-art attacks such as Boolean Satisfiability Attack (SAT-attack) and approximation-based attacks, question the efficacy of the existing defense schemes.

Recent solutions to protect hardware designs from various hardware security threats have employed a myriad of obfuscation techniques. However, these solutions have mostly focused on specific design elements such as “SAT-hardness”. Despite meeting the focused criterion such as “SAT-hardness” for maximizing security, obfuscated designs are still vulnerable to the newly evolving attack vectors. To mitigate this problem and provide a better solution that can thwart SAT-attackand provide better resilience against evolving attack vectors, Look-Up Table (LUT)-based obfuscation is studied. This work provides an extensive analysis of LUT-based obfuscation by exploring several factors such as LUT technology, size, number of LUTs, and replacement strategy as they have a substantial influence on the Power-Performance-Area (PPA) and security of the design.

For making the reconfigurable logic obfuscation efficient in terms of design overheads, this work further proposes a novel architecture using LUT. Additionally, a study is conducted with different threat models and attack vectors to show that the security provided by the proposed primitive is superior to that of the traditional ways of LUT-based obfuscation.

While many existing works have focused on mitigating the well-known SAT attack and its derivatives, there hasn’t been much research on preventing Power Side-Channel Attacks (PSCAs), which have the capability to retrieve the sensitive contents of the IP in a non-invasive manner. Using P-SCA for unlocking the obfuscated circuit, does not require the laborious task of simulating powerful SAT attacks. For maximizing the security, and curbing P-SCA, the work proposes a “defense-in-depth obfuscation” which builds on our existing LUT-based solution. The proposed obfuscation is tailored such that LUT-based obfuscation incurs minimal overheads while providing a full-scale robust solution to secure the hardware.

Additionally, this work invents a security-driven design flow, which uses off-the-shelf industrial Electronic Design Automation (EDA) tools for easier obfuscation of the design. This proposed flow is meticulously crafted in a way such that it is non-disruptive to the current industrial physical design flow. To enable this flow one must overcome some obstacles; as there is a lack of frameworks and unified methods that can validate the security and functionality of obfuscated designs This work has discussed the challenges of validating the security and functionality of obfuscated designs and further presents the methodology of verifying the functionality for the LUT-based obfuscated IP (pre and post-fabrication). Additionally, Security Evaluation Platform for Hardware Logic Obfuscation using Intelligent Artificial Neural Net (SEPIANN) is proposed to validate the security of the design. This system-level framework instantaneously estimates the obfuscation strength in terms of attack resiliency time eliminating the need to simulate de-obfuscation using the SAT attack.

Finally, the work shows the application and scalability of the proposed work by fabricating various security and computing cores by obfuscating them with the LUT-based obfuscation.

As modern technology advances and more users are utilizing the internet, people’s information has become accessible to the public. Although sensitive information such as ID numbers, bank accounts, or passwords might not be publicly discoverable, an individual’s name, interests, education, and social connections may be discoverable.

This research aims to assess the effectiveness of spear phishing emails built upon publicly available information, focusing on individuals within academia as the subjects. The social network of the subjects would be constructed using an information scraper built with Python and machine learning algorithms. The content of the emails would be generated by a Large Language Model (LLM). The experiment aims to evaluate the efficacy of AI-driven target selection through the response rates of email opening and engagement of the embedded link.

Our hypothesis posits that publicly disclosed personal information potentially threatens an individual’s online security and privacy. This vulnerability is manifested through a greater susceptibility to spear phishing attacks and inferred private information using machine learning techniques.

Additionally, we would discuss some mitigation strategies from the perspectives of email service providers, organizations, and users. Our goal is to warn the public regarding the potential threats of publicly available information being accessible to attackers. Being aware of phishing attacks that rely on personal social networks could reduce the success rate of such attack angle.

The daily use of mobile phones, and particularly smartphones, has become an integral part of modern civilization. With the continued adoption of smartphones by users world wide, an abundance of applications to meet their various demands is a necessity. A plethora of applications are provided through markets, such as the Google Play Store, that allow users to download applications directly to their device. As the Google Play Store is one of the most popular markets, they provide considerably robust security, and users have trust in their ability to properly vet hosted products. Be that as it may, there exists a subset of society which seeks to exploit and take advantage of unsuspecting victims. Due to the robustness of the security scanning, malware developers must circumvent marketplace security controls. An example of an exploit is called piggybacking. In this case, a benign application can be prepared for an update attack with the piggybacking technique that injects the malicious code. Detecting this change in the application is the main focus of the study. Because of the piggybacking technique, which is cleverly obfuscated, static analysis is not a consistent method to detect malice; hardware performance counters (HPCs) that are capable of dynamic analysis are adopted to explore whether the HPCs have the potential to detect clandestine applications. HPCs were utilized to observe the possibility of detection of piggybacked applications, furthermore, the piggybacked applications that contain the update attacks. HPC data was collected via a rooted phone with automated pipelines, and for the depth of the study, the comparison between static data and dynamic data was provided with visualization, call graphs and scatter graphs. Additionally, a machine learning tool, WEKA, was utilized to discover whether the data can classify the applications into benign or malicious. Six different classifiers are selected, and as a result, the Decision Tree classifiers achieved around 94% to 99% detect accuracy proving that HPCs are a viable method to detect update malware. The result led us to determine whether HPCs are utilizable to detect embedded malware.

