IDrISS: Intrusion detection for IT systems security toward a semantic modelling of side-channel signals

International audienceThis paper proposes a novel approach called IDrISS that exploits electromagnetic (EM) side-channel signals to design non-protocol based Intrusion Detection System (IDS). EM emanations side-channels are captured on power lines of an infrastructure. They are used to identify the presence of any type of electronic devices onto a physical network. IDrISS can learn the structure of the EM unintentional emanations of the legit devices composing the infrastructure as a reference profile. In a second step, it records and analyses the current emanations to compare and detect any kind of unwanted emanations. IDrISS is used as a Intrusion Detection System (IDS) that can trig an alarm as soon as a intrusion is detected. The results show that intrusion can be detected in various scenarios whatever the activity of the legit computers of the network. Furthermore, the capture device used is based on inexpensive off-the-shelf components that makes the deployment onto real network easy