PaperlayerView exact revision on arXiv

Source-linked AI summary

What's Your NIC Whispering? Network Threat Behavior Recognition via NIC Electromagnetic Side-Channel Leakage

Hongchao Wang, Linrui Li, Yunkai Zou, Zhenduo Hou, Yilin Zhang, Haoyang Pu, Wen Chen, Jierui Chen

arXiv:2608.22941v1cs.CRcs.AR

TL;DR

NICWhisper asks whether unintended electromagnetic emissions from NIC activity can reveal network threat behaviors when conventional traffic or host telemetry is unavailable or undesirable. It externally captures NIC EM signals, converts them into time–frequency representations, and evaluates recognition across varied behaviors and conditions, achieving 80.67% Macro-F1 across eight classes while retaining information beyond signal magnitude and partially transferring across execution conditions and NIC hardware.

  • Problem

    The paper asks whether NIC electromagnetic leakage contains sufficiently structured information to distinguish network behaviors without relying on conventional traffic or host telemetry.

  • Method

    NICWhisper externally captures NIC EM emissions, transforms raw measurements into time–frequency representations, and evaluates recognition across varied tools, configurations, activities, perturbations, and hardware.

  • Results

    80.67% Macro-F1 is achieved across eight behavior classes, while controlled interventions show recognition relies on joint time–frequency organization beyond simple signal magnitude.

  • Takeaways & Limitations

    NIC EM leakage provides a complementary physical observation source whose behavior-related information remains informative across execution variations, moderate perturbations, and partially unseen NIC hardware.

  • Takeaways & Limitations

    The evaluation uses five NICs under a controlled acquisition setup, and controlled perturbations do not fully reproduce coupled variations in realistic deployments.

Abstract

from arXiv · show

Conventional network threat detection primarily relies on packet-level, flow-level, or host-level telemetry. This paper investigates a different observation surface: unintended electromagnetic(EM) emissions generated by network interface card(NIC) activity, and asks whether such physical leakage contains sufficiently structured information for network threat-behavior recognition. We present NICWhisper, which externally captures NIC EM emissions, transforms raw measurements into time-frequency representations, and recognizes network behaviors without inspecting packet contents or host-side runtime states. Rather than competing with traffic-based detection, NICWhisper exploits the physical manifestation of traffic-driven NIC activity, whose timing, rate, concurrency, and burst organization naturally shape the measured EM leakage. We construct a NIC EM dataset covering active benign workloads and seven representative threat behaviors under diverse execution conditions, and systematically evaluate signal dependence, execution variation, measurement perturbation, and cross-device transfer. NICWhisper achieves 80.67\% Macro-F1 across eight behavior classes, while further experiments show that the observed behavior-related information extends beyond simple signal magnitude and remains partially transferable across execution conditions and NIC hardware. These results establish NIC EM leakage as a complementary physical observation source for network security monitoring when direct access to conventional traffic or host telemetry is limited or undesirable.

I. INTRODUCTION

NICWhisper investigates whether externally captured NIC electromagnetic leakage can provide a complementary observation channel for recognizing network behaviors without packet or host-state inspection. It introduces a dataset and time–frequency recognition pipeline, then evaluates robustness across execution and measurement conditions.

  • Approach: NICWhisper captures unintended NIC emissions externally and analyzes them on an independent host without inspecting packets or host-side runtime states.
  • Motivation: NICWhisper addresses whether NIC electromagnetic leakage contains distinguishable physical patterns for different network behaviors.The leakage reflects NIC processing shaped by request timing, rate, concurrency, and burst organization rather than explicit network semantics.
  • Dataset: The study releases a dataset covering active benign workloads and seven representative threat behaviors under varied tools, configurations, and concurrent activities.
  • Contribution: The paper presents a systematic study of NIC electromagnetic leakage as a physical observation channel for network behavior recognition.
  • Evaluation: The recognition pipeline uses time–frequency analysis and evaluates effectiveness, signal dependence, execution variation, and cross-device transfer.
  • Significance: NICWhisper complements traffic inspection and host monitoring by providing an external physical observation source for closed, legacy, mission-critical, or resource-constrained systems.