The increasing reliance on digital technologies and connected systems has amplified the need for securing sensitive information from a multitude of hardware security threats. Side-channel attacks, SAT attacks, and hardware Trojans pose significant risks to the integrity and confidentiality of devices ranging from smart cards to cloud computing infrastructures. The thesis provides a comprehensive analysis of these security threats, exploring their underlying principles, attack techniques, and existing countermeasures while focusing on the analysis of the countermeasures and future trends.

The study focuses on the evolution and impact of side-channel attacks addressing the exploitation of power, timing, electromagnetic, acoustic, and optical patterns, fault injection techniques, and physical characteristics of systems. The thesis delves into the increasing prominence of SAT attacks and the role of logic locking in preventing hardware security breaches throughout the global supply chain. In addition, the research investi- gates the threat of hardware Trojans in ASIC-specific AI/ML hardware accelerators and their potential consequences on the accuracy and reliability of ML models.

To counter these challenges, the thesis combines approaches and contributions from three works to develop robust countermeasures and security-aware Electronic Design Au- tomation (EDA) tools. The research aims to design and implement reconfigurable and interconnecting logic blocks using STT-MRAM-based LUTs and routing-based obfusca- tion, offering a reliable, low-power, and SAT-hard instance. The thesis also seeks to develop an EDA tool flow to automate the placement of lock blocks and security opti- mization, achieving security with minimal power and area overhead. Furthermore, the study surveys the current state-of-the-art AI/ML hardware accelerators, their inherent robustness to hardware errors, and their mitigation strategies, emphasizing the necessity for a multi-faceted approach to ensuring hardware system integrity.

By providing a comprehensive overview of hardware security threats and their counter- measures, this thesis contributes to the development of more secure cryptographic systems and AI/ML hardware accelerators highlighting the need for a multi-faceted approach to ensure hardware system integrity.

In recent times, the exponential surge in firmware demand and shorter Time-to-Market have underscored the necessity for proficient and precise firmware security analysis. But firmware security analysis has never been an easy job due to its complexity, lack of source code and limited resources. Currently, various static and dynamic firmware analysis tools are being developed. However, a prevalent concern lies in the absence of a standard benchmark that incorporates diverse characteristics, which is essential for effectively testing the tools from various angles. This thesis aims to bridge this gap by introducing FirmBench, a comprehensive benchmark specifically designed for binary analysis. FirmBench is meticulously curated to offer a wide array of scenarios and challenges, thoroughly evaluating the capabilities of security analysis tools. This research aims to contribute significantly to the advancement of firmware security analysis, providing developers with a reliable and versatile benchmark for assessing the effectiveness of their tools. FirmBench stands out from existing benchmarks due to its unique features, including the provision of source code, structured metadata, utilization of complex peripheral libraries and inclusion of samples with specific CVEs injected into framework of SDKs. FirmBench was put through numerous analyses using a wide array of static and dynamic tools. Through our characterization process, we have demonstrated that FirmBench is suitable for evaluating various state-of-the-art static and dynamic analysis tools. Furthermore, the benchmark enables testing tools with distinct combinations of operating systems (OS), architectures, micro-controller units (MCUs) and peripherals. This research has also yielded significant insights, such as implications stemming from the absence of centralized benchmark and the challenges associated with using existing datasets for binary analysis.

ABSTRACT

Fingerprinting SoC FPGA via Measuring Communication LinkOver the past few decades, Field Programmable Gate Arrays (FPGAs) have found widespread application in various fields, including signal processing, hardware acceleration, machine learning, etc. To address the requirements of heterogeneous computing, a new category of devices called System-on-Chip FPGAs (SoC-FPGAs) has emerged. These devices combine the capabilities of microcontrollers and FPGAs to leverage the advantages offered by both general-purpose CPUs and FPGAs. However, the introduction of SoC-FPGAs also introduces potential security vulnerabilities since both CPUs and FPGAs are impressionable to side-channel attacks. On SoC-FPGAs, the CPUs and FPGAs are connected through the communication link, which can be utilized as an attacking interface for such side-channel attacks. In this paper, we proposed such side-channel attacks targeting SoC-FPGAs to fingerprint the hardware accelerators running on them by measuring the communication link. We implemented a benchmark program that stresses the communication link and records the I/O bandwidth of the running accelerators. After analyzing the collected data traces using machine learning classifiers, we successfully distinguished the unique I/O pattern of different victim accelerators. Our highest classification accuracy result is 93.3% with a random forest classifier, and it proved that attackers could use such an attack to perform accelerator fingerprinting on SoC-FPGAs. As far as we know, this is the first attack by which fingerprinting accelerator on SoC-FPGAs via measuring communication link.

