Research Repository

A method for detecting abnormal program behavior on embedded devices

Zhai, X and Appiah, K and Ehsan, S and Howells, G and Hu, H and Gu, D and McDonald-Maier, KD (2015) 'A method for detecting abnormal program behavior on embedded devices.' IEEE Transactions on Information Forensics and Security, 10 (8). 1692 - 1704. ISSN 1556-6013

[img]
Preview
Text
T-IFS-Final.pdf - Accepted Version

Download (715kB) | Preview

Abstract

© 2005-2012 IEEE. A potential threat to embedded systems is the execution of unknown or malicious software capable of triggering harmful system behavior, aimed at theft of sensitive data or causing damage to the system. Commercial off-the-shelf embedded devices, such as embedded medical equipment, are more vulnerable as these type of products cannot be amended conventionally or have limited resources to implement protection mechanisms. In this paper, we present a self-organizing map (SOM)-based approach to enhance embedded system security by detecting abnormal program behavior. The proposed method extracts features derived from processor's program counter and cycles per instruction, and then utilises the features to identify abnormal behavior using the SOM. Results achieved in our experiment show that the proposed method can identify unknown program behaviors not included in the training set with over 98.4% accuracy.

Item Type: Article
Subjects: T Technology > TA Engineering (General). Civil engineering (General)
Divisions: Faculty of Science and Health > Computer Science and Electronic Engineering, School of
Depositing User: Shoaib Ehsan
Date Deposited: 07 May 2015 10:13
Last Modified: 22 Jan 2019 22:15
URI: http://repository.essex.ac.uk/id/eprint/13498

Actions (login required)

View Item View Item