Learning Execution Contexts from System Call Distributions for Intrusion Detection in Embedded Systems

TL;DR

This paper introduces a lightweight, cluster-based method for intrusion detection in embedded systems by analyzing system call frequency distributions, enabling effective anomaly detection with minimal overhead.

Contribution

It presents a novel approach that learns legitimate execution contexts through clustering and monitors them in real-time, with minimal processor modifications.

Findings

Effective detection of anomalous executions

Low overhead and minimal processor modifications

Applicable to embedded systems with real-time constraints

Abstract

Existing techniques used for intrusion detection do not fully utilize the intrinsic properties of embedded systems. In this paper, we propose a lightweight method for detecting anomalous executions using a distribution of system call frequencies. We use a cluster analysis to learn the legitimate execution contexts of embedded applications and then monitor them at run-time to capture abnormal executions. We also present an architectural framework with minor processor modifications to aid in this process. Our prototype shows that the proposed method can effectively detect anomalous executions without relying on sophisticated analyses or affecting the critical execution paths.