A method for detecting abnormal program behavior on embedded devices
Authors
Zhai, Xiaojun
Ehsan, Shoaib
Howells, Gareth
Dongbing, Gu
McDonald-Maier, Klaus
Appiah, Kofi

Hu, Huosheng

Issue Date
2015-04-13
Metadata
Show full item recordAbstract
A potential threat to embedded systems is the execution of unknown or malicious software capable of triggering harmful system behavior, aimed at theft of sensitive data or causing damage to the system. Commercial off-the-shelf embedded devices, such as embedded medical equipment, are more vulnerable as these type of products cannot be amended conventionally or have limited resources to implement protection mechanisms. In this paper, we present a self-organizing map (SOM)-based approach to enhance embedded system security by detecting abnormal program behavior. The proposed method extracts features derived from processor's program counter and cycles per instruction, and then utilises the features to identify abnormal behavior using the SOM. Results achieved in our experiment show that the proposed method can identify unknown program behaviors not included in the training set with over 98.4% accuracy.Citation
Zhai, X, Appiah, K, Ehsan, S, Howells, G, Hu, H, Gu, D, & McDonald-Maier, K (2015), 'A Method for Detecting Abnormal Program Behavior on Embedded Devices', IEEE Transactions On Information Forensics And Security, 10, 8, pp. 1692-1704Publisher
IEEEJournal
IEEE Transactions on Information Forensics and SecurityDOI
10.1109/TIFS.2015.2422674Type
ArticleLanguage
enSeries/Report no.
INSPEC Accession Number: 15232972Vol. 10
Issue 8
ISSN
1556-6013EISSN
1556-6021ae974a485f413a2113503eed53cd6c53
10.1109/TIFS.2015.2422674