Hybrid Cryptographic Monitoring System for Side-Channel Attack Detection on PYNQ SoCs

Nishant Chinnasami; Rasha Karakchi

REVIEW 4 major objections 5 minor 14 references

Hybrid Cryptographic Monitoring System for Side-Channel Attack Detection on PYNQ SoCs

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ML beats timing thresholds for AES side-channel attacks on embedded hardware.

desk verdict No results are reported, and the detector features include the injected delays and bit flips, so the claimed ML-vs-threshold comparison cannot support any conclusion about side-channel detection. read the letter →

arxiv 2508.21606 v1 pith:U4SU7LKA submitted 2025-08-29 cs.CR

Nishant Chinnasami , Rasha Karakchi This is my paper · ORCID

classification cs.CR

keywords AES-128side-channelattacktimingfaultinjectionanomalydetectionRandomForestFPGAPYNQ

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that a lightweight, two-part detector can catch side-channel-style anomalies around AES-128 encryption on a small embedded system, without altering the cipher or using hardware performance counters. The first part is a statistical threshold on execution time; the second is a Random Forest classifier that learns from timing and ciphertext bytes after each block. The authors inject two kinds of synthetic attacks—a 5–20 ms delay before encryption and a bit flip in the first plaintext byte—and measure how well each detector flags the tampered blocks. Their claimed result is that the Random Forest beats the static threshold on accuracy while staying real-time: under 5 ms inference per block on a PYNQ-Z1 and using under 30% of the FPGA fabric. A sympathetic reader would take this as evidence that cheap, non-invasive machine-learning monitoring can harden embedded cryptography against timing and fault side-channels.

What carries the argument

Two detection mechanisms carry the argument. (1) A statistical threshold, T = μ + 3·(max−min)/n, flags a block as malicious when its AES execution time exceeds the mean plus three times the normalized range; this is the fast, low-overhead baseline. (2) A Random Forest classifier, fed the per-block encryption time and the full 16-byte ciphertext, learns the boundary between normal and anomaly-injected blocks; this is the higher-accuracy detector. The anomaly injection module—a 5–20 ms sleep before encryption for timing attacks and an XOR of the first plaintext byte with 0xFF for fault attacks—provides the labeled training signal and the ground truth for evaluation.

What would settle it

Run the detector on real traces: mount a cache-timing attack on an AES-128 implementation with microsecond-scale timing variations, or inject a fault into an intermediate AES round, then compare detection accuracy against the reported simulation numbers. If accuracy collapses to chance, the central claim that the framework detects real side-channel attacks fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that a hybrid monitor combining a simple timing threshold with a Random Forest classifier can detect simulated timing and fault anomalies in AES-128 encryption blocks with high accuracy on both a desktop CPU and a PYNQ-Z1 SoC. The threshold method flags any block whose encryption time exceeds T = μ + 3·(max−min)/n, a heuristic analog of the 3-sigma rule. The Random Forest is trained on per-block timing plus the 16 ciphertext bytes, with block labels derived from the simulated injections. The authors report that the ML approach outperforms the static threshold on accuracy, returns predictions in under 5 ms on the embedded ARM Cortex-A9, and consumes less than 30%

Load-bearing premise

The injected anomalies—a 5–20 ms delay and a first-byte XOR—are assumed to be faithful proxies for real timing and fault side-channel attacks; if real attacks are far smaller or corrupt different parts of the computation, the measured accuracy will not carry over.

