On-board Diagnosis: A First Step from Detection to Prevention of Intrusions on Avionics Applications

Abstract

Nowadays, air travel is one of the safest transportation means. While safety is historically well integrated into avionics systems, it is becoming increasingly important to take into account the security of such systems for the future. In particular, Host-based Intrusion Detection Systems (HIDS) are commonly used in traditional information systems to improve their security. The adaptation of such systems for deployment inside an aircraft has been studied in another work and has shown to be effective in detecting anomalous behavior in an avionic application. However, the detection itself is not sufficient to provide an on-board reaction, and to prevent such intrusion. This paper proposes to improve such HIDS by introducing a signature-based system capable of providing a first diagnosis after the detection of an anomalous behavior. The proposed diagnosis approach is based on the definition of the signature of an alert, and its comparison with a knowledge database that is regularly updated throughout aircraft lifetime. This approach has been implemented on a real avionic computer and yielded good results in terms of classification accuracy and resources consumption.

System Dependability Assessment—Interplay Between Research and Practice

“…Besides detecting anomalous behaviors of the target application, a signature-based system providing a first diagnosis after the detection of an anomalous behavior was also implemented. This approach has been validated on a real avionic computer and yielded good results in terms of classification accuracy and resource consumption [Damien et al 2020]. To support the validation of the HIDS, we developed a tool enabling the automatic injection of attacks and the generation of application code mutations that mimic the behavior of malevolent pieces of code introduced inside the target application [Damien et al 2019-a].…”