B. Threat Model

The threat model treats NICWhisper as an externally sensed, aggregate EM observation of designated-NIC activity under benign and representative attack behaviors. Its classes describe observable behavior families, while the leakage remains a statistical mixture of multiple hardware and workload sources.

  • Monitored setting: The monitored device has a designated NIC, an authorized nearby EM probe, trusted sensing equipment, and a fixed recognition configuration.
  • Observation model: The recognizer receives only the captured EM trace; packet payloads, flow records, host logs, system calls, and process states are unavailable.
  • Network activities: Threat activities include flooding, scanning, service probing, enumeration, SQL-injection probing, and cross-site-scripting probing, with variation in tools, rates, concurrency, timing, targets, and inputs.
  • Network activities: Active benign access is modeled alongside threat activity and includes browsing, content requests, and file downloading.
  • Physical observation: The measured trace represents aggregate NIC and supporting-circuit activity rather than leakage attributed to a specific internal circuit.
  • Recognition scope: Behavior classes represent observable network behaviors rather than complete attack campaigns or strict MITRE ATT&CK technique labels.

C. Preliminary Signal Characterization

Preliminary characterization shows that NIC EM measurements retain behavior-related information, but coarse whole-trace summaries cannot reliably distinguish all classes. NICWhisper therefore uses diverse, behavior-level workload construction to study physical patterns beyond fixed execution artifacts.

  • Whole-trace RMS distributions differ across behaviors but substantially overlap, preventing reliable separation from global signal level alone.
  • A random-forest classifier using nine whole-trace descriptors shows a visible confusion-matrix diagonal, yet confusion remains among benign access, scanning, enumeration, and application-layer probing.
  • Conventional summaries retain behavior-related information but discard important temporal organization needed to characterize network activity.
  • The dataset includes active benign browsing, content requests, and file transfers alongside seven threat behaviors, rather than an idle-NIC baseline.
  • NICWhisper varies implementations and behavior-specific configurations while keeping behavior-level labels unchanged, targeting patterns shared across executions.
  • Threat traces contain concurrent legitimate and threat activity, so each class represents aggregate NIC processing rather than a pure waveform from one activity.

C. Time–Frequency Representation

NICWhisper uses time–frequency representations because raw sequences and global spectra each omit complementary structure. Signal conditioning, STFT-based transformation, and deterministic resizing produce fixed-size inputs while preserving temporal and spectral organization.

  • A time–frequency representation preserves both temporal evolution and spectral-energy distribution, unlike raw sequences or whole-trace spectra alone.
  • NICWhisper removes the trace-wise DC component after limited conditioning, retaining relative amplitude variation and temporal organization.
  • The pipeline computes an STFT and log-power representation to retain spectral-energy organization over time while reducing dynamic range.
  • STFT associates local frequency content with temporal position, exposing persistent, recurring, and localized activity patterns for learning.
  • Spectrograms with different temporal dimensions are deterministically resized to a common F0 × T0 classifier input rather than padded or truncated as raw waveforms.
  • All samples use the same STFT and resizing configuration, with normalization estimated from training data and applied unchanged to validation and test observations.

D. Network Behavior Recognition

NICWhisper learns network-behavior labels from processed NIC EM observations using a compact convolutional classifier. The classifier operates directly on resized time–frequency representations and applies identical preprocessing to unseen observations.

  • NICWhisper learns the association between time–frequency representations and network behaviors using a compact conventional classifier.
  • The classifier uses two-dimensional convolutional blocks, global feature aggregation, and a classification layer to combine local spectrogram evidence.
  • For unseen observations, identical conditioning, STFT, log-power transformation, resizing, and normalization precede prediction among the behavior classes.

V. EVALUATION

The evaluation tests NICWhisper across recognition feasibility, signal representation, execution variation, and measurement conditions using a controlled external NIC EM setup. On the balanced eight-class task, it achieves 80.67% Macro-F1 and 0.985 ± 0.012 benign-versus-threat AUROC.