Editorial extensions

If this is right

On embedded platforms like the PYNQ-Z1, a Random Forest detector can flag anomalous AES blocks in real time (under 5 ms per block) using only Python-level timing and ciphertext, without hardware counter support.
The threshold method remains useful as a zero-training, low-overhead first pass; the ML layer can be reserved for blocks the threshold flags or for finer discrimination.
Since the framework stays outside the AES core, it can be retrofitted to existing cryptographic libraries and does not require constant-time rewrites or masking.
The reported resource footprint (under 30% FPGA utilization) suggests the detector can coexist with the encryption engine and other peripherals on small SoCs.
Detection accuracy is bounded by the richness of the features—ciphertext bytes plus one timing value per block—so the approach is deliberately feature-light and transferable across platforms, with consistent results on CPU and FPGA.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The simulated anomalies are orders of magnitude larger than real side-channel leaks: real timing attacks exploit cache misses or variable-time operations at microsecond/nanosecond scale, and real fault injection usually targets intermediate AES state, not the first plaintext byte. If those real attacks are the intended threat, the reported accuracy should be expected to drop unless the feature set
The detector's block-level labels are known only because the paper controls anomaly injection. In a live system, anomalies do not come with labels, so the Random Forest would need an unsupervised or one-class variant to detect novel attacks without retraining on each new attack type.
A testable extension: sweep the injected delay from 20 ms down to microseconds to map how detection accuracy degrades; the crossover point would indicate the smallest timing anomaly this feature set can catch.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a framework description with no quantitative results, and the one comparative claim in the abstract is undermined by a construct-validity problem. The good parts: the setup is transparent and potentially portable. The authors describe a concrete AES-128-ECB target on a PYNQ-Z1, a statistical threshold rule, and a Random Forest, and they are upfront about simulating anomalies with delays and plaintext bit flips. If they had shipped code, data, and standard metrics, this could serve as a useful starting point for lightweight anomaly monitoring on that board.

The soft spots are large, though. Most importantly, there are no numbers anywhere in the manuscript. No accuracy, no false-positive rates, no confusion matrices, no plots. The abstract states that 'the ML approach outperforms static thresholds in accuracy,' but the evaluation section is essentially a summary. A claim without data is not a result.

Even if the numbers were there, the experiment cannot support the claim. In Algorithm 2, the timing feature t_i is recorded after the injected sleep, so the artificial delay is part of the input to both the threshold and the classifier. Similarly, the ML features include the original block bytes, which for fault-injected blocks contain the XOR-modified first byte. So both detectors are keyed on the injection markers themselves, not on any genuine side-channel leakage. The comparison is therefore between two ways of detecting the injection, not between two ways of detecting a side-channel attack. On top of that, the threshold is computed and evaluated on the same dataset (in-sample), and the anomaly ratio of 10–30% is high enough to make the classification task trivial.

To be fair, the paper does not misrepresent the anomalies as real attacks; it calls them simulations. But the abstract and introduction make the broader claim of 'side-channel attack detection,' and that framing is not supported. Real timing leaks are often nanoseconds, and real fault attacks corrupt intermediate state, not plaintext bytes. The detection accuracy reported here would not transfer.

This is early-stage work, maybe an undergraduate project. A reader looking for an example of how to set up AES monitoring on a PYNQ might find the algorithm sketches useful. But it is not a security result. I would not send it to peer review in its current form. If the authors strip the injection markers from the features, validate against real attack traces, and report standard metrics on a held-out set, it could become a modest engineering note.

Referee Report

4 major / 5 minor

Summary. The paper proposes a dual detection framework for AES-128 encryption anomalies on CPU and PYNQ-Z1 SoC platforms. Anomalies are simulated by injecting a 5–20 ms delay before encryption and by XORing the first plaintext byte with 0xFF. The authors compare a statistical threshold detector based on encryption time with a Random Forest classifier trained on timing and per-block byte features, claiming that the ML approach outperforms static thresholds in accuracy and maintains real-time feasibility. The manuscript describes Algorithms 1 and 2, the experimental setup, and qualitative deployment results, but it reports no quantitative evaluation: no accuracy, false-positive rate, confusion matrix, plot, or dataset statistics are presented.

