Power as a Security Sensor

What the Circuit Knows

Stuxnet, the malware that sabotaged the centrifuges at Iran’s uranium enrichment plant, rewrote the settings of their motor drives. It ran the motors up to 1410 Hz and down to 2 Hz, against a normal range of 807 to 1210 Hz, and intercepted the engineering software’s access to the controllers so that the engineers could not see its changes (Symantec, 2011). The rapid, wide speed changes put stress on the centrifuges that the operators could not see. An independent, detailed electrical measurement would have been far harder to spoof, and it would have shown that stress as it happened.

Once an attacker controls the software layer, its telemetry is the first thing that can be falsified. A circuit’s current draw is set by the equipment on it, not by any host, so the waveform record remains an independent account of what that equipment did, down to the behavior of the components inside it.

The same record shows what is actually connected. A Raspberry Pi can present the network fingerprint of a laser printer, answer on the right ports, and respond to the right queries; software that imitates another system’s network stack well enough to fool a network scanner was published two decades ago (Provos, 2004). Electrically, they are different machines. The printer has a fuser with a thermal duty cycle and motor drives with commutation harmonics; the Raspberry Pi has a small switch-mode supply and no mechanical load.

What We Detect

Telling those machines apart starts with a baseline. EQ Wave™ records the complete current and voltage waveform continuously, so each monitored circuit builds a history of what it normally draws. When equipment is added, removed, swapped, or starts behaving differently, the change shows in the switching-band content, the harmonic structure, and the duty-cycle rhythm—detail that most meters and power quality analyzers miss.

The platform reports change against that baseline: this circuit is not drawing what it drew last month, with the waveform evidence attached. It needs no prior knowledge of the device and no signature library.

Why Waveform Resolution Matters

A counterfeit can match a device’s average power draw with little effort. Matching its switching-band signature is far harder, because the real magnetics, switching frequency, and control loop inside the device set it. The cost of a convincing fake rises with the measurement bandwidth of the instrument watching. The next generation of EQ Wave will extend continuous current capture through the 2 to 150 kHz supraharmonic band, where switch-mode power supplies operate and conventional analyzers keep only statistics or nothing.

How It Is Used

• Rotating sweeps: a few sensors moved on a schedule across a facility or a portfolio of sites, checking branch circuits against their own history, with no permanent installation.
• Continuous watch on sensitive circuits: permanent monitoring on circuits feeding regulated, classified, or safety-critical equipment.
• Supply-chain verification: equipment checked on arrival against a factory characterization developed with the manufacturer.

Limitations

• It complements network monitoring and does not replace it.
• On a feeder, many loads add together, and one device’s behavior can be masked by others. Device-level findings are therefore clearest at the outlet or branch circuit.
• A deviation from the baseline is evidence to investigate, not a verdict, and every finding traces to waveform samples an engineer can re-examine.
• We identify equipment and whether it is authorized, never people or their activity (Responsible Use).

Inside Your Perimeter

Recording and analysis run on premises, including on air-gapped networks, and every remote path to a gateway is authenticated by identity, not by network location. A Protocol Is Not a Security Posture explains how the platform is secured.