  • Evaluation design: NICWhisper evaluates eight behavior classes using balanced data, repeated five-run experiments, and Macro-F1 as the primary metric.The evaluation pool contains 4,000 traces, with 500 observations per class; results are reported across five random seeds.
  • RQ1: Observation feasibility: 80.67% Macro-F1 and 80.53% Accuracy are achieved across the balanced eight-class recognition task.Equal class sizes make Macro-F1 directly representative of recognition quality across all behaviors.
  • RQ1: Observation feasibility: 91.44% and 90.51% F1 are obtained for SQLi and Flood, while PortScan and PathDisc are more challenging at 69.12% and 70.98%.Normal and XSS also exceed 84%, with ServiceProbe and DirEnum between these groups.
  • RQ1: Observation feasibility: Recognition errors concentrate among behaviors with similar request-driven activity, especially DirEnum versus PathDisc and ServiceProbe versus Normal or PortScan.Per-run results remain above chance for every behavior despite differences in class difficulty.
  • RQ1: Observation feasibility: 0.985 ± 0.012 AUROC is achieved when the eight-class predictions are pooled into benign-versus-threat detection.The threat score is defined as 1 − p(Normal), without training a separate binary model.

C. RQ2: What Signal Structure Supports Behavior Recognition?

RQ2 tests which properties of NIC EM spectrograms support recognition by selectively weakening magnitude, temporal, spectral, and joint time–frequency structure. Recognition is most dependent on joint temporal–spectral organization rather than global magnitude alone.

  • Signal dependence: Amplitude normalization reduces Macro-F1 by 4.50 points to 76.17% ± 6.15%, while energy normalization reduces it by 2.16 points to 78.51% ± 2.18%.These reductions show that magnitude and aggregate energy contribute, but neither explains most discriminative capability.
  • Signal dependence: Temporal block shuffling yields 77.59% ± 4.22% Macro-F1, while spectral disruption yields 76.52% ± 2.36%.Each intervention produces a moderate decrease, indicating that useful information is not confined to only one dimension.
  • Signal dependence: 60.82% ± 2.13% Macro-F1 follows time–frequency shuffling, a 19.85-point decrease from the original representation.The larger loss supports the role of joint temporal–spectral organization in recognition.
  • Sanity check: Randomized training labels reduce Macro-F1 to 12.33% ± 4.50%, near the 12.5% eight-class chance level.The unchanged observations and randomized labels provide a sanity check on the association between EM measurements and behavior labels.

D. RQ3: Attack-Execution Variation

RQ3 examines whether behavior information persists across execution tools and parameter configurations, while related perturbation tests assess measurement sensitivity. Recognition remains substantial under unseen executions, but stronger signal distortion causes progressively larger losses.

  • Mixed variation: 78.06% ± 4.88% Macro-F1 is achieved when all nine Tool×Parameter execution identities are mixed across the dataset.Execution diversity does not remove the discriminative information available in NIC EM observations.
  • Held-out variation: 70.64% ± 5.04% Macro-F1 is achieved across two tests withholding an entire parameter configuration from training.The unseen configurations retain considerable multi-class recognition capability.
  • Held-out variation: 85.02% ± 1.61% Macro-F1 is obtained across two tool-held-out directions, showing recognition does not collapse for unseen implementations.The higher absolute scores across protocols are not controlled evidence of improvement because training constructions and test distributions differ.
  • Measurement perturbation: 80.76%, 80.99%, and 79.77% Macro-F1 remain near baseline at 30, 25, and 20 dB SNR, but fall to 67.84% at 15 dB and 38.97% at 10 dB.The controlled results indicate tolerance to moderate additive noise but sharp degradation under stronger noise.
  • Measurement perturbation: 80.69%, 80.47%, and 80.23% Macro-F1 result from 1%, 2%, and 5% temporal shifts, compared with 80.67% without shifting.The recognizer does not require activity to occur at one precisely fixed absolute location within the observation window.
  • Measurement perturbation: 45.29% Macro-F1 under the strongest frequency-domain perturbation shows that severe spectral distortion progressively removes information available to the classifier.Mild and moderate perturbations retain 80.37% and 71.49% Macro-F1, respectively.

