Trusted Monitor: TEE-Based System Monitoring

Jung, Benedikt; Eichler, Christian; Röckl, Jonas; Schlenk, R.; Hönig, Timo; Müller, Tilo

doi:10.1109/sbesc56799.2022.9964869

Cited by 1 publication

(2 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From within the ARM TrustZone, we continuously monitor the system's state by relying on hardware performance counters. The performance This paper was originally published in the 2022 XII Brazilian Symposium on Computing Systems Engineering (SBESC) [1].…”

Section: Introductionmentioning

confidence: 99%

“…In summary, this paper makes the following contributions: (1) To the best of our knowledge, we are the first to evaluate intrusion and anomaly detection based on hardware performance counters and artificial intelligence directly out of the ARM TrustZone TEE. (2) We present a functional prototype as an extension to the Linux operating system.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Profiling with Trust: System Monitoring from Trusted Execution Environments

Eichler

Röckl

Jung

et al. 2023

Preprint

Self Cite

View full text Add to dashboard Cite

Large-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%