Runtime Anomaly Detection in Embedded Systems by Binary Tracing and Hidden Markov Models

Embedded computing systems are very vulnerable to anomalies that can occur during execution of deployed software. Anomalies can be due for example to faults, bugs or deadlocks during executions. These anomalies can have very dangerous consequences on the systems controlled by embedded computing devices. Embedded systems are designed to perform autonomously, i.e. without any human intervention, and thus the possibility to debug an application to manage the anomaly is very difficult if not impossible. Anomaly detection algorithms are the primary means of being aware of anomalous conditions. In this paper we describe a novel approach to detect an anomaly during execution of one or more applications. The algorithm exploits the differences between the behavior of memory sequences generated during executions. Memory reference sequences are monitored in real time using the PIN tracing tool. The memory reference sequence is divided into randomly selected blocks and spectrally described with the Discrete Cosine Transform. Experimental analysis is based on the SPEC 2006 CPU benchmark suite, and show very low error rates for the anomalies tested.