Battery-Sensing Intrusion Protection System (B-SIPS)
Total Page:16
File Type:pdf, Size:1020Kb
Battery-Sensing Intrusion Protection System (B-SIPS) Timothy Keith Buennemeyer Dissertation submitted to the faculty of Virginia Polytechnic Institute and State University in partial fulfillment of the requirements for the degree of DOCTOR OF PHILOSOPHY in Computer Engineering Dr. Joseph G. Tront, Chairman Dr. A. Lynn Abbott Dr. Christopher L. North Dr. Cameron D. Patterson Dr. Patrick R. Schaumont Randolph C. Marchany December 5, 2008 Blacksburg, VA Keywords: Battery, Intrusion Detection, Mobile, Power, Security, Wireless Copyright 2008 © Timothy K. Buennemeyer Battery-Sensing Intrusion Protection System (B-SIPS) Timothy K. Buennemeyer Abstract This dissertation investigates using instantaneous battery current sensing techniques as a means of detecting IEEE 802.15.1 Bluetooth and 802.11b (Wi-Fi) attacks and anomalous activity on small mobile wireless devices. This research explores alternative intrusion detection methods in an effort to better understand computer networking threats. This research applies to Personal Digital Assistants (PDAs) and smart phones, operating with sensing software in wireless network environments to relay diagnostic battery readings and threshold breaches to indicate possible battery exhaustion attack, intrusion, virus, and worm activity detections. The system relies on host-based software to collect smart battery data to sense instantaneous current characteristics of anomalous network activity directed against small mobile devices. This effort sought to develop a methodology, design and build a net-centric system, and then further explore this non- traditional intrusion detection system (IDS) approach. This research implements the Battery- Sensing Intrusion Protection System (B-SIPS) client detection capabilities for small mobile devices, a server-based Correlation Intrusion Detection Engine (CIDE) for attack correlation with Snort’s network-based IDS, device power profiling, graph views, security administrator alert notification, and a database for robust data storage. Additionally, the server-based CIDE provides the interface and filtering tools for a security administrator to further mine our database and conduct forensic analysis. A separate system was developed using a digital oscilloscope to observe Bluetooth, Wi-Fi, and blended attack traces and to create unique signatures. The research endeavor makes five significant contributions to the security field of intrusion detection. First, this B-SIPS work creates an effective intrusion detection approach that can operate on small, mobile host devices in networking environments to sense anomalous patterns in instantaneous battery current as an indicator of malicious activity using an innovative Dynamic Threshold Calculation (DTC) algorithm. Second, the Current Attack Signature Identification and Matching System (CASIMS) provides a means for high resolution current measurements and supporting analytical tools. This system investigates Bluetooth, Wi-Fi, and blended exploits using an oscilloscope to gather high fidelity data. Instantaneous current changes were examined on mobile devices during representative attacks to determine unique attack traces and recognizable signatures. Third, two B-SIPS supporting theoretical models are presented to investigate static and dynamic smart battery polling. These analytical models are employed to examine smart battery characteristics to support the theoretical intrusion detection limits and capabilities of B-SIPS. Fourth, a new genre of attack, known as a Battery Polling Cycle Timing Attack, is introduced. Today’s smart battery technology polling rates are designed to support Advanced Power Management needs. Every PDA and smart phone has a polling rate that is determined by the device and smart battery original equipment manufacturers. If an attacker knows the precise timing of the polling rate of the battery’s chipset, then the attacker could attempt to craft intrusion packets to arrive within those limited time windows and between the battery’s polling intervals. Fifth, this research adds to the body of knowledge about non- traditional attack sensing and correlation by providing a component of an intrusion detection strategy. This work expands today’s research knowledge towards a more robust multilayered network defense by creating a novel design and methodology for employing mobile computing devices as a first line of defense to improve overall network security and potentially through extension to other communication mediums in need of defensive capabilities. Mobile computing and communications devices such as PDAs, smart phones, and ultra small general purpose computing devices are the typical targets for the results of this work. Additionally, field- deployed battery operated sensors and sensor networks will also benefit by incorporating security mechanisms developed and described here. iii Dedication With utmost sincerity, this research effort is dedicated to my loving family, Amy, Laura, Keith, and Allyson. Without their sacrifice, support, and patience this work would not have been achievable. Thank you for believing in me and joining together as a caring family in exploring all the wonderful possibilities that life brings us on our journey. Your steadfast encouragement and patience gave me the momentum to continue with the research and achieve my goal. Thank you always for the sincere commitment and support; this research endeavor in large measure was possible because of you being there for me and carrying the burden for our family. iv Acknowledgments I wish to express my admiration and gratitude to Professor Joe Tront for his support, trust, confidence, guidance, and mentorship in my research endeavor and to Mr. Randy Marchany and Mr. Wayne Donald for their friendship, thoughtful insights, security research concepts, collaboration, and use of the Virginia Tech Information Technology and Security Lab facilities. This endeavor is a reflection of their vision to provide an appropriate security research venue and a nurturing environment that blends interdisciplinary security knowledge across faculty, staff and students to synergistically achieve high research standards and collaborative successes. I appreciate the time, insight, and support that my advisory committee gave me in shaping the B-SIPS research; thank you Dr. Lynn Abbott, Dr. Cameron Patterson, Dr. Chris North, and Dr. Patrick Schaumont for coaching me along my research journey. Also, I genuinely appreciate the U.S. Army for allowing me the opportunity to pursue my research efforts and the enthusiastic support of my Army colleagues at Virginia Tech. I offer a special thanks to COL Grant Jacoby for his sincere efforts to launch me on my research path. He shared several essential research extension ideas that allowed me to develop the B-SIPS concept and chart a course. His generous collaboration and guidance during the initial phases of this research and friendship throughout the Ph.D. endeavor were critical and arguably the key catalyst for my B-SIPS research azimuth. I cannot thank my Army colleagues enough: LTC Calvert “Triiip” Bowen, LTC Joe Adams, and LTC Dave Raymond for their friendship and collaboration while in Blacksburg at Virginia Tech. I wish to thank my B-SIPS research colleagues Michael Gora, Theresa Nelson, John Paul Dunning, Lee Clagett, Faiz Munshi, Wayne Chiang, Ingrid Burbey, and Brad Tilley. Without their teamwork, support, friendship, and dedicated efforts, this work would not have been achievable. I thank you all for the guidance and encouragement throughout the B-SIPS research effort, your commitment, involvement and support for this research was essential for success. Lastly, the product photos of various servers, computers, PDAs and smart phones included in the device specifications and in some of the author created figures and diagrams were reproduced with permission from Dell, Hewlett-Packard and Verizon. v Contents Dedication....................................................................................................................................................................iv Acknowledgments........................................................................................................................................................v List of Figures ........................................................................................................................................................... xii List of Tables........................................................................................................................................................... xvii List of Equations.......................................................................................................................................................xix List of Algorithms......................................................................................................................................................xx 1 Introduction........................................................................................................................................................1 1.1 Problem Statement......................................................................................................................................1 1.2 Background and Motivation .......................................................................................................................2 1.3 Design Purpose...........................................................................................................................................5