{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T11:10:17Z","timestamp":1789125017925,"version":"build-2803163510"},"reference-count":55,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T00:00:00Z","timestamp":1789084800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>This study introduces a unified evaluation framework for device-level intrusion detection using power side-channel fingerprints under an open-set threat model. We target post-enrollment device substitution: an adversary replaces a legitimate Commercial Off-The-Shelf (COTS) node with a counterfeit of the same model and firmware after enrollment, during deployment or maintenance, making the substitution invisible to credential-based authentication. To address this scenario, we evaluate seven ESP32-WROOM-32 and seven Arduino Uno R3 devices across four sessions spanning 45 days. Each platform group is drawn from a single manufacturing batch so that measured differences reflect within-batch variation; results are correspondingly established at this scale and for this sourcing. Unlike most prior studies that evaluate fingerprinting under isolated assumptions, this study treats intrusion detection as a system-level problem that requires the joint consideration of temporal stability, open-set recognition, and feature representation. We conduct a two-tier evaluation. Tier 1 characterizes device uniqueness and temporal stability using handcrafted statistical features and neural embeddings trained via triplet + Additive-Margin Softmax (AM-Softmax) loss, analyzed via separation ratios, d\u2032 scores, F1-scores, and statistical power. Tier 2 applies embeddings to an open-set intrusion-detection protocol using percentile-based thresholding. This analysis reveals that temporal viability is strongly influenced by feature representation under the evaluated conditions. Over 45 days, under an identical Leave-One-Run-Out protocol and scoring rule, neural embeddings achieve a 93.9% true positive rate at a 9.9% false acceptance rate, whereas the same rule applied to handcrafted statistical features yields 66.4% and 35.8%. When each device identity is withheld from training altogether, embeddings hold a 26.0% false acceptance rate against 39.0% for statistical features. Platform comparison shows that ESP32 achieves a 1.80\u00d7 higher separation ratio than Arduino (3.06 vs. 1.70), with architecture-dependent discriminability. Statistical power analysis yields 89.1% power at d=0.774. These results identify representation-level robustness as a key requirement for practical power-based intrusion detection, while longer-term validation remains an important direction for future work.<\/jats:p>","DOI":"10.3390\/s26185769","type":"journal-article","created":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T10:51:37Z","timestamp":1789123897000},"page":"5769","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Anomaly-Based Intrusion Detection for IoT Microcontrollers Using Power Side-Channel Fingerprinting"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0428-0078","authenticated-orcid":false,"given":"Samar Mohamed Hussein","family":"Shukry","sequence":"first","affiliation":[{"name":"Department of Electronics and Networks Engineering, German University in Cairo, New Cairo 11835, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"}]},{"given":"Frank","family":"Kargl","sequence":"additional","affiliation":[{"name":"Institute of Distributed Systems, Ulm University, 89077 Ulm, Germany"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"}]},{"given":"Tallal","family":"El-Shabrawy","sequence":"additional","affiliation":[{"name":"Department of Electronics and Networks Engineering, German University in Cairo, New Cairo 11835, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"}]},{"given":"Amr Talaat","family":"Abdel-Hamid","sequence":"additional","affiliation":[{"name":"Department of Electronics and Networks Engineering, German University in Cairo, New Cairo 11835, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,11]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1207","DOI":"10.1109\/JPROC.2014.2332291","article-title":"Counterfeit integrated circuits: A rising threat in the global semiconductor supply chain","volume":"102","author":"Guin","year":"2014","journal-title":"Proc. IEEE"},{"key":"ref_2","unstructured":"Xiao, Y., He, Y., Zhang, X., Wang, Q., Xie, R., Sun, K., Xu, K., and Li, Q. (March, January 26). From hardware fingerprint to access token: Enhancing the authentication on IoT devices. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"42","DOI":"10.1109\/MWC.001.2300420","article-title":"Domain-agnostic hardware fingerprinting-based device identifier for Zero-Trust IoT security","volume":"31","author":"Elmaghbub","year":"2024","journal-title":"IEEE Wirel. Commun."