Abstract: Systems, methods, and other embodiments associated with automated calibration of electromagnetic interference (EMI) fingerprint scanning instrumentation for utility power system counterfeit detection are described. In one embodiment, a method for detecting a calibration state of an EMI fingerprint scanning device includes: collecting electromagnetic signals with the EMI fingerprint scanning device for a test period of time at a geographic location; identifying one or more peak frequency bands in the collected electromagnetic signals; comparing the one or more peak frequency bands to assigned radio station frequencies at the geographic location to determine if a match is found; and generating a calibration state signal based at least in part on the comparing to indicate whether the EMI fingerprint scanning device is calibrated or not calibrated.

Abstract: In one embodiment, a method for auditing the results of a machine learning model includes: retrieving a set of state estimates for original time series data values from a database under audit; reversing the state estimation computation for each of the state estimates to produce reconstituted time series data values for each of the state estimates; retrieving the original time series data values from the database under audit; comparing the original time series data values pairwise with the reconstituted time series data values to determine whether the original time series and reconstituted time series match; and generating a signal that the database under audit (i) has not been modified where the original time series and reconstituted time series match, and (ii) has been modified where the original time series and reconstituted time series do not match.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target computing system. During operation, the system obtains target electromagnetic interference (EMI) signals, which were gathered by monitoring EMI signals generated by the target computing system, using an insertable device, wherein when the insertable device is inserted into the target computing system, the insertable device gathers the target EMI signals from the target computing system. Next, the system generates a target EMI fingerprint from the target EMI signals. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target computing system to determine whether the target computing system contains any unwanted electronic components.

Abstract: Detecting a counterfeit status of a target utility device by: selecting a set of frequencies that best reflect load dynamics or other information content of a reference utility device while undergoing a power test sequence; obtaining target electromagnetic interference (EMI) signals emitted by the target utility device while undergoing the same power test sequence; creating a sequence of target kiviat plots from the amplitude of the target EMI signals at each of the set of frequencies at observations over the power test sequence to form a target kiviat tube EMI fingerprint; comparing the target kiviat tube EMI fingerprint to a reference kiviat tube EMI fingerprint for the reference utility device undergoing the power test sequence to determine whether the target utility device and the reference utility device are of the same type; and generating a signal to indicate a counterfeit status based at least in part on the results of the comparison.

Abstract: Detecting whether a target utility device that includes multiple electronic components is genuine or suspected counterfeit by: performing a test sequence of energizing and de-energizing the target device and collecting electromagnetic interference (EMI) signals emitted by the target device; generating a target EMI fingerprint from the EMI signals collected; retrieving a plurality of reference EMI fingerprints from a database library, each of which corresponds to a different configuration of electronic components of a genuine device of the same make and model as the target device; iteratively comparing the target EMI fingerprint to the retrieved reference EMI fingerprints and generating a similarity metric between each compared set; and indicating that the target device (i) is genuine where the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and is a suspect counterfeit device where no similarity metric for any individual reference EMI fingerprint satisfies the test.

Abstract: The disclosed embodiments relate to a system that camouflages EMI fingerprints in EMI emissions from a computing system to enhance system security. During operation, the system monitors the EMI emissions from the computer system during operation of the computer system to produce corresponding EMI signals. Next, the system determines a dynamic amplitude of the EMI emissions based on the EMI signals. If the dynamic amplitude of the EMI emissions drops below a threshold value, the system executes synthetic transactions, which have interarrival times that, when superimposed on a workload of the computer system, cause the computer system to produce randomized EMI emissions.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system generates a sinusoidal load for the target asset. Next, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is executing the sinusoidal load. The system then generates a target EMI fingerprint from the target EMI signals. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains unwanted electronic components.

Abstract: Systems, methods, and other embodiments associated with autonomous cloud-node scoping for big-data machine learning use cases are described. In some example embodiments, an automated scoping tool, method, and system are presented that, for each of multiple combinations of parameter values, (i) set a combination of parameter values describing a usage scenario, (ii) execute a machine learning application according to the combination of parameter values on a target cloud environment, and (iii) measure the computational cost for the execution of the machine learning application. A recommendation regarding configuration of central processing unit(s), graphics processing unit(s), and memory for the target cloud environment to execute the machine learning application is generated based on the measured computational costs.

Abstract: The disclosed embodiments relate to a system that camouflages electromagnetic interference (EMI) fingerprints in EMI emissions from a computing system to enhance system security. During operation, the system monitors the EMI emissions from the computer system while the computer system is operating to produce corresponding EMI signals. Next, the system performs a Fast Fourier Transform (FFT) operation on the EMI signals. The system then converts an output of the FFT operation into a frequency-domain representation of the EMI signals. Next, the system generates a camouflaging signal based on the frequency-domain representation of the EMI signals. Finally, the system outputs the camouflaging signal through a transmitter to camouflage EMI fingerprints in the EMI emissions from the computer system.

Abstract: The disclosed embodiments provide a system that detects execution of malicious cryptomining software in a target computing system. During operation, the system monitors target electromagnetic interference (EMI) signals generated during operation of the target computing system. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then compares the target EMI fingerprint against a set of malicious EMI fingerprints for different pieces of malicious cryptomining software to determine whether the target computing system is executing malicious cryptomining software.