Significance. If the central claim were substantiated, a lightweight, non-intrusive Random Forest detector that flags anomalous AES blocks on an embedded PYNQ-Z1 with better accuracy than a timing threshold would be a useful contribution for low-power systems lacking hardware performance counters. The paper also names reproducible ingredients: a simple threshold rule, a Random Forest classifier, and a concrete embedded platform. However, the evaluation protocol is construct-invalid for side-channel attack detection: the features directly encode the injected delay and bit flip, making the detection task trivial. In addition, no quantitative results are given. The potential significance is therefore not realized in the present manuscript.

major comments (4)

[Section 3 (Deployment and Evaluation)] The central claim that "the ML approach outperforms static thresholds in accuracy" is asserted without any quantitative evidence. The section reports no accuracy numbers, false-positive rates, confusion matrices, ROC curves, or timing distributions. It also gives no resource-utilization figures despite claiming "under 30% of FPGA resources." Without numeric results and a description of the evaluation protocol, the main comparative conclusion is unsupported.
[Algorithm 2, Steps 2–3 and Section 2.1] The evaluation is tautological. In Step 2, the encryption time t_i is recorded after an injected 5–20 ms sleep for delay anomalies, so the injected delay is directly embedded in the timing feature. In Step 3, the feature set includes "original block bytes," which for fault-injected blocks contain the first byte XORed with 0xFF. Thus both the threshold and the Random Forest are reading the injection markers themselves. The experiment does not test detection of a side-channel attack; it tests detection of manually inserted delays and plaintext modifications. This construct-validity failure makes the claimed ML-vs-threshold comparison uninformative for the stated purpose.
[Algorithm 2, Step 5; Section 2.2] The threshold T = μ + 3×((max−min)/N) is computed on the same dataset that is then evaluated, and no separate calibration set is described. This is an in-sample evaluation and will inflate the apparent performance of the threshold method. The metric comparison between ML and threshold is therefore not meaningful unless a proper train/validation/test split is applied to the threshold as well as the classifier.
[Section 2.1 and Abstract] The simulated anomalies are not validated as proxies for real timing and fault-injection attacks. The injected 5–20 ms delay is many orders of magnitude larger than realistic timing side-channels (e.g., cache-timing differences on AES), and the fault model corrupts the plaintext byte rather than intermediate cipher state as in differential fault analysis. The paper does not test against real side-channel traces or show that detection transfers. The claimed generalizability to "timing and fault injection attacks" is therefore unsupported.

minor comments (5)

[Algorithm 2, Step 3] The feature description is ambiguous: the abstract and introduction mention "ciphertext features," while Step 3 says "original block bytes." Since the original block bytes include the injected bit flip, this ambiguity is not merely cosmetic; the authors should clarify exactly which bytes are used as ML inputs.
[Section 2.2] The threshold rule is described as "inspired by the empirical 3-sigma rule," but the formula T = μ + 3×(max−min)/n is not the 3-sigma rule and no statistical justification is given. If this rule is retained, its distributional properties and calibration should be discussed.
[Section 3] The claim that "the Random Forest classifier... improved accuracy with inference latency under 5 ms" is not supported by any measured latency plot or table. Similarly, the FPGA resource claim needs a utilization report or a synthesis summary.
[General] The manuscript contains no tables or figures with experimental data. Figure 1 is referenced but not described in the text. The evaluation section is a high-level summary rather than a report of results; concrete numbers are essential for a comparative study.
[References] Some references are incomplete or lack venue/page information (e.g., [1], [9], [10]). Please verify and complete the bibliography.

Circularity Check

2 steps flagged · score 8.0 of 10

Detection is tautological: features include injected delay and modified plaintext byte, so ML-vs-threshold comparison measures marker detection, not side-channel detection.

self definitional [Section 2.1; Algorithm 2, Steps 2 and 3]
"To simulate potential threats, we inject two types of anomalies into selected encryption blocks: • Timing Delay Injection: A short delay (5–20 ms) is added before encryption to simulate cache contention or intentional software slowdowns, mimicking timing-based side-channel behavior. • Fault Injection (Bit Flip): The first byte of the plaintext block is XORed with 0xFF before encryption, simulating data corruption from voltage glitches or electromagnetic interference. Each anomaly-injected block is labeled malicious."

