Continuous Authentication of Embedded Software

This paper explores the use of frequency information of hardware performance counter data to enable continuous authentication (CA) in embedded software. Current approaches for CA are not targeted for use with embedded software. In order to be more suitable for embedded scenarios the proposed method uses short time Fourier transforms on streams of hardware performance counters. The frequency information is used to build an encoding to a state transition. These transitions are used to build a corresponding state machine which recognizes and authenticates the protected program continuously at run time. The method achieves an average successful authentication true positive rate of 97% with a 1.5% false positive rate.