Abstract: The disclosed embodiments provide a system that generates a reference EMI fingerprint to be used in detecting unwanted electronic components in a target asset. During operation, the system gathers reference EMI signals generated by a reference asset while the reference asset is executing a periodic workload, wherein the reference asset is of the same type as the target asset and is certified not to contain unwanted electronic components. Next, the system divides the reference EMI signals into a set of profiles, which comprise EMI signals for non-overlapping time intervals of a fixed size. The system then temporally aligns and merges profiles in the set of profiles to produce a reference profile. Next, the system generates the reference EMI fingerprint from the reference profile. Finally, the system compares a target EMI fingerprint for the target asset against the reference EMI fingerprint to determine whether the target asset contains unwanted electronic components.

Abstract: During operation, the system obtains time-series sensor signals gathered from sensors in an asset during operation of the asset in an outdoor environment, wherein the time-series sensor signals include temperature signals. Next, the system produces thermally-compensated time-series sensor signals by performing a thermal-compensation operation on the temperature signals to compensate for variations in the temperature signals caused by dynamic variations in an ambient temperature of the outdoor environment. The system then trains a prognostic inferential model for a prognostic pattern-recognition system based on the thermally-compensated time-series sensor signals. During a surveillance mode for the prognostic pattern-recognition system, the system receives recently-generated time-series sensor signals from the asset, and performs a thermal-compensation operation on temperature signals in the recently-generated time-series sensor signals.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system generates a sinusoidal load for the target asset. Next, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is executing the sinusoidal load. The system then generates a target EMI fingerprint from the target EMI signals. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains unwanted electronic components.

Abstract: During operation, the system receives time-series signals from sensors in the asset while the asset is operating. Next, the system obtains real-time environmental parameters for an environment in which the asset is operating. The system then selects an environment-specific inferential model for the asset based on the real-time environmental parameters, wherein the environment-specific inferential model was trained on a golden system while the golden system was operating in an environment that matches the real-time environmental parameters. Next, the system uses the environment-specific inferential model to generate estimated values for the received time-series signals based on correlations among the received time-series signals, and performs a pairwise-differencing operation between actual values and the estimated values for the received time-series signals to produce residuals. Finally, the system determines from the residuals whether the asset is operating correctly.

Abstract: The system receives a set of load signals from an archive that contains historic load information gathered at various locations throughout an electrical grid, which distributes electrical power for the utility system. Next, the system applies a first difference function to the set of load signals to produce a set of difference signals. The system then performs a spike-detection operation on the set of difference signals to identify pairs of positive-negative and negative-positive spikes, which identify gaps in the set of load signals associated with periods of network disruption. Next, the system modifies the set of load signals by filling in each identified gap with projected load values determined by performing a localized loadshape forecasting operation based on the continuous load values immediately preceding the identified gap. Finally, the system forecasts electricity demand for the utility system based on the modified set of load signals.

Abstract: The disclosed embodiments provide a system that performs seasonality-compensated prognostic-surveillance operations for an asset. During operation, the system obtains time-series sensor signals gathered from sensors in the asset during operation of the asset. Next, the system identifies seasonality modes in the time-series sensor signals. The system then determines frequencies and phase angles for the identified seasonality modes. Next, the system uses the determined frequencies and phase angles to filter out the seasonality modes from the time-series sensor signals to produce seasonality-compensated time-series sensor signals. The system then applies an inferential model to the seasonality-compensated time-series sensor signals to detect incipient anomalies that arise during operation of the asset. Finally, when an incipient anomaly is detected, the system generates a notification regarding the anomaly.

Abstract: During operation, the system receives time-series signals from sensors in the asset while the asset is operating. Next, the system obtains real-time environmental parameters for an environment in which the asset is operating. The system then selects an environment-specific inferential model for the asset based on the real-time environmental parameters, wherein the environment-specific inferential model was trained on a golden system while the golden system was operating in an environment that matches the real-time environmental parameters. Next, the system uses the environment-specific inferential model to generate estimated values for the received time-series signals based on correlations among the received time-series signals, and performs a pairwise-differencing operation between actual values and the estimated values for the received time-series signals to produce residuals. Finally, the system determines from the residuals whether the asset is operating correctly.

Abstract: The disclosed embodiments relate to a system that camouflages electromagnetic interference (EMI) fingerprints in EMI emissions from a computing system to enhance system security. During operation, the system monitors the EMI emissions from the computer system while the computer system is operating to produce corresponding EMI signals. Next, the system performs a Fast Fourier Transform (FFT) operation on the EMI signals. The system then converts an output of the FFT operation into a frequency-domain representation of the EMI signals. Next, the system generates a camouflaging signal based on the frequency-domain representation of the EMI signals. Finally, the system outputs the camouflaging signal through a transmitter to camouflage EMI fingerprints in the EMI emissions from the computer system.

Abstract: The disclosed embodiments provide a system that detects execution of malicious cryptomining software in a target computing system. During operation, the system monitors target electromagnetic interference (EMI) signals generated during operation of the target computing system. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then compares the target EMI fingerprint against a set of malicious EMI fingerprints for different pieces of malicious cryptomining software to determine whether the target computing system is executing malicious cryptomining software.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target computing system. During operation, the system obtains target electromagnetic interference (EMI) signals, which were gathered by monitoring EMI signals generated by the target computing system, using an insertable device, wherein when the insertable device is inserted into the target computing system, the insertable device gathers the target EMI signals from the target computing system. Next, the system generates a target EMI fingerprint from the target EMI signals. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target computing system to determine whether the target computing system contains any unwanted electronic components.