Keywords

1 Introduction

A wide variety of information technology equipment (ITE) is involved in our daily activities. Most of ITE devices radiate electromagnetic disturbance unintentionally. If someone intercepts these electromagnetic waves and reconstructs the information, confidential information might be leaked [1, 2]. Electromagnetic radiation was mentioned in some papers as a computer security risk [3–5]. These topic leads to the concept of TEMPEST, which is the technology of electromagnetic leaking research. Electromagnetic radiation from a computer display can be categorized into two types: radiation that contains text information and radiation that does not. TEMPEST focus more on text information leaking because most confidential information is text. The text information has higher risk of secret data leakage than non-text. Thus, it is important to efficiently and accurately distinguish the two types whether for an attacker or a protector.

The current researches on electromagnetic radiation detection mostly based on the harmonic characteristics of electromagnetic radiation signal spectrum, but these methods can’t distinguish the radiation that contains text information and radiation that does not [6, 7]. As a direct method, we can reconstruct the display image by using a special receiver, but not all test houses or manufacturers have such specialized receivers. Furthermore, to correctly reconstruct the electromagnetic radiation signal, the synchronizing information that including the horizontal synchronizing frequency and vertical synchronizing frequency is essential. However, the computer’s synchronization information is un-known in the practical non-cooperative attack scenario.

For these reasons, this paper proposed an evaluation method to determine whether or not text information is contained in electromagnetic radiation without knowing the synchronization information and reconstructing the dis-play image. First, we found the “text - space – text” characteristic for electro-magnetic radiation signal containing text information. Then, we proposed a new method which used sparse decomposition in wavelet to describe this characteristic. By using this method, we can accurately and efficiently detect the text information leakage in electromagnetic radiation from a computer display.

2 Analyzing Display Electromagnetic Radiation Signal Properties

Video signal produce depend on the combined action of horizontal synchronizing signal and vertical synchronizing signal [8]. Video signal can be represented as summation of digital pulses with different amplitude:

$$ S_{p} (t) = \sum\limits_{n = - \infty }^{ + \infty } {a_{n} } g_{T} (t - nT_{p} ) $$
(1)

where, g T (t) is code pattern of video pulse, and the symbol cycle is T p .

For images that contain text information, there are both information signal and horizontal synchronizing signal in the received electromagnetic radiation signal as shown in Fig. 1. At the same time, a text image containing text line and there is a space between every two lines, so there would be “text - space – text” characteristics of the text. The characteristics would also reflect in the electromagnetic radiation signal in time domain as shown in Fig. 2. This paper provides a way to describe this characteristics of the text to realize text information detection.

Fig. 1.
figure 1

Electromagnetic radiation signal with text information of computer display in time domain

Full size image
Fig. 2.
figure 2

The “text - space – text” characteristics in image and electromagnetic radiation signal

Full size image

3 Evalution Algorithm

In this paper, sparse knowledge is introduced to describe the characteristics of electromagnetic radiation signals contain text information. The implementation procedures are shown in a flow chart (Fig. 3).

Fig. 3.
figure 3

Flow chart of the implementation procedure of the proposed algorithm

Full size image

Firstly, make a sparse decomposition in wavelet domain. The sparse decomposition procedures can be represented as [9]

$$ X\mathop \to \limits^{DWT} \left\{ {a_{L} ,\left. {d_{j} } \right\}} \right.\mathop \to \limits^{Threshold} \left\{ {\mathop {a_{L} }\limits^{\sim } ,\left. {\mathop {d_{j} }\limits^{\sim } } \right\}} \right.\mathop \to \limits^{IDWT} \tilde{X} $$
(2)

where X is the initial electromagnetic radiation signal. Decompose X by wavelet and get the wavelet coefficient {a L , d j }. Set a threshold and then get the effective coefficient \( \left\{ {\mathop {a_{L} }\limits^{\sim } ,\left. {\mathop {d_{j} }\limits^{\sim } } \right\}} \right. \). \( \tilde{X} \) is sparse signal through wavelet inverse transformation. The threshold is used in hard thresh method.

$$ \left\{ {\mathop {a_{L} }\limits^{\sim } ,\left. {\mathop {d_{j} }\limits^{\sim } } \right\}} \right.{ = }\left\{ {\begin{array}{*{20}c} {0,\begin{array}{*{20}c} {} & {} \\ \end{array} \left| {\left\{ {a_{L} ,\left. {d_{j} } \right\}} \right.} \right| < Thr} \\ {\left\{ {a_{L} ,\left. {d_{j} } \right\}} \right.,\left| {\left\{ {a_{L} ,\left. {d_{j} } \right\}} \right.} \right| > Thr} \\ \end{array} } \right. $$
(3)

where,

$$ Thr = \sigma \sqrt {2\ln N} $$
(4)

where, N is the data length. σ is the standard deviation of noise.

$$ \hat{\sigma } = {{median\left| {Det1} \right|} \mathord{\left/ {\vphantom {{median\left| {Det1} \right|} {0.6745}}} \right. \kern-0pt} {0.6745}} $$
(5)

where, Det1 represents the most detailed wavelet coefficient.

Secondly, divide the sparse signal \( \tilde{X} \) into n equal sub-bands. The length of each sub-band is m.

$$ \tilde{X}{\text{ = [x}}_{1} x_{2} x_{3} \ldots \ldots x_{n - 1} {\text{x}}_{n} ] $$
(6)

Thirdly, calculate the sparsity of each sub-band. Sparsity is here defined as the number of non-zero components in the data. Sparsity of sparse signal \( \tilde{X} \) is not uniform. The text part is thick and the other part is thin, so the “text - space – text” characteristic in image becomes to “thick-thin-thick” characteristic in the sparse signal \( \tilde{X} \). This structure can be described by Block Sparse [10]. Thus, the \( \tilde{X} \) can be redescribed as,

$$ \tilde{X}{ = [}\underbrace {{{\text{x}}_{1} \ldots x_{{d_{1} }} }}_{x[1]}\underbrace {{x_{{d_{1} + 1}} \ldots x_{{d_{1} + d_{2} - 1}} }}_{x[2]} \ldots \underbrace {{x_{{n - d_{N} + 1}} \ldots {\text{x}}_{n} }}_{x[N]}] $$
(7)

where, \( n = \sum\nolimits_{j = 1}^{N} {d_{j} } \). x[j] is the jth block and its length is d j  ∊ Z +. Each block has different sparsity. Corresponding sparsity \( \tilde{Y} \) is

$$ \tilde{Y}{ = [}\underbrace {{y_{1} \ldots y_{{d_{1} }} }}_{y[1]}\underbrace {{y_{{d_{1} + 1}} \ldots y_{{d_{1} + d_{2} - 1}} }}_{y[2]} \ldots \underbrace {{y_{{n - d_{N} + 1}} \ldots y_{n} }}_{y[N]}] $$
(8)

Thus, if there is text information in the electromagnetic radiation signal, “text - space – text” characteristic would make the \( \tilde{Y} \) present periodic variation. There are many ways to describe periodic signal, correlation is here used.

Finally, calculate correlation of \( \tilde{Y} \), and the side lobe peak p i nearest the zero in the correlation is the period of “text - space – text” characteristic. Thus, the frequency f i of “text - space – text” characteristic is f i  = 1/p i . The correlation \( {\hat{\text{r}}}(k) \) is given as,

$$ {\hat{\text{r}}}(k) = \frac{1}{N}\sum\limits_{n = 0}^{N - 1} {y_{N} (n)} y_{N} (n + k) $$
(9)

Considering period would increase with the increase of word size, we set the threshold \( \widetilde{thr} \) is the frequency when the word size is 5. Thus, when \( f_{i} < \widetilde{thr} \), it can be concluded that the signal contain text information. For the condition that there is no side lobe peak in correlation of \( \tilde{Y} \), the p i means zero, \( f_{i} \gg \widetilde{thr} \). Thus, it can be concluded that the signal does not contain text information.

4 Experimental Results

In this section, the proposed algorithm is applied to experimental data and the results and analysis are given.

The measurement setup is shown in Fig. 4. The resolution of the computer display was 1024 × 768. A log-periodic antenna was located at 1 m from the front surface of the computer, and its height was the same as the height of the computer display center. An antenna is connected to a data collector, which can be data acquisition card, digital oscilloscope and spectrum analyzer. Digital oscilloscope was here used.

Fig. 4.
figure 4

Measurement setup for data collection

Full size image

To prove the feasibility of the proposed algorithm, image with text information, image without text information and blank image are tested respectively. The sub-band length m is set to 1000. Through experiment, we got the \( \widetilde{thr} \) is equal to 5 Khz.

Firstly, for an image with text information, results are shown in Fig. 5. Figure 5(a) shows the reconstructed image with text information. As can be seen from Fig. 5(b), the sparsity of signal presents the periodic structure “text-space-text” obviously. The correlation of sparsity is shown in Fig. 5(c). It can be seen that the peak nearest the zero is 0.0009081, so \( f_{i} = 1/0.0009081 = 1.1012\;Khz < \widetilde{thr} \). Thus, the experimental result is that the signal contains text information.

Fig. 5.
figure 5

Image with text information. (a) Reconstructed image. (b) Sparsity of electromagnetic radiation signal. (c) Correlation of sparsity for image with text information.

Full size image

Secondly, for a blank image, results are shown in Fig. 6. As can be seen from Fig. 6(a), the distribution of sparsity is chaotic. Figure 6(b) shows the correlation of sparsity. It can be seen that there is no side lobe peak in correlation of \( \tilde{Y} \). Thus, the experimental result is that the signal dose not contain text information.

Fig. 6.
figure 6

Blank image. (a) Sparsity of electromagnetic radiation signal. (b) Correlation of sparsity.

Full size image

Thirdly, for an image without text information, results are shown in Fig. 7. Figure 7(a) shows the original image with text information. Its sparsity of signal is shown in Fig. 7(b). It can be seen that the distribution of sparsity is chaotic. In Fig. 7(c), the correlation of sparsity is shown. The peak nearest the zero is 2.004e −5, so \( f_{i} = 1/ 2. 0 0 4e^{ - 5} = 49.9\;Khz > \widetilde{thr} \). Thus, the experimental result is that the signal dose not contain text information.

Fig. 7.
figure 7

Non-blank image without text information. (a) Original image. (b) Sparsity of electromagnetic radiation signal (c) Correlation of sparsity

Full size image

To evaluate the clutter detection performance of the algorithm, the probability of detection (POD) and the false alarm rate (FAR) are computed. The definitions of POD and FAR are:

$$ {\text{POD}} = {{TruePositives} \mathord{\left/ {\vphantom {{TruePositives} {(TruePositives + FalseNegatives)}}} \right. \kern-0pt} {(TruePositives + FalseNegatives)}} $$
(10)
$$ {\text{FAR}} = {{FalsePositives} \mathord{\left/ {\vphantom {{FalsePositives} {(FalsePositives + TrueNegatives)}}} \right. \kern-0pt} {(FalsePositives + TrueNegatives)}} $$
(11)

where, “Positive” labels the location that the detector judges as image with text information, and “Negative” labels the location that the detector judges as image without text information; In Table 1, True Positive (TP),False Negative (FN),False Positive (FP),True Negative (TN) and FAR of the data are summarized for the proposed algorithm.

Table 1. Performance of algorithm based on data
Full size table

5 Conclusion

An evaluation method that determines whether or not electromagnetic radiation contains text information is proposed in this paper. First, we found the “text - space – text” characteristic for electromagnetic radiation signal containing text information. Then, we propose a new method to describe this characteristic. By using this method, we can accurately and efficiently detect the text information leakage in electromagnetic radiation from a computer display. In the future, we will analyze the performance of the proposed algorithm under different parameter setting.