Lightweight Intrusion Detection for Resource-Constrained Embedded Control Systems

Abstract

Today's power grid depends on embedded control systems to function properly. Securing these systems presents a unique challenge, since on top of the resource restrictions inherent to embedded devices, SCADA systems must accommodate strict timing requirements that are nonnegotiable, and their massive scale greatly amplifies costs such as power consumption. Together, these constraints make the conventional approach to host intrusion detection-namely, using a hypervisor to create a safe environment from which a monitoring entity can operate-too costly or impractical for embedded control systems in such critical infrastructure.In this paper, we introduce Autoscopy, an experimental host intrusion detection mechanism that operates from within the kernel and leverages its built-in tracing framework to look for control-flow anomalies, which are most often caused by rootkits hijacking kernel hooks. In initial testing on a standard laptop system, our prototype was able to detect a representative selection of control-flow hijacking rootkit techniques while imposing less than 5% performance overhead for the majority of our benchmark tests. We argue that its design and effectiveness make it both feasible for and uniquely suited to intrusion detection for SCADA systems, and are currently porting Autoscopy to actual power hardware to test our hypothesis. Being situated in the kernel, Autoscopy needs some hardware (e.g., memory immutability) or software protection (i.e., kernel hardening) measures in place for its own protection; however, such protective measures would cost less than full-blown reference monitor isolation via hardware virtualization at the core of hypervisor-based proposals.

Architecture and security of SCADA systems: A review

“…These type of attacks are used with the composition of other attacks. Moreover, some IDSs approaches have been proposed to specifically for resource constraint devices [98,99,100]. Signature detection, anomaly detection, Machine learning based approaches are knowledge-based techniques.…”

Intrusion detection for resource-constrained embedded control systems in the power grid

“…For example, ACAP [41] uses Kprobes to capture network packets by probing important functions in the INET socket layer while Atom LEAP [42] leverages Kprobes to place "energy calipers" at arbitrary kernel code locations for measuring and characterizing the energy usage of a system. However, to the best of our knowledge, the Autoscopy effort [15,16,43] is the first to leverage Kprobes as a tool for system protection.…”

Chaotic Memory Randomization for Securing Embedded Systems

“…Several attempts [19,3,22,6] have been made at creating efficient monitoring devices for determining if malware has been loaded onto an embedded system. Most, with the exception of Cui et al, of these systems involve either modeling performance metrics of the embedded system and comparing them against previous run times or theoretical run time bounds.…”