Advanced System Resiliency Based on Virtualization Techniques for IoT Devices

Röckl, Jonas; Protsenko, Mykolai; Huber, Monika; Müller, Tilo; Freiling, Felix C.

doi:10.1145/3485832.3485836

“…Hardware Watchdog: Hardware watchdogs are widespread on IoT devices and are an established mechanism to react to a critical event [63][64][65][66]. We ensure that the TM TA is scheduled regularly by employing a hardware watchdog in the secure world.…”

Section: Trusted Monitormentioning

confidence: 99%

Profiling with Trust: System Monitoring from Trusted Execution Environments

Eichler

¹

,

Röckl

²

,

Jung

³

et al. 2023

Preprint

0

View full text Add to dashboard Cite

Large-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.

show abstract

Profiling with trust: system monitoring from trusted execution environments

Eichler,

Röckl,

Jung

et al. 2024

Des Autom Embed Syst

3

0

View full text Add to dashboard Cite

Large-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.

show abstract

Operating Systems and Hypervisors for Network Functions: A Survey of Enabling Technologies and Research Studies

Thyagaturu

¹

,

Shantharama

²

,

Nasrallah

³

et al. 2022

View full text Add to dashboard Cite

Scalable and flexible communication networks increasingly conduct the packet processing for Network Functions (NFs) in General Purpose Computing (GPC) platforms. The input/output (I/O)-intensive and latency-sensitive packet processing is challenging for the operating systems and hypervisors running on GPC platforms. This article surveys the existing enabling technologies and research studies on operating system and hypervisor aspects that directly influence the packet processing for NFs on GPC platforms. We organize this survey according to the main categories abstraction approach, memory access, and I/O strategy. We further categorize abstraction approach technologies and research studies into the categories operation systems, hypervisors, and containers. We partition the memory access category into the two subcategories of memory allocation and memory access, while we partition the I/O strategy category into the sub-categories I/O device virtualization and I/O device access. Our survey gives a comprehensive summary of the capabilities and limitations of the existing enabling technologies and researched approaches for abstraction, memory access, and I/O for NF packet processing. We outline critical future research directions for advancing NF packet processing on GPC platforms.

show abstract

Advanced System Resiliency Based on Virtualization Techniques for IoT Devices

Cited by 7 publications

References 47 publications

Profiling with Trust: System Monitoring from Trusted Execution Environments

Profiling with Trust: System Monitoring from Trusted Execution Environments

Profiling with trust: system monitoring from trusted execution environments

Operating Systems and Hypervisors for Network Functions: A Survey of Enabling Technologies and Research Studies

Contact Info

Product

Resources

About