The increasing number of security threats faced by real-time embedded systems requires the development of effective intrusion detection mechanisms. However, the limited resources in such systems, viz., computational power and storage, prevent current techniques from being effective. In this paper, we propose a lightweight method with a deterministic time complexity for detecting anomalous executions using a distribution of system call frequencies, i.e., the number of occurrences of each system call type during execution. We use the global k-means clustering with the Mahalanobis distance to learn the legitimate execution contexts of real-time embedded applications and then monitor them at run-time to detect intrusions. We also present minor processor modifications to aid in this process. Initial prototypes show that the proposed method can effectively detect anomalous executions without relying on overly sophisticated analyses. It can also detect certain attacks that current methods fail to do so.
['Man-Ki Yoon', 'Sibin Mohan', 'Jaesik Choi', 'Mihai Christodorescu', 'Lui Sha']
Intrusion Detection Using Execution Contexts Learned from System Call Distributions of Real-Time Embedded Systems