Cumulative Signal Attack Techniques

• Cumulative signal attacks are adversarial techniques that aggregate independent signal channels to enhance data extraction or bypass detection.
• Multi-screaming-channel methods fuse RF traces across various frequencies, reducing trace requirements and improving side-channel attack efficiency.
• CUSIGN detection leverages cumulative sign analysis in CPS to robustly detect stealthy FDI attacks with minimal computational overhead.

A cumulative signal attack refers to a class of adversarial techniques in which multiple independent signal channels—or repeated statistical evidence across a channel—are systematically aggregated or “cumulated” to bypass traditional detection or to enhance the efficiency of retrieval of private or critical information from a target system. This concept arises primarily in two distinct domains: (i) remote electromagnetic (EM) side-channel analysis targeting cryptographic hardware via “multi-screaming-channel” frequency fusion, and (ii) anomaly or intrusion detection in cyber-physical systems (CPS) where attackers craft sensor data to evade traditional statistical detectors but expose themselves to “cumulative sign” (CUSIGN) analysis due to subtle non-randomness in attack patterns. Both applications exploit cumulative processing either to strengthen attacks or to detect stealthy adversaries.

1. Cumulative Channel Fusion in Screaming-Channel Side-Channel Attacks

A cumulative signal attack in the context of mixed-signal systems with RF co-packaged digital logic leverages the presence of cryptographic leakage on multiple RF “screaming-channel” frequencies. This involves the joint acquisition and statistical fusion of side-channel traces from several distinct frequencies, each carrying independent or partially correlated copies of the internal leakage signal. The canonical workflow consists of:

1. Frequency Selection: The attacker performs an RF spectrum scan in the vicinity of the device’s legitimate carrier (e.g., 2.4 GHz ISM band), identifying both clock-induced harmonics and non-harmonic “lobes” exhibiting high side-channel SNR. For frequency $f_i$, the SNR is computed as

$$\mathrm{SNR}(f_i)\;=\;\frac{\mathrm{Var}[\mathbb{E}\{S(t)\mid d\}]}{\mathbb{E}[\mathrm{Var}\{S(t)\mid d\}]}$$

where $d$ denotes the sensitive internal state and $S(t)$ the demodulated trace (Guillaume et al., 3 Apr 2025).

2. Channel Preprocessing: Each frequency is independently down-converted, filtered, and windowed; points of interest are identified (via TVLA or profiling), and Z-score normalization is applied:

$\widetilde{S}_i(t)=\frac{S_i(t)-\mu_i}{\sigma_i}$

3. Decision Fusion Attack Strategy: Each channel supports a standalone profiling (e.g., CPA) attack, producing score vectors over key hypotheses. The attacker then fuses these by averaging:

$s_{\rm cum,k}=\frac1n\sum_{i=1}^n s_{i,k}$

and outputs the key hypothesis $\hat{k} = \arg\max_k s_{\rm cum,k}$.

This cumulative procedure produces SNR gains approximately linear in the number of coherently exploited frequencies, yielding an inverse scaling of trace complexity:

$$\mathrm{SNR}_{\rm cum}\approx n\,\mathrm{SNR}_1;\qquad N_{\rm traces}(n)\approx \frac{N_{\rm traces}(1)}{n}$$

This permits distant (up to 30 meters) attacks that halve trace requirements per additional channel, as demonstrated on the Nordic nRF52832 with TinyAES (Guillaume et al., 3 Apr 2025).

2. Cumulative Sign Detection in Stealthy CPS Sensor Attacks

The cumulative signal paradigm also underpins stealthy attack detection in CPS via cumulative sign or CUSIGN detectors (Bonczek et al., 2020). Here, the focus is on cumulative analysis—not of raw values—but of the signs (i.e., directionality) of residuals between measured outputs and model predictions. This exploits the fact that smart attackers may introduce persistent biases while keeping magnitude-based detectors (e.g., $\chi^2$, CUSUM) silent.

The CUSIGN approach tracks for each time $k$ whether the Kalman-filter-inspired innovation statistic $z_k$ (typically $z_k = r_k^\top\Sigma^{-1}r_k$) exceeds or falls below a reference value, e.g., the median of the $\chi^2$ distribution under the null hypothesis. The core idea is to cumulatively count consecutive upcrossings or downcrossings via memoryless CUSUM-like processes:

• $S_k^+ = \max(0, S_{k-1}^+ + s_k)$, with $s_k = \text{sign}(z_k - z_{\rm ref})$; alarm and reset on $S^+_k \geq \tau$
• $S_k^- = \min(0, S_{k-1}^- + s_k)$; alarm and reset on $S^-_k \leq -\tau$

A sustained positive or negative bias—the statistical hallmark of many FDI attacks—leads to rapid absorption in these Markov processes, and hence an alarm. The detection performance is tunable via $\tau$, trading off average run length (ARL, i.e., time between false alarms) and detection delay. Analytical results show that for attack-induced $|p_+ - \frac12| = \Delta p$, detection delay satisfies $D=O(\tau/\Delta p)$. This method can detect stealthy FDI attacks that evade both $\chi^2$ and CUSUM detectors (Bonczek et al., 2020).