The label "malicious" is defined by these injections. Algorithm 2 Step 2 performs "Sleep for short random time" for delay and "Flip first byte of B_i" for fault; Step 3 then creates features from "timing t_i and original block bytes". Therefore every positive-class sample has its label encoded directly in the feature vector: the timing feature contains the added sleep and the byte feature contains the flipped first byte (or ciphertext affected by it). The classifier is thus reconstructing the injection marker, not detecting side-channel leakage. Accuracy on this task is guaranteed by construction and says nothing about detecting real timing/fault attacks.
other [Algorithm 2, Step 3; Section 3 (Deployment and Evaluation)]
"Step 3: Extract Features Create dataset with timing t_i and original block bytes; ... The Random Forest classifier, using timing and ciphertext features, improved accuracy with inference latency under 5 ms on the PYNQ-Z1."

This comparison is forced. The threshold method receives only encryption_time, which can see the injected delay but not the byte flip. The Random Forest additionally receives the block-byte feature, which contains the bit-flipped first byte for every fault-injected block. Since the fault label is defined by that bit flip, the ML model has a direct readout of the label that the threshold detector is structurally denied. The reported "improved accuracy" is therefore not an empirical discovery about side-channel detection but an artifact of giving the ML detector the very marker used to create the labels.

full rationale

The paper's central claim—"the ML approach outperforms static thresholds in accuracy" (Abstract)—rests on an evaluation protocol in which the anomaly labels are defined by the injected delay and byte flip, and the ML features are the timing and byte values that contain those same injections. This is self-definitional: the task is to predict a label from features that are deterministic functions of that label. The threshold detector sees only timing, so it cannot detect the byte-flip fault at all; the Random Forest is handed the flipped byte (or its ciphertext trace) as a feature. Thus the ML advantage is built into the experimental design, not demonstrated against real side-channel traces. The paper contains no external validation against actual timing or fault-injection attacks, and the simulated anomalies are never compared with real nanosecond-scale timing leaks or faults corrupting intermediate cipher state. The circularity is not a matter of self-citation; it is a matter of the detection target being equivalent to the input features by construction. Score 8 reflects that the central comparison reduces by definition.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central claim rests on two fitted or chosen parameters (threshold coefficient, injection delay) and on the unvalidated assumption that injected anomalies represent real side-channel attacks. No new entities are introduced.

free parameters (3)

Threshold coefficient = 3
The rule T = μ + 3*(max-min)/n uses a fixed multiplier of 3 chosen by the authors to set sensitivity, but it is not justified and is not the standard 3-sigma rule. Section 2.2.
Anomaly injection ratio r = 10%-30%
The fraction of blocks modified in the experiments is chosen by the authors and affects the difficulty of detection. Section 2.1.
Delay injection duration = 5-20 ms
The simulated timing anomaly is an explicit sleep of 5-20 ms, chosen to create a detectable timing deviation. Section 2.1.

assumptions (3)

ad hoc to paper Injected delays and bit flips are faithful proxies for real timing and fault-injection side-channel attacks
The entire evaluation generalizes from synthetic anomalies to real attacks based on this unstated premise. Section 2.1.
domain assumption AES-128 in ECB mode with random 16-byte blocks in PyCryptodome is a representative target for side-channel detection
Real embedded workloads use varied plaintext structures, modes, and implementations. Section 2.1.
ad hoc to paper The statistical rule T = μ + 3*(max-min)/n is a valid outlier threshold
The formula is nonstandard and is not the 3-sigma rule cited by the paper. Section 2.2.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Hybrid Cryptographic Monitoring System for Side-Channel Attack Detection on PYNQ SoCs." pith.science (2026). https://pith.science/paper/U4SU7LKA