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1145\/3596247","article-title":"Fingerprinting IoT devices using latent physical side-channels","volume":"7","author":"Feng","year":"2023","journal-title":"Proc. ACM Interact. Mob. Wearable Ubiquitous Technol."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Suh, G.E., and Devadas, S. (2007, January 18\u201322). Physical unclonable functions for device authentication and secret key generation. Proceedings of the ACM\/IEEE Design Automation Conference (DAC), San Diego, CA, USA.","DOI":"10.1145\/1278480.1278484"},{"key":"ref_6","unstructured":"Stallings, W. (2020). Cryptography and Network Security: Principles and Practice, Pearson Education. [8th ed.]."},{"key":"ref_7","unstructured":"Zhang, T., Jiang, J., and Zhang, Y. (2019). Revisiting and evaluating software side-channel vulnerabilities and countermeasures in cryptographic applications. arXiv."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"277","DOI":"10.1007\/978-3-642-41671-2_36","article-title":"Performance analysis for PUF data using fuzzy extractor","volume":"Volume 280","author":"Kang","year":"2014","journal-title":"Ubiquitous Information Technologies and Applications (CUTE 2013)"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1876","DOI":"10.1109\/TIFS.2013.2279798","article-title":"PUF modeling attacks on simulated and silicon data","volume":"8","author":"Sehnke","year":"2013","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Spolaor, R., Liu, H., Turrin, F., Conti, M., and Cheng, X. (2023, January 17\u201320). Plug and power: Fingerprinting USB powered peripherals via power side-channel. Proceedings of the IEEE International Conference on Computer Communications (INFOCOM), New York, NY, USA.","DOI":"10.1109\/INFOCOM53939.2023.10229048"},{"key":"ref_11","first-page":"24","article-title":"The finger in the power: How to fingerprint PCs by monitoring their power consumption","volume":"Volume 13959","author":"Botvinnik","year":"2023","journal-title":"International Conference on Detection Intrusions Malware Vulnerability Assessment (DIMVA)"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Ronkin, M., and Bykhovsky, D. (2023). Passive fingerprinting of same-model electrical devices by current consumption. Sensors, 23.","DOI":"10.3390\/s23010533"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"7618","DOI":"10.1109\/TMC.2023.3340039","article-title":"Towards receiver-agnostic and collaborative radio frequency fingerprint identification","volume":"23","author":"Shen","year":"2024","journal-title":"IEEE Trans. Mob. Comput."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Lomba, E., Severino, R., and Fern\u00e1ndez Vilas, A. (2022, January 6\u20139). Towards adaptive RF fingerprint-based authentication of IIoT devices. Proceedings of the 27th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA), Stuttgart, Germany.","DOI":"10.1109\/ETFA52439.2022.9921575"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Jagannath, A., Kane, Z., and Jagannath, J. (2022, January 4\u20138). RF fingerprinting needs attention: Multi-task approach for real-world WiFi and Bluetooth. Proceedings of the IEEE Global Communications Conference (GLOBECOM), Rio de Janeiro, Brazil.","DOI":"10.36227\/techrxiv.20442867.v2"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"93","DOI":"10.1109\/TDSC.2005.26","article-title":"Remote physical device fingerprinting","volume":"2","author":"Kohno","year":"2005","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Ronkin, M., and Bykhovsky, D. (2022, January 13\u201315). Electrical equipment fingerprinting with electrical network current consumption. Proceedings of the 45th International Conference on Telecommunications and Signal Processing (TSP), Prague, Czech Republic.","DOI":"10.1109\/TSP55681.2022.9851296"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"He, Z., and Sayadi, H. (2025, January 25\u201328). PowerPrint: Harnessing machine learning for accurate and scalable device fingerprinting via power consumption. Proceedings of the IEEE International Symposium on Circuits and Systems (ISCAS), London, UK.","DOI":"10.1109\/ISCAS56072.2025.11043487"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Myridakis, D., Spathoulas, G., Kakarountas, A., Schoinianakis, D., and Lueken, J. (2018, January 2\u20135). Anomaly detection in IoT devices via monitoring of supply current. Proceedings of the 8th International Conference on Consumer Electronics\u2014Berlin (ICCE-Berlin), Berlin, Germany.","DOI":"10.1109\/ICCE-Berlin.2018.8576178"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Park, J., Surabhi, V.R., Krishnamurthy, P., Garg, S., Karri, R., and