Hardware-Based Probabilistic Threat Detection and Estimation for Embedded Systems
Name:
PID5537817_(check_passed_versi ...
Size:
931.0Kb
Format:
PDF
Description:
Final Accepted Manuscript
Affiliation
Univ Arizona, Dept Elect & Comp EngnIssue Date
2018Keywords
Timing-based threat detectionAnomaly detection
Embedded system security
Non-intrusive hardware
Metadata
Show full item recordPublisher
IEEECitation
N. A. Carreon, S. Lu and R. Lysecky, "Hardware-Based Probabilistic Threat Detection and Estimation for Embedded Systems," 2018 IEEE 36th International Conference on Computer Design (ICCD), Orlando, FL, USA, 2018, pp. 522-529. doi: 10.1109/ICCD.2018.00084Rights
© 2018 IEEE.Collection Information
This item from the UA Faculty Publications collection is made available by the University of Arizona with support from the University of Arizona Libraries. If you have questions, please contact us at repository@u.library.arizona.edu.Abstract
With billions of networked connected embedded systems, the security historically provided by the isolation of embedded systems is no longer sufficient. Both proactive security measures that prevent intrusions and reactive measures that detect intrusions are essential. Anomaly-based detection is a common reactive approach employed to detect malware that has evaded proactive defenses by observing anomalous deviations in the system execution. Timing-based anomaly detection detects malware by monitoring the system's internal timing, which offers unique protection against mimicry malware compared to sequence-based anomaly detection. However, previous timing-based anomaly detection methods focus on each operation independently at the granularity of tasks, function calls, system calls, or basic blocks. These approaches neither consider the entire software execution path nor provide a quantitative estimate of the presence of malware. This paper presents a novel model for specifying the normal timing for execution paths in software applications using cumulative distribution functions of timing data in sliding execution windows. We present a probabilistic formulation for estimating the presence of malware for individual operations and sequences of operations within the paths, and we define thresholds to minimize false positives based on training data. Experimental results with a smart connected pacemaker and three sophisticated mimicry malware demonstrate improved performance and accuracy compared to state-of-the-art timing-based malware detection.ISSN
978-1-5386-8477-1Version
Final accepted manuscriptSponsors
National Science Foundation [CNS-1615890]Additional Links
https://ieeexplore.ieee.org/document/8615734/ae974a485f413a2113503eed53cd6c53
10.1109/ICCD.2018.00084