This research introduces an innovative framework that integrates large language models (LLMs) with retrieval-augmented generation (RAG) systems and continuous threat intelligence feeds for real-time cybersecurity. Our approach overcomes the limitations of static threat analysis by providing dynamic, adaptive threat detection and response. Through comparative studies, we demonstrate that our system outperforms traditional methods, excelling in identifying both known and zero-day vulnerabilities. Detailed case studies, including device-specific vulnerabilities and actively-exploited CVEs in ransomware campaigns, highlight the framework's precision and reliability. This work bridges significant gaps in current cybersecurity solutions and sets the stage for future advancements in automated threat management.

The sharing of hardware components in modern processors helps to achieve high performance and meet the increasing computation demand. Though isolation has been done among users and applications at operating system level, recent research shows that attacks can leverage sophisticated approaches to observe the behaviors of the shared hardware components and infer secrets including password, secret key, etc. Such observations and corresponding attacks are called as side channels and side-channel attacks (SCAs). A number of SCAs have been discovered including Flush+Reload, Flush+Flush, Prime+Probe, Spectre, Meltdown, Fallout, RIDL, ZombieLoad. SCAs have threatened the security of billions of hardware devices, including chips manufactured by Intel, Apple, ARM, etc. Therefore, it is urgent to address the security threats caused by SCAs.

This dissertation pursues the use of machine learning to design effective defense mechanisms and obtain a comprehensive understanding of the side channel threats for emerging applications. In particular, we propose to tackle from three aspects: detection, mitigation and vulnerability analysis.

For detection part, we leverage the microarchitecture level information, i.e. hardware performance counters, to build machine learning-based SCAs detectors. Eventually, we propose two customized machine learning classification models to capture SCAs at real-time and detect zero-day SCAs respectively. As the increase edge devices deployed in the network, we also investigate the machine learning-based detectors against malware and SCAs on autonomous vehicles, mobiles and laptops respectively. We find that hardware performance counters can effectively capture the SCAs with machine learning techniques.

A second aspect of the dissertation is exploring the existing system level and hardware level settings for designing light-weight SCAs mitigation approaches. We find that randomizing the frequency and prefetchers can obfuscate side channel traces and protect against secret leakage. Based on the effectiveness of machine learning-based SCAs detection and randomization-based mitigation, we further developed a detection-mitigation defense approach to further minimize performance overhead incurred by adjusting hardware and system level parameters.

In the last part of this dissertation, we evaluated the side channel leakage in more general applications which are mostly neglected in the prior side channel research community. We find that hardware performance counters can also be used by attackers to fingerprint websites users visited. Besides, we also discover that the inputs' labels of deep learning models are susceptible to be leaked via side-channel attack, i.e. Flush+Reload. To the best of our knowledge, we are the first group to identify the correlation between label information and side channel observations, highlighting the importance of reexamining the side channel vulnerability in general applications.

The processing of data-intensive applications is a challenging and time-consuming task that often requires massive infrastructure to ensure fast data analysis. One of the most powerful scale-out infrastructures to perform massive computation (e.g. big data analytics) and eliminate the need to maintain high-end expensive computing resources at the user side is the cloud. The performance and the cost of such infrastructure depend on the overall server configuration, such as processor, memory, network, and storage configurations. In addition to the cost of owning or maintaining the hardware, the heterogeneity in the server configuration further expands the selection space, leading to non-convergence. The challenge is further exacerbated by the dependency of the application's performance on the underlying hardware.

Despite an increasing interest in resource provisioning, little works have been done in developing accurate and practical models to proactively predict the performance of data-intensive applications corresponding to the server configuration and provision an optimal configuration online. The key challenges of current solutions are uncertainty in predictions, cost of training, generalizability from benchmark datasets to real-world systems datasets, and interpretability of the model.

In this dissertation, through a comprehensive real-system empirical analysis of performance, we address these challenges by introducing a proactive machine-learning-based methodology for resource provisioning. We first characterize diverse types of data-intensive workloads across different types of server architectures. The characterization aids in accurately capture applications' behavior and train a model for the prediction of their performance. Then, we build a set of cross-platform performance models for applications. Based on the developed predictive model, we use optimization techniques to distinguish close-to-optimal configurations in order to reach the performance goal.

On the other hand, in recent literature, researchers substantiated that the machine learning-based models bring new security challenges such as adversarial machine learning attacks. In this dissertation, we investigate what could be the target of adversarial machine learning in the cloud domain and how much the risk of this new thread is real. To the best of our knowledge, we are the first group looking into this domain of research as no report has been found on the adversarial attacks on resource provisioning systems (RPS) of the cloud. Our investigation shows that adversarial machine learning can be used for co-locating the adversary Virtual Machines (VM) with the victim VM to attack to its performance. Moreover, we show that the attacker can fool the RPS to evade the detection and migration performed by RPS.