Implementation of a Host-Based Intrusion Detection System for Avionic Applications

Abstract

Today, aircraft are protected by strong safety properties, qualified operators and process-based security measures. However, considering the recent evolution of in-flight services towards more connectivity, resource sharing and advanced entertainment functionalities, together with the increase of threats targeting embedded systems, the potential malicious modification of an aircraft application must be seriously considered for future systems. In this context, several solutions can be developed to improve aircraft security. In particular, Host-based Intrusion Detection Systems (HIDS) are relevant to deal with targeted threats such as an insider attack. This paper presents the specific constraints of building an HIDS onboard an aircraft, and discusses some relevant solutions that satisfy these constraints. These solutions are evaluated in terms of detection efficiency and resource consumption in order to select the solution that allows the best trade-off between efficiency and performances. The implementation of this solution on an embedded avionic computer is also described.

On-board Diagnosis: A First Step from Detection to Prevention of Intrusions on Avionics Applications

“…An overhead of 6 clock ticks (+3.3%) is observed for the communication-related API calls (mainly impacted by the SDA Monitor), on the median value. It is very similar to the overhead measured in [1] (anomaly detection only, 5 clock ticks), even if more information is logged at each application API call. As expected, there is no impact on the other API calls.…”

“…This represents 0.88% of the duration allocated to the monitored partition (App HMI, 6.7 ms). Compared to the results described in [1] (0.014 ms for the HIDS partition with Anomaly Detection only), the introduction of the on-board diagnosis represents a high increase in terms of execution time, but is still very efficient in terms of the time allocated to App HMI. These results are summarized in Table IV.…”

“…The work described in [1] mainly focused on the definition of the SDA used for the anomaly-based detection system based on system calls analysis. This anomaly-based system was specifically designed to generate very few false alarms.…”

“…In [1], the authors described the design and the implementation of a HIDS adapted to such embedded real-time and critical context, taking into account the following objectives: O1 Preserving the real-time execution of the other functions, O2 Proposing limited evolution for legacy aircraft, O3 Performing real-time detection, O4 Having a small memory footprint, O5 Providing reliable and explainable results and O6 Being efficient even on "black-box" applications.…”

“…The first contribution of this paper is the description of the overall diagnosis process designed for the HIDS of [1]. The second contribution is the description of an implementation of this process, and in particular the representation of an alert within the knowledge database, its construction on-ground and its exploitation on-board.…”