Paper Info
Title
Exploring ICMetrics to detect abnormal program behaviour on embedded devices
Abstract
Execution of unknown or malicious software on an embedded system may trigger harmful system behaviour targeted at stealing sensitive data and/or causing damage to the system. It is thus considered a potential and significant threat to the security of embedded systems. Generally, the resource constrained nature of commercial off-the-shelf (COTS) embedded devices, such as embedded medical equipment, does not allow computationally expensive protection solutions to be deployed on these devices, rendering them vulnerable. A Self-Organising Map (SOM) based and Fuzzy C-means based approaches are proposed in this paper for detecting abnormal program behaviour to boost embedded system security. The presented technique extracts features derived from processor's Program Counter (PC) and Cycles per Instruction (CPI), and then utilises the features to identify abnormal behaviour using the SOM. Results achieved in our experiment show that the proposed SOM based and Fuzzy C-means based methods can identify unknown program behaviours not included in the training set with 90.9% and 98.7% accuracy.
Year
DOI
Venue
2015
10.1016/j.sysarc.2015.07.007
Journal of Systems Architecture - Embedded Systems Design
Keywords
Field
DocType
Embedded system security,Abnormal behaviour detection,Intrusion detection,Self-Organising Map
Training set,Computer science,Parallel computing,Program counter,Fuzzy logic,Real-time computing,Rendering (computer graphics),Malware,Cycles per instruction,Intrusion detection system,Self organising maps,Embedded system
Journal
Volume
Issue
ISSN
61
10
1383-7621
Citations 
PageRank 
References 
0
0.34
21
Authors
7
Name
Order
Citations
PageRank
Xiaojun Zhai17721.78
Kofi Appiah216318.09
Shoaib Ehsan311024.43
Gareth Howells428044.88
Huosheng Hu52009220.95
Dongbing Gu676972.81
Klaus D. McDonald-Maier732754.43