Spying on Microcontrollers using Current Sensing and embedded TinyML models

Overview

Welcome to CurrentSense-TinyML

Intro

CurrentSense-TinyML is all about detecting microcontroller behaviour with current sensing and TinyML. Basically we are trying to work out what is happening on a target PCB.

This work is inspired by prior work I have done, as well as the work of Stacksmashing at Level Down security. This work is intended to be a working Proof of Concept (PoC) for what is the next logical step in these kinds of attacks - using Machine Learning (ML) in current monitoring side-channel analysis attacks.

GOAL - To detect an LED flashing on a target using an TensorFlow Lite ML model running on a different microcontroller speaking to an INA219 power monitor that is reading the power going into the target.

See TinyML-CurrentSense-Writeup.ipynb for the writeup of this project. The Arduino_CurrentSense_ML folder contains the Arduino IDE .ino file that will load the model onto an Arduino Nano 33 Sense board. The rest of the code - for generating training data, recording it, and processing it, can all be found in the jupyter notebook and the DataCollection folder.

We've also uploaded it to Google Colaboratory for those who would like to have a play but not install stuff locally first: https://colab.research.google.com/github/Santandersecurityresearch/CurrentSense-TinyML/blob/main/TinyML-CurrentSense-Writeup.ipynb

This is a taster of the resulting behaviour - reading the state of the target LED (in RED) and copying it using the analyser's LED (Yellow):

PoC

What is CurrentSense-TinyML (and does it work?)

Despite prior evidence that says 'yes!' from the work we cited above, there are a few good indicators that this should work. If we setup the INA219 with the Nano 33 Sense and just monitor the Nano target running blink, we can see the following output when we use Arduino IDE's Serial Plotter (using the get_current_data.ino code for those who want to play along at home)

initial motivation

How Do I Install It?

First things first, we need to get the environment ready. TensorFlow does not support Python v3.9.x, so if you need to, you should run conda activate to enable a python 3.8.x environment.

We recommend you use a Jupyter Notebook instance as this makes life much easier.

We first install TensorFlow and then do our imports...

Tensorflow

Next up, you will need some hardware:

  • INA219 Current Measuring over I2C board
  • Arduino Nano ATMEGA329P target board (AliExpress or eBay is good here)
  • Arduino Nano 33 Sense ML capable board
  • USB Cables and Laborkabel
  • A Breadboard is handy

On the software side, your IDE Platformio or the Arduino should work with the Arduino Nano 33 Sense. You'll also need to add the INA219 library

How Do I Use It?

Ok, so we've convinced ourselves that this should work... or might work... or could work... so let's get started!

We recommend you load the TinyML-CurrentSense-Writeup.ipynb into your Jupyter instance as this is the most detailed explaination as to how you make magic happen.

Who Is Behind It?

CurrentSense-TinyML is a research project by Work done by Mark Carney of the Santander Group Cyber Security Research Team. (@LargeCardinal).

You might also like...
CTranslate2 is a fast inference engine for OpenNMT-py and OpenNMT-tf models supporting both CPU and GPU executio

CTranslate2 is a fast inference engine for OpenNMT-py and OpenNMT-tf models supporting both CPU and GPU execution. The goal is to provide comprehensive inference features and be the most efficient and cost-effective solution to deploy standard neural machine translation systems such as Transformer models.

WeNet is to close the gap between research and production end-to-end (E2E) speech recognition models,
WeNet is to close the gap between research and production end-to-end (E2E) speech recognition models,

WeNet is to close the gap between research and production end-to-end (E2E) speech recognition models, to reduce the effort of productionizing E2E models, and to explore better E2E models for production.

A Cross platform implement of Wenet ASR. It's based on ONNXRuntime and Wenet. We provide a set of easier APIs to call wenet models.

RapidASR: a new member of RapidAI family. Our visio is to offer an out-of-box engineering implementation for ASR. A cpp implementation of recognize-on

tutorial on how to train deep learning models with c++ and dlib.

