  Trustworthy operation of industrial control systems depends on secure and
real-time code execution on the embedded programmable logic controllers (PLCs).
The controllers monitor and control the critical infrastructures, such as
electric power grids and healthcare platforms, and continuously report back the
system status to human operators. We present Zeus, a contactless embedded
controller security monitor to ensure its execution control flow integrity.
Zeus leverages the electromagnetic emission by the PLC circuitry during the
execution of the controller programs. Zeus's contactless execution tracking
enables non-intrusive monitoring of security-critical controllers with tight
real-time constraints. Those devices often cannot tolerate the cost and
performance overhead that comes with additional traditional hardware or
software monitoring modules. Furthermore, Zeus provides an air-gap between the
monitor (trusted computing base) and the target (potentially compromised) PLC.
This eliminates the possibility of the monitor infection by the same attack
vectors. Zeus monitors for control flow integrity of the PLC program execution.
Zeus monitors the communications between the human-machine interface and the
PLC, and captures the control logic binary uploads to the PLC. Zeus exercises
its feasible execution paths, and fingerprints their emissions using an
external electromagnetic sensor. Zeus trains a neural network for legitimate
PLC executions, and uses it at runtime to identify the control flow based on
PLC's electromagnetic emissions. We implemented Zeus on a commercial Allen
Bradley PLC, which is widely used in industry, and evaluated it on real-world
control program executions. Zeus was able to distinguish between different
legitimate and malicious executions with 98.9% accuracy and with zero overhead
on PLC execution by design.