@misc{pith2026250821606,
  author       = {Pith},
  title        = {Pith review of: Hybrid Cryptographic Monitoring System for Side-Channel Attack Detection on PYNQ SoCs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U4SU7LKA}},
  note         = {Machine review of arXiv:2508.21606}
}

read the original abstract

AES-128 encryption is theoretically secure but vulnerable in practical deployments due to timing and fault injection attacks on embedded systems. This work presents a lightweight dual-detection framework combining statistical thresholding and machine learning (ML) for real-time anomaly detection. By simulating anomalies via delays and ciphertext corruption, we collect timing and data features to evaluate two strategies: (1) a statistical threshold method based on execution time and (2) a Random Forest classifier trained on block-level anomalies. Implemented on CPU and FPGA (PYNQ-Z1), our results show that the ML approach outperforms static thresholds in accuracy, while maintaining real-time feasibility on embedded platforms. The framework operates without modifying AES internals or relying on hardware performance counters. This makes it especially suitable for low-power, resource-constrained systems where detection accuracy and computational efficiency must be balanced.

Figures

Figures reproduced from arXiv: 2508.21606 by the authors.

**Figure 1.** Proposed Detection Framework 2 METHODOLOGY In this work, we develop and evaluate a statistical timing-based anomaly detection framework to enhance the security of AES128 encryption. Our methodology consists of anomaly injection, parallel encryption execution, timing measurement, and thresholdbased anomaly detection. We evaluated this methodology on both a standard multi-core CPU (8 logical cores and 3.2 GHz) envir… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 14 canonical work pages

[1]

Toward a Lightweight, Scalable, and Parallel Secure Encryption Engine

Rasha Karakchi, Rye Stahle-Smith, Nishant Chinnasami, and Tiffany Yu. Toward a lightweight, scalable, and parallel secure encryption engine. arXiv preprint arXiv:2506.15070, 2025

work page Pith review arXiv 2025
[2]

Paul C. Kocher. Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems. In CRYPTO, 1996

work page 1996
[3]

Bernstein

Daniel J. Bernstein. Cache-timing attacks on aes. http://cr.yp.to/antiforgery/ cachetiming-20050414.pdf, 2005. Accessed: 2025-06-22

work page 2005
[4]

Differential fault analysis of secret key cryptosystems

Eli Biham and Adi Shamir. Differential fault analysis of secret key cryptosystems. In Burton S. Kaliski Jr., editor, Advances in Cryptology — CRYPTO ’97 , volume 1294 of Lecture Notes in Computer Science , pages 513–525. Springer, 1997

work page 1997
[5]

Ecdsa key extraction from mobile devices via nonintrusive physical side channels

Daniel Genkin, Lev Pachmanov, Itamar Pipman, Eran Tromer, and Yuval Yarom. Ecdsa key extraction from mobile devices via nonintrusive physical side channels. In Proceedings of the 2016 ACM SIGSAC conference on computer and communica- tions security, pages 1626–1638, 2016

work page 2016
[6]

Fault attacks on aes and their countermeasures

Subidh Ali, Xiaofei Guo, Ramesh Karri, and Debdeep Mukhopadhyay. Fault attacks on aes and their countermeasures. pages 163–208, 2016

work page 2016
[7]

A review on security analysis of cyber physical systems using machine learning

Alshaibi Ahmed Jamal, Al-Ani Mustafa Majid, Anton Konev, Tatiana Kosachenko, and Alexander Shelupanov. A review on security analysis of cyber physical systems using machine learning. Materials today: proceedings , 80:2302–2306, 2023

work page 2023
[8]

Machine learning based side-channel- attack countermeasure with hamming-distance redistribution and its application on advanced encryption standard

Weiwei Shan, Shuai Zhang, and Yukun He. Machine learning based side-channel- attack countermeasure with hamming-distance redistribution and its application on advanced encryption standard. Electronics Letters, 53(14):926–928, 2017

work page 2017

Show all 14 references

[9]