Khorrami, F. (2020, January 25\u201329). Anomaly detection in embedded systems using power and memory side channels. Proceedings of the IEEE European Test Symposium (ETS), Tallinn, Estonia.","DOI":"10.1109\/ETS48528.2020.9131596"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Jung, W., Feng, Y., Khan, S.A., Xin, C., Zhao, D., and Zhou, G. (2022, January 4\u20136). DeepAuditor: Distributed online intrusion detection system for IoT devices via power side-channel auditing. Proceedings of the 21st ACM\/IEEE International Conference on Information Processing in Sensor Networks (IPSN), Milan, Italy.","DOI":"10.1109\/IPSN54338.2022.00040"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Lightbody, D., Ngo, D.-M., Temko, A., Murphy, C.C., and Popovici, E. (2024). Dragon_Pi: IoT side-channel power data intrusion detection dataset and unsupervised convolutional autoencoder for intrusion detection. Future Internet, 16.","DOI":"10.3390\/fi16030088"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"103579","DOI":"10.1016\/j.jnca.2022.103579","article-title":"A methodology to identify identical single-board computers based on hardware behavior fingerprinting","volume":"212","author":"Bovet","year":"2023","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"103596","DOI":"10.1016\/j.cose.2023.103596","article-title":"Single-board device individual authentication based on hardware performance and autoencoder transformer models","volume":"137","author":"Bovet","year":"2024","journal-title":"Comput. Secur."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Huang, K., Yang, J., Hu, P., and Liu, H. (2022). A novel framework for open-set authentication of Internet of Things using limited devices. Sensors, 22.","DOI":"10.3390\/s22072662"},{"key":"ref_26","unstructured":"Alhazbi, S., Sciancalepore, S., and Oligeri, G. (2023, January 4\u20138). The day-after-tomorrow: On the performance of radio fingerprinting over time. Proceedings of the 39th Annual Computer Security Applications Conference (ACSAC), Austin, TX, USA."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1646","DOI":"10.1109\/COMST.2020.2988293","article-title":"A survey of machine and deep learning methods for Internet of Things (IoT) security","volume":"22","author":"Mohamed","year":"2020","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1016\/j.comcom.2022.11.001","article-title":"A review of machine learning-based zero-day attack detection: Challenges and future directions","volume":"198","author":"Guo","year":"2023","journal-title":"Comput. Commun."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1023\/B:MACH.0000008084.60811.49","article-title":"Support vector data description","volume":"54","author":"Tax","year":"2004","journal-title":"Mach. Learn."},{"key":"ref_30","unstructured":"Bendale, A., and Boult, T.E. (July, January 26). Towards open set deep networks. Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"65356","DOI":"10.1109\/ACCESS.2025.3559325","article-title":"Intrusion detection in IoT networks using dynamic graph modeling and graph-based neural networks","volume":"13","author":"Govea","year":"2025","journal-title":"IEEE Access"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Anagnostopoulos, N.A., Fan, Y., Saleem, M.U., Mexis, N., Gel\u00f3czi, E., Klement, F., Frank, F., Schaller, A., Arul, T., and Katzenbeisser, S. (2022, January 2\u20136). Testing physical unclonable functions implemented on commercial off-the-shelf NAND Flash memories using programming disturbances. Proceedings of the 12th IEEE International Conference on Consumer Electronics (ICCE-Berlin), Berlin, Germany.","DOI":"10.1109\/ICCE-Berlin56473.2022.10021310"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., and Thompson, M. (2023). Guide to Operational Technology (OT) Security, National Institute of Standards and Technology (NIST). NIST Special Publication 800-82, Rev. 3.","DOI":"10.6028\/NIST.SP.800-82r3"},{"key":"ref_34","unstructured":"(2020). Electricity Metering Equipment\u2014General Requirements, Tests and Test Conditions\u2014Part 11: Metering Equipment (Standard No. IEC 62052-11:2020). Available online: https:\/\/cdn.standards.iteh.ai\/samples\/23376\/a93fb3cf9870451cae24e9705b9fda74\/IEC-62052-11-2020.pdf."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"(2022). Information Security, Cybersecurity and Privacy Protection\u2014Information Security Management Systems\u2014Requirements (Standard No. ISO\/IEC 27001:2022). Available online: https:\/\/www.iso.org\/standard\/27001.","DOI":"10.2307\/j.ctv30qq13d"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Rose, S., Borchert, O., Mitchell, S., and Connelly, S. (2020). Zero Trust Architecture, National Institute of Standards and Technology (NIST).","DOI":"10.6028\/NIST.SP.800-207"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"1273","DOI":"10.1080\/01621459.1993.10476408","article-title":"Alternatives to the median absolute deviation","volume":"88","author":"Rousseeuw","year":"1993","journal-title":"J. Am. Stat. Assoc."