Dlib Deep Learning tutorial on how to train deep learning models with c++ and dlib. usage git clone https://github.com/davisking/dlib.git mkdir build

TensorRT implementation of RepVGG models from RepVGG: Making VGG-style ConvNets Great Again

RepVGG RepVGG models from "RepVGG: Making VGG-style ConvNets Great Again" https://arxiv.org/pdf/2101.03697.pdf For the Pytorch implementation, you can

Deep Scalable Sparse Tensor Network Engine (DSSTNE) is an Amazon developed library for building Deep Learning (DL) machine learning (ML) models

Amazon DSSTNE: Deep Scalable Sparse Tensor Network Engine DSSTNE (pronounced "Destiny") is an open source software library for training and deploying

 Deploying Deep Learning Models in C++: BERT Language Model
Deploying Deep Learning Models in C++: BERT Language Model

This repository show the code to deploy a deep learning model serialized and running in C++ backend.

A flexible, high-performance serving system for machine learning models

XGBoost Serving This is a fork of TensorFlow Serving, extended with the support for XGBoost, alphaFM and alphaFM_softmax frameworks. For more informat

Lite.AI 🚀🚀🌟  is a user-friendly C++ lib for awesome🔥🔥🔥 AI models  based on onnxruntime, ncnn or mnn. YOLOX, YoloV5, YoloV4, DeepLabV3, ArcFace, CosFace, Colorization, SSD
Lite.AI 🚀🚀🌟 is a user-friendly C++ lib for awesome🔥🔥🔥 AI models based on onnxruntime, ncnn or mnn. YOLOX, YoloV5, YoloV4, DeepLabV3, ArcFace, CosFace, Colorization, SSD

Lite.AI 🚀🚀🌟 is a user-friendly C++ lib for awesome🔥🔥🔥 AI models based on onnxruntime, ncnn or mnn. YOLOX🔥, YoloV5🔥, YoloV4🔥, DeepLabV3🔥, ArcFace🔥, CosFace🔥, Colorization🔥, SSD🔥, etc.

Owner
Santander Security Research
Santander Security Research
VNOpenAI 31 Dec 26, 2022
ORB-SLAM3 is the first real-time SLAM library able to perform Visual, Visual-Inertial and Multi-Map SLAM with monocular, stereo and RGB-D cameras, using pin-hole and fisheye lens models.

Just to test for my research, and I add coordinate transformation to evaluate the ORB_SLAM3. Only applied in research, and respect the authors' all work.

B.X.W 5 Jul 11, 2022
Number recognition with MNIST on Raspberry Pi Pico + TensorFlow Lite for Microcontrollers

About Number recognition with MNIST on Raspberry Pi Pico + TensorFlow Lite for Microcontrollers Device Raspberry Pi Pico LCDディスプレイ 2.8"240x320 SPI TFT

iwatake 51 Dec 16, 2022
Eloquent interface to Tensorflow Lite for Microcontrollers

This Arduino library is here to simplify the deployment of Tensorflow Lite for Microcontrollers models to Arduino boards using the Arduino IDE.

null 188 Dec 26, 2022
Want a faster ML processor? Do it yourself! -- A framework for playing with custom opcodes to accelerate TensorFlow Lite for Microcontrollers (TFLM).

CFU Playground Want a faster ML processor? Do it yourself! This project provides a framework that an engineer, intern, or student can use to design an

Google 331 Jan 1, 2023
TensorFlow Lite for Microcontrollers

TensorFlow Lite for Microcontrollers Build Status Official Builds Community Supported Builds Additional Documentation TensorFlow Lite for Microcontrol

null 998 Jan 3, 2023
Training and Evaluating Facial Classification Keras Models using the Tensorflow C API Implemented into a C++ Codebase.

CFace Training and Evaluating Facial Classification Keras Models using the Tensorflow C API Implemented into a C++ Codebase. Dependancies Tensorflow 2

null 7 Oct 18, 2022
Header-only library for using Keras models in C++.

frugally-deep Use Keras models in C++ with ease Table of contents Introduction Usage Performance Requirements and Installation FAQ Introduction Would

Tobias Hermann 926 Dec 30, 2022
Serve pytorch / torch models using Drogon

C++ Torch Server Serve torch models as rest-api using Drogon, example included for resnet18 model for Imagenet. Benchmarks show improvement of ~6-10x

null 16 Nov 27, 2022