3. Comparative Effectiveness and Limitations

Cumulative signal attacks—whether for offensive data extraction or defensive anomaly detection—leverage aggregation across independent “channels” (physical, frequency, or statistical domain) to overcome the inherent limitations of single-channel approaches. In remote SCA:

• SNR and Trace Savings: Doubling the number of frequencies (channels) yields an approximate $2\times$ reduction in required traces for a fixed guessing entropy.
• Channel Diversity: Exploiting both harmonic and non-harmonic lobes confers robustness to noise and environmental interference.
• Practical Bound: As the number of channels increases beyond about five, the returns diminish if all channels share the same underlying leakage.

For CUSIGN-based detection, aggregation of sign evidence achieves strong robustness to stealthy attacks with $O(1)$ memory and computational complexity. The trade-off is governed by the threshold $\tau$ (false alarm rate vs. detection delay). Combining CUSIGN with conventional $\chi^2$ or CUSUM detectors improves overall security by fusing magnitude and non-randomness detection.

4. Experimental Evaluations

Cumulative multi-channel attacks have demonstrated practical enhancements over mono-channel attacks:

• At $15\,$m using non-harmonic frequencies ($2.484$ and $2.593$ GHz), “guessing entropy” (GE) dropped from an infeasible~50 (single-channel) to 32 with only $136\times500$ traces, compared to $410$–$686\times500$ individually.
• At $30\,$m (harmonics $2.528$ and $2.552$ GHz), the best single-channel required $5452\times50$ traces for $\text{GE}\approx39$, while cumulative fusion achieved the same GE at $2727\times50$ traces—about a $2\times$ reduction (Guillaume et al., 3 Apr 2025).

For CUSIGN, a CPS case study on a UGV’s velocity sensor targeted two attack modes: persistent and alternating small-magnitude FDI. While the CUSUM detector (tuned for $0.15$ false-alarm rate) never triggered, CUSIGN with $\tau=2$, $z_{\rm ref}=\text{median}~\chi^2_3\approx2.365$, $\ell=100$, $Z=3$ successfully detected both attack types within a few hundred time steps as the estimated alarm rate $\hat{\alpha}$ violated its statistically predicted range (Bonczek et al., 2020).

5. Practical Implementation Guidelines

Attackers mounting cumulative side-channel attacks require:

• At least two channel-synchronized SDR chains with directional antennas (e.g., USRP, LimeSDR) and, ideally, phase-coherent clocks.
• Prior profiling on a cable-connected replica to construct leakage templates for each $f_i$.
• Wideband scans to identify a diverse set of “exploitable” frequencies, often finding dozens with partial leakage.
• Separate CPA or ML attacks per channel; scores fused via (weighted) average, with weights proportional to per-channel SNR.
• Awareness that increasing channel count beyond five offers little additional benefit unless channels capture genuinely new information.

For defenders adopting CUSIGN, implementation requires only online sign updates and a windowless mean estimator ($O(1)$ memory and time), making it suitable for embedded CPS, with theoretical guarantees on false-alarm rate and detection speed.

6. Theoretical Underpinnings and Performance Analysis

The cumulative approach in both domains is underpinned by classical statistical aggregation:

• For multi-screaming-channel attacks: SNR improvement follows directly from the independence of Gaussian noise across channels, justifying trace complexity reductions.
• For CUSIGN detection: Markov chain analysis yields closed-form ARL and expected alarm rate, with attack detectability characterized in terms of induced bias in sign probabilities.

A plausible implication is that cumulative strategies, when channels (or residuals) are sufficiently independent, systematically amplify signal (or bias) relative to noise, thereby enhancing both offensive and defensive capabilities.

7. Summary Table of Core Methodological Steps

Domain	Step Type	Method Description
Screaming-channel SCA (Guillaume et al., 3 Apr 2025)	Channel fusion	Select $n$ frequencies, process independently, fuse CPA/ML scores by average
CPS FDI detection (Bonczek et al., 2020)	Sign aggregation	Track running counts of sign(z–z_ref), raise alarm if O(τ) consecutive bias
Both domains	Cumulative evidence	Linearly improved SNR or detection, $O(1)$ added computational cost

The application of cumulative signal attacks represents a critical evolution in both side-channel cryptanalysis and cyber-physical system security, offering substantial improvements in attack efficacy and defensive detection power through systematic multi-channel or multi-evidence aggregation.