Runtime Anomaly Detection in Embedded Systems by Binary Tracing and Hidden Markov Models

Abstract

Embedded computing systems are very vulnerable to anomalies that can occur during execution of deployed software. Anomalies can be due for example to faults, bugs or deadlocks during executions. These anomalies can have very dangerous consequences on the systems controlled by embedded computing devices. Embedded systems are designed to perform autonomously, i.e. without any human intervention, and thus the\ud possibility to debug an application to manage the anomaly is very difficult if not impossible. Anomaly detection algorithms are the primary means of being aware of anomalous conditions. In this paper we describe a novel approach to detect an anomaly during execution of one or more applications. The algorithm exploits the differences between the behavior of memory sequences generated during executions. Memory reference sequences are monitored in real time using the PIN tracing tool. The memory reference sequence is divided into randomly selected blocks and spectrally described with the Discrete Cosine Transform. Experimental analysis is based on the SPEC 2006 CPU benchmark suite, and show very low error rates for the anomalies tested

An Area-Context-Based Credibility Detection for Big Data in IoT

“…However, this method which determines outliers as anomalies can only detect point anomalies. Maxion and Tan [23] and Cuzzocrea et al [24] use the Markov detector to detect the security state of the embedded system. is method constructs a Markov matrix based on transition probability of the state sequence.…”