Pal, Chandrajit and Saha, Sangeet and Zhai, Xiaojun and Howells, Gareth and McDonald-Maier, Klaus D (2025) APPARENT: AI-Powered Platform Anomaly Detection in Edge Computing. IEEE Transactions on Sustainable Computing. pp. 1-17. DOI https://doi.org/10.1109/tsusc.2025.3562738
Pal, Chandrajit and Saha, Sangeet and Zhai, Xiaojun and Howells, Gareth and McDonald-Maier, Klaus D (2025) APPARENT: AI-Powered Platform Anomaly Detection in Edge Computing. IEEE Transactions on Sustainable Computing. pp. 1-17. DOI https://doi.org/10.1109/tsusc.2025.3562738
Pal, Chandrajit and Saha, Sangeet and Zhai, Xiaojun and Howells, Gareth and McDonald-Maier, Klaus D (2025) APPARENT: AI-Powered Platform Anomaly Detection in Edge Computing. IEEE Transactions on Sustainable Computing. pp. 1-17. DOI https://doi.org/10.1109/tsusc.2025.3562738
Abstract
Embedded systems serving as IoT nodes are often vulnerable to malicious and unknown runtime software that could compromise the system, steal sensitive data, and cause undesirable system behaviour. Commercially available embedded systems used in automation, medical equipment, and automotive industries, are especially exposed to this vulnerability since they lack the resources to incorporate conventional safety features and are challenging to mitigate through conventional approaches. We propose a novel system design coined as APPARENT which can identify program characteristics by monitoring and counting the maximum possible low-level hardware events from Hardware Performance Counters (HPCs) that occur during the program's execution and analyse the correlation among the counts of various monitored events. To further utilise these captured events as features we propose a self-supervised machine learning algorithm that combines a Graph Attention Network GAT and a Generative Topographic Mapping GTM to detect unusual program behaviour as anomalies to enhance the system security. Our proposed methodology takes advantage of attributes like program counter, cycles per instruction, and physical and virtual timers at various exception levels of the embedded processor to identify abnormal activity. APPARENT identifies unknown program behaviours not present in the training phase with an accuracy of over 98.46% on Autobench EEMBC benchmarks.
Item Type: | Article |
---|---|
Uncontrolled Keywords: | Generative Topographic Mapping (GTM); Graph Attention Network (GAT); Cycles Per Instruction (CPI); Control Flow Graph (CFG); Gated Recurrent Unit (GRU); Machine Learning (ML); Anomaly Detection |
Divisions: | Faculty of Science and Health Faculty of Science and Health > Computer Science and Electronic Engineering, School of |
SWORD Depositor: | Unnamed user with email elements@essex.ac.uk |
Depositing User: | Unnamed user with email elements@essex.ac.uk |
Date Deposited: | 01 May 2025 12:18 |
Last Modified: | 01 May 2025 12:18 |
URI: | http://repository.essex.ac.uk/id/eprint/40768 |
Available files
Filename: Anomaly_detection_in_MORELLO_APPARENT (1).pdf