Towards Host Intrusion Detection for Embedded Industrial Systems

Abstract

Original Equipment Manufacturers now embed hardware virtualization in car equipments to reduce costs and hardware complexity, while allowing more functionalities, such as connectivity. This evolution forces the cohabitation of distinct criticality domains on the same hardware, reaffirming the need for security. Because of the trade-off between performance and system overall complexity, deploying security becomes a challenging balancing act. Host Intrusion Detection Systems (HIDS) security protects the behavior of a program at runtime: it monitors the program execution flow to distinguish threats from benign activity. This paper presents a novel runtime security solution for embedded mixed-criticality systems, which integrates HIDS in a partitioned system based on Multiple Independent Levels of Security (MILS) architecture. Our HIDS monitors a program's execution by observing both hardware and software signals; there is to our knowledge no HIDS providing such precise representation of program execution.

The FORA European Training Network on Fog Computing for Robotics and Industrial Automation

“…We have developed a table-driven VM scheduler for Xen, a new clock mode and tracing hooks to handle safety-critical applications that have real-time requirements and have to synchronize their activities across FNs [17]. PikeOS has been extended with container capabilities and with continuous monitoring services for security [18].…”

“…The FCP implements the Precise Time Protocol Multi-Domain Aggregation for safe and secure clock synchronizations [30]. The security services are implemented as the lightweight authentication protocols for secure and efficient TLS Session Resumption, rTLS [31] and a host intrusion detection system integrated to the FCP [18]. The dependability services are based on a framework for recovery using fault-tolerant mechanism [32] and fault tolerant scheduling solutions for multi-criticality TSN traffic [33].…”

Intrusion Detection System Based on Integrated System Calls Graph and Neural Networks

“…Host IDS detect attacks based on system logs, audit data, Windows Registry, file systems, system calls, and program analysis [17]. Two of the most important areas of interest in host IDS are embedded systems [18] and the Android operating system [19], [20].…”

Online Transition-Based Feature Generation for Anomaly Detection in Concurrent Data Streams

“…It is applicable to HIDS based on system calls or kernel operations [33], [34], [35]. The calls are provided as events, and each process will generate a distinct case.…”