Learning Execution Contexts from System Call Distribution for Anomaly Detection in Smart Embedded System

Abstract

Existing techniques used for intrusion detection do not fully utilize the intrinsic properties of embedded systems. In this paper, we propose a lightweight method for detecting anomalous executions using a distribution of system call frequencies. We use a cluster analysis to learn the legitimate execution contexts of embedded applications and then monitor them at run-time to capture abnormal executions. We also present an architectural framework with minor processor modifications to aid in this process. Our prototype shows that the proposed method can effectively detect anomalous executions without relying on sophisticated analyses or affecting the critical execution paths. IntroductionAn increasing number of attacks are targeting embedded systems [21,37] that compromise the security, and hence safety, of such systems. It is not an easy task to retrofit embedded systems with security mechanisms that were developed for more general purpose scenarios since the former (a) have constraints in processing power, memory, battery life, etc. and (b) are required to meet stringent requirements such as timing constraints.Traditional behavior-based intrusion detection systems (IDS) [10] rely on specific signals such as network traffic [15,39], control flow [1,8], system calls [14,32,5], etc. The use of system calls, especially in the form of sequences [14,16,44,29,12,40], has been extensively studied in behavior-based IDSes for general purpose systems since many malicious activities often use system calls to execute privileged operations on system resources. Because server, desktop and mobile applications exhibit rich, wildly varying behaviors across executions, such IDSes need to rely either (a) on complex models of normal behavior, which are expensive to run and thus unsuitable for an embedded system, or (b) on simple, partial models, which validate only small windows of the application execution at a time. This opens the door for attacks where variations of a valid execution sequence are replayed with slightly different parameters to achieve a malicious goal; on the other hand, the application would not execute that sequence of operations in a normal manner, every time.

Checking is Believing: Event-Aware Program Anomaly Detection in Cyber-Physical Systems

“…• CPS platform. We assume the initial state (i.e., the training stage) of the application is trustworthy, which is a general requirement of most behavior-based intrusion detection systems [31]. We also assume the runtime monitoring module (running on the host) is trusted and cannot be disabled or modified.…”

Design and Development of AD-CGAN: Conditional Generative Adversarial Networks for Anomaly Detection

“…Authors of [19] have an anomaly model built using system call frequency distribution and clustering techniques to detect when processes deviate from their standard profiles. Similar to the anomaly frameworks of [13], [14], the model of [19] has no temporal modeling of the events and can only be used for post-mortem analysis. Furthermore, the authors of [20] used the statistical metric of entropy to implement an anomaly detection model for network logs.…”

TaskShuffler: A Schedule Randomization Protocol for Obfuscation against Timing Inference Attacks in Real-Time Systems

“…Otherwise, the adversary can perform more active attacks than what is described above -this is out of scope for this paper and we intend to analyze it in future work. There are various other threats faced by real-time systems [14], [26]- [29], [31] -most of these techniques are about intrusion detection and hence complementary to those presented here.…”

“…Hence, any perturbations to these operational modes can result in the safety of such systems being compromised. On one hand, recent studies [14], [26]- [29], [31] have shown that the security of real-time systems can be improved by taking advantage of these very properties, viz., predictability (or regularity) in their behavior. Such security mechanisms try to detect abnormal deviations from expected patterns.…”