Embedded computing systems are very vulnerable to anomalies that can occur during execution of deployed software. Anomalies can be due for example to faults, bugs or deadlocks during executions. These anomalies can have very dangerous consequences on the systems controlled by embedded computing devices. Embedded systems are designed to perform autonomously, i.e. without any human intervention, and thus the possibility to debug an application to manage the anomaly is very difficult if not impossible. Anomaly detection algorithms are the primary means of being aware of anomalous conditions. In this paper we describe a novel approach to detect an anomaly during execution of one or more applications. The algorithm exploits the differences between the behavior of memory sequences generated during executions. Memory reference sequences are monitored in real time using the PIN tracing tool. The memory reference sequence is divided into randomly selected blocks and spectrally described with the Discrete Cosine Transform. Experimental analysis is based on the SPEC 2006 CPU benchmark suite, and show very low error rates for the anomalies tested.

Runtime Anomaly Detection in Embedded Systems by Binary Tracing and Hidden Markov Models

Cuzzocrea Alfredo;
2015

Abstract

Embedded computing systems are very vulnerable to anomalies that can occur during execution of deployed software. Anomalies can be due for example to faults, bugs or deadlocks during executions. These anomalies can have very dangerous consequences on the systems controlled by embedded computing devices. Embedded systems are designed to perform autonomously, i.e. without any human intervention, and thus the possibility to debug an application to manage the anomaly is very difficult if not impossible. Anomaly detection algorithms are the primary means of being aware of anomalous conditions. In this paper we describe a novel approach to detect an anomaly during execution of one or more applications. The algorithm exploits the differences between the behavior of memory sequences generated during executions. Memory reference sequences are monitored in real time using the PIN tracing tool. The memory reference sequence is divided into randomly selected blocks and spectrally described with the Discrete Cosine Transform. Experimental analysis is based on the SPEC 2006 CPU benchmark suite, and show very low error rates for the anomalies tested.
Anomaly detection
HMM
run-time analysis
spectral analysis
memory address
File in questo prodotto:
Non ci sono file associati a questo prodotto.

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: http://hdl.handle.net/20.500.11770/312500
 Attenzione

Attenzione! I dati visualizzati non sono stati sottoposti a validazione da parte dell'ateneo

Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 5
  • ???jsp.display-item.citation.isi??? 5
social impact