Abstract:Embedded system technologies are increasingly being incorporated into manufacturing, smart grid, industrial control systems, and transportation systems. However, the vast majority of today's embedded platforms lack the support of built-in security features which makes such systems highly vulnerable to a wide range of cyber-attacks. Specifically, they are vulnerable to malware injection code that targets the power distribution system of an ARM Cortex-M-based microcontroller chipset (ARM, Cambridge, UK). Through hardware exploitation of the clock-gating distribution system, an attacker is capable of disabling/activating various subsystems on the chip, compromising the reliability of the system during normal operation. This paper proposes the development of an Intrusion Detection System (IDS) capable of detecting clock-gating malware deployed on ARM Cortex-M-based embedded systems. To enhance the robustness and effectiveness of our approach, we fully implemented, tested, and compared six IDSs, each employing different methodologies. These include IDSs based on K-Nearest Classifier, Random Forest, Logistic Regression, Decision Tree, Naive Bayes, and Stochastic Gradient Descent. Each of these IDSs was designed to identify and categorize various variants of clock-gating malware deployed on the system. We have analyzed the performance of these IDSs in terms of detection accuracy against various types of clock-gating malware injection code. Power consumption data collected from the chipset during normal operation and malware code injection attacks were used for models' training and validation. Our simulation results showed that the proposed IDSs, particularly those based on K-Nearest Classifier and Logistic Regression, were capable of achieving high detection rates, with some reaching a detection rate of 0.99. These results underscore the effectiveness of our IDSs in protecting ARM Cortex-M-based embedded systems against clock-gating malware.

SPMOS-Based Intrusion Detection Architecture

On a Distributