Learning Execution Contexts from System Call Distribution for Anomaly Detection in Smart Embedded System

Existing techniques used for anomaly detection do not fully utilize the intrinsic properties of embedded devices. In this paper, we propose a lightweight method for detecting anomalous executions using a distribution of system call frequencies. We use a cluster analysis to learn the legitimate execu...

Full description

Saved in:
Bibliographic Details
Published in2017 IEEE/ACM Second International Conference on Internet-of-Things Design and Implementation (IoTDI) pp. 191 - 196
Main Authors Man-Ki Yoon, Mohan, Sibin, Jaesik Choi, Christodorescu, Mihai, Lui Sha
Format Conference Proceeding
LanguageEnglish
Published ACM 01.04.2017
Subjects
Anomaly Detection
Context
Embedded systems
Monitoring
Open source software
Prototypes
Security
Online AccessGet full text

Cover

More Information
Summary:Existing techniques used for anomaly detection do not fully utilize the intrinsic properties of embedded devices. In this paper, we propose a lightweight method for detecting anomalous executions using a distribution of system call frequencies. We use a cluster analysis to learn the legitimate execution contexts of embedded applications and then monitor them at run-time to capture abnormal executions. Our prototype applied to a real-world open-source embedded application shows that the proposed method can effectively detect anomalous executions without relying on sophisticated analyses or affecting the critical execution paths.