Enhancing security in cloud computing with anomaly detection using random forest

Avneet Gupta and RajBala Simon. Enhancing security in cloud computing with anomaly detection using random forest. pages 1–6, 2024

2024
[10]

Machine- learning-based side-channel attack detection for fpga socs

Lars Bauer, Hassan Nassar, Nadir Khan, Jürgen Becker, and Jörg Henkel. Machine- learning-based side-channel attack detection for fpga socs. IEEE Transactions on Circuits and Systems for Artificial Intelligence , 2024

2024
[11]

A comprehensive study of deep learning for side-channel analysis

Loïc Masure, Cécile Dumas, and Emmanuel Prouff. A comprehensive study of deep learning for side-channel analysis. IACR Transactions on Cryptographic Hardware and Embedded Systems , pages 348–375, 2020

2020
[12]

Pynq-z1: Python productivity for zynq

Xilinx Inc. Pynq-z1: Python productivity for zynq. https://www.pynq.io/board. html, 2018. Accessed: 2025-06-22

2018
[13]

Pycryptodome: Python cryptographic library

Dario Legrandin. Pycryptodome: Python cryptographic library. https://www. pycryptodome.org/, 2018. Version accessed: 2025

2018
[14]

D. J. Hand and K. Yu. Idiot’s bayes—not so stupid after all?International Statistical Review, 69(3):385–398, 2001

2001

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Toward a Lightweight, Scalable, and Parallel Secure Encryption Engine

Rasha Karakchi, Rye Stahle-Smith, Nishant Chinnasami, and Tiffany Yu. Toward a lightweight, scalable, and parallel secure encryption engine. arXiv preprint arXiv:2506.15070, 2025

work page Pith review arXiv 2025

[2] [2]

Paul C. Kocher. Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems. In CRYPTO, 1996

work page 1996

[3] [3]

Bernstein

Daniel J. Bernstein. Cache-timing attacks on aes. http://cr.yp.to/antiforgery/ cachetiming-20050414.pdf, 2005. Accessed: 2025-06-22

work page 2005

[4] [4]

Differential fault analysis of secret key cryptosystems

Eli Biham and Adi Shamir. Differential fault analysis of secret key cryptosystems. In Burton S. Kaliski Jr., editor, Advances in Cryptology — CRYPTO ’97 , volume 1294 of Lecture Notes in Computer Science , pages 513–525. Springer, 1997

work page 1997

[5] [5]

Ecdsa key extraction from mobile devices via nonintrusive physical side channels

Daniel Genkin, Lev Pachmanov, Itamar Pipman, Eran Tromer, and Yuval Yarom. Ecdsa key extraction from mobile devices via nonintrusive physical side channels. In Proceedings of the 2016 ACM SIGSAC conference on computer and communica- tions security, pages 1626–1638, 2016

work page 2016

[6] [6]

Fault attacks on aes and their countermeasures

Subidh Ali, Xiaofei Guo, Ramesh Karri, and Debdeep Mukhopadhyay. Fault attacks on aes and their countermeasures. pages 163–208, 2016

work page 2016

[7] [7]

A review on security analysis of cyber physical systems using machine learning

Alshaibi Ahmed Jamal, Al-Ani Mustafa Majid, Anton Konev, Tatiana Kosachenko, and Alexander Shelupanov. A review on security analysis of cyber physical systems using machine learning. Materials today: proceedings , 80:2302–2306, 2023

work page 2023

[8] [8]

Machine learning based side-channel- attack countermeasure with hamming-distance redistribution and its application on advanced encryption standard

Weiwei Shan, Shuai Zhang, and Yukun He. Machine learning based side-channel- attack countermeasure with hamming-distance redistribution and its application on advanced encryption standard. Electronics Letters, 53(14):926–928, 2017

work page 2017