F. RQ5: Cross-Device Transfer

RQ5 evaluates transfer from one source NIC to four unseen target devices, including same-vendor and cross-vendor hardware. Behavior information transfers partially without target data and improves substantially with limited target-device fine-tuning.

  • Direct transfer: 69.48% average Macro-F1 is achieved across four unseen NICs without target-device training data.Direct-transfer scores range from 67.35% to 72.67%, indicating a clear distribution shift without eliminating behavior-related information.
  • Target adaptation: 79.40% average Macro-F1 follows fine-tuning with only 10% target-domain data, improving direct transfer by 9.92 percentage points.Improvements occur across all four target devices, ranging from 7.80 to 11.09 points.
  • Interpretation: Cross-device measurements contain both transferable behavior structure and device-specific variation.Direct recognition remains possible on unseen NICs, while limited target data reduces the device-induced distribution shift.

VI. RELATED WORK

Prior work uses traffic, host, and physical side-channel observations for security monitoring, but NICWhisper studies NIC electromagnetic leakage as an external, complementary source of behavior-level evidence.

  • Existing threat-monitoring systems analyze packets, flows, protocol characteristics, host events, processes, or causal relationships.
  • Prior physical-side-channel research has inferred cryptographic, visual, neural-network, malware, attestation, and anomalous-device information from power or electromagnetic emissions.
  • NICWhisper captures unintended NIC electromagnetic emissions outside the monitored software stack, providing behavior-level evidence without packet contents or host-generated telemetry.
  • The study evaluates NIC electromagnetic leakage across five NICs under controlled acquisition, finding partial transferability while stopping short of claiming deployment-ready detection.
  • The current scope covers predefined behavior families and active benign workloads; packet contents, protocol semantics, and process-level reconstruction remain outside the study.

APPENDIX A DETAILED RESULTS OF CONTROLLED INTERVENTIONS

Controlled interventions compare the contributions of amplitude, temporal, spectral, and joint time–frequency organization, while signal perturbation experiments define the tested operating conditions.

  • Controlled interventions: 19.85 percentage points: destroying joint time–frequency organization causes the largest Macro-F1 decrease.The comparison indicates that recognition benefits from structured information distributed across both dimensions.
  • Controlled interventions: 2.16–4.50 percentage points: global amplitude or energy normalization reduces Macro-F1, while the remaining 76.17% Macro-F1 shows magnitude alone is insufficient.
  • Controlled interventions: 3.08 and 4.15 points: individually perturbing temporal and spectral organization produces reductions of similar magnitude.
  • Sanity control: 12.33% Macro-F1: random labels produce performance near the eight-class chance level, providing a separate sanity control.
  • Perturbation protocol: Signal perturbations are applied before standard preprocessing and STFT transformation, with fixed RQ1-trained models and specified amplitude, noise, temporal, and frequency conditions.Frequency perturbations attenuate selected positive-frequency bands before reconstruction and subsequent preprocessing.

PARAMETER CONFIGURATIONS

Threat workloads are varied through tool implementations, behavior-specific parameter profiles, and randomized execution details while concurrent benign traffic is present.

  • Workload construction: Three tool variants and three behavior-specific parameter profiles produce nine Tool×Parameter execution identities for each behavior.
  • Configuration summary: The dataset-generation table organizes tool variants and behavior-specific configuration dimensions into the P1–P3 profiles.
  • Configuration dimensions: The profiles vary behavior-specific dimensions such as request methods, payloads, probing depth, crawling, injection context, and response verification.
  • Execution variation: All threat workloads run with concurrent benign background traffic, and collection adds timing jitter, target or path selection, payload ordering, and request-scheduling variations.
Loading 2608.22941v1…