Exploring ICMetrics to detect abnormal program behaviour on embedded devices

Zhai, X, Appiah, K ORCID logoORCID: https://orcid.org/0000-0002-9480-0679, Ehsan, S, Howells, G, Hu, H, Gu, D and McDonald-Maier, K, 2015. Exploring ICMetrics to detect abnormal program behaviour on embedded devices. Journal of Systems Architecture, 61 (10), pp. 567-575. ISSN 1383-7621

[thumbnail of PubSub2482_Appiah.pdf]
Preview
Text
PubSub2482_Appiah.pdf - Post-print

Download (483kB) | Preview

Abstract

Execution of unknown or malicious software on an embedded system may trigger harmful system behaviour targeted at stealing sensitive data and/or causing damage to the system. It is thus considered a potential and significant threat to the security of embedded systems. Generally, the resource constrained nature of Commercial off-the-shelf (COTS) embedded devices, such as embedded medical equipment, does not allow computationally expensive protection solutions to be deployed on these devices, rendering them vulnerable. A Self-Organising Map (SOM) based and Fuzzy C-means based approaches are proposed in this paper for detecting abnormal program behaviour to boost embedded system security. The presented technique extracts features derived from processor's Program Counter (PC) and Cycles per Instruction (CPI), and then utilises the features to identify abnormal behaviour using the SOM. Results achieved in our experiment show that the proposed SOM based and Fuzzy C-means based methods can identify unknown program behaviours not included in the training set with 90.9% and 98.7% accuracy.

Item Type: Journal article
Publication Title: Journal of Systems Architecture
Creators: Zhai, X., Appiah, K., Ehsan, S., Howells, G., Hu, H., Gu, D. and McDonald-Maier, K.
Publisher: Elsevier
Date: November 2015
Volume: 61
Number: 10
ISSN: 1383-7621
Identifiers:
Number
Type
10.1016/j.sysarc.2015.07.007
DOI
Divisions: Schools > School of Science and Technology
Record created by: EPrints Services
Date Added: 09 Oct 2015 10:12
Last Modified: 26 Jul 2017 08:42
URI: https://irep.ntu.ac.uk/id/eprint/9321

Actions (login required)

Edit View Edit View

Statistics

Views

Views per month over past year

Downloads

Downloads per month over past year