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"137","DOI":"10.3758\/BF03207704","article-title":"Calculation of signal detection theory measures","volume":"31","author":"Stanislaw","year":"1999","journal-title":"Behav. Res. Methods Instrum. Comput."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_40","unstructured":"Hermans, A., Beyer, L., and Leibe, B. (2017). In defense of the triplet loss for person re-identification. arXiv."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"926","DOI":"10.1109\/LSP.2018.2822810","article-title":"Additive margin Softmax for face verification","volume":"25","author":"Wang","year":"2018","journal-title":"IEEE Signal Process. Lett."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1109\/TCCN.2020.3043332","article-title":"Open set wireless transmitter authorization: Deep learning approaches and dataset considerations","volume":"7","author":"Hanna","year":"2021","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"ref_43","unstructured":"(2021). Information Technology\u2014Biometric Performance Testing and Reporting\u2014Part 1: Principles and Framework (Standard No. ISO\/IEC 19795-1:2021). Available online: https:\/\/www.iso.org\/standard\/73515.html."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Cumming, G. (2012). Understanding the New Statistics: Effect Sizes, Confidence Intervals, and Meta-Analysis, Routledge.","DOI":"10.4324\/9780203807002"},{"key":"ref_45","unstructured":"Cohen, J. (1988). Statistical Power Analysis for the Behavioral Sciences, Lawrence Erlbaum. [2nd ed.]."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"279","DOI":"10.4300\/JGME-D-12-00156.1","article-title":"Using effect size\u2014Or why the P value is not enough","volume":"4","author":"Sullivan","year":"2012","journal-title":"J. Grad. Med. Educ."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"365","DOI":"10.1038\/nrn3475","article-title":"Power failure: Why small sample size undermines the reliability of neuroscience","volume":"14","author":"Button","year":"2013","journal-title":"Nat. Rev. Neurosci."},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"591","DOI":"10.1111\/j.1469-185X.2007.00027.x","article-title":"Effect size, confidence interval and statistical significance: A practical guide for biologists","volume":"82","author":"Nakagawa","year":"2007","journal-title":"Biol. Rev."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"303","DOI":"10.1016\/0098-3004(93)90090-R","article-title":"Principal components analysis (PCA)","volume":"19","author":"Ratajczak","year":"1993","journal-title":"Comput. Geosci."},{"key":"ref_50","unstructured":"(2019). IEEE Standard for Floating-Point Arithmetic (Standard No. IEEE Std 754-2019)."},{"key":"ref_51","first-page":"800","article-title":"TensorFlow Lite Micro: Embedded Machine Learning for TinyML Systems","volume":"3","author":"David","year":"2021","journal-title":"Proc. Mach. Learn. Syst."},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"168","DOI":"10.1145\/3776588","article-title":"From Tiny Machine Learning to Tiny Deep Learning: A Survey","volume":"58","author":"Somvanshi","year":"2026","journal-title":"ACM Comput. Surv."},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"130","DOI":"10.1145\/3291047","article-title":"Demystifying Arm TrustZone: A comprehensive survey","volume":"51","author":"Pinto","year":"2019","journal-title":"ACM Comput. Surv."},{"key":"ref_54","unstructured":"(2020). Electromagnetic Compatibility (EMC)\u2014Part 4-3: Testing and Measurement Techniques\u2014Radiated, Radio-Frequency, Electromagnetic Field Immunity Test (Standard No. IEC 61000-4-3:2020)."},{"key":"ref_55","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1016\/j.future.2023.10.011","article-title":"Adversarial attacks and defenses on ML- and hardware-based IoT device fingerprinting and identification","volume":"152","author":"Bovet","year":"2024","journal-title":"Future Gener. Comput. Syst."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5769\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T10:54:33Z","timestamp":1789124073000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5769"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,11]]},"references-count":55,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185769"],"URL":"https:\/\/doi.org\/10.3390\/s26185769","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,11]]}}}