Abstract:
Securing life-critical embedded systems, particularly medical devices, requires both proactive security measures that prevent intrusions and reactive measures that detect...Show MoreMetadata
Abstract:
Securing life-critical embedded systems, particularly medical devices, requires both proactive security measures that prevent intrusions and reactive measures that detect intrusions. This paper presents a novel model for specifying the normal timing for operations in software applications using cumulative distribution functions of timing subcomponent within sliding execution windows. We present a probabilistic formulation for estimating the presence of malware for individual operations by monitoring the internal timing of the different components of the system, and we define thresholds to minimize false positives based on training data. Experimental results with a smart connected pacemaker and three sophisticated mimicry malware scenarios demonstrate improved performance and accuracy compared to state-of-the-art timing-based malware detection.
Published in: 2019 Spring Simulation Conference (SpringSim)
Date of Conference: 29 April 2019 - 02 May 2019
Date Added to IEEE Xplore: 10 June 2019
ISBN Information: