• Detecting compromised programs for embedded system applications

      Zhai, Xiaojun; Appiah, Kofi; Ehsan, Shoaib; Cheung, Wah M; Howells, Gareth; Hu, Huosheng; Gu, Dongbing; McDonald-Maier, Klaus; University of Derby; University of Essex (Springer, 2014-02-25)
      This paper proposes an approach for detecting compromised programs by analysing suitable features from an embedded system. Features used in this paper are the performance variance and actual program counter values of the embedded processor extracted during program execution. "Cycles per- Instruction" is used as pre-processing block before the features are classified using a Self-Organising Map. Experimental results demonstrate the validity of the proposed approach on detecting some common changes such as deletion, insertion and substitution of programs. Overall, correct detection rate for our system is above 90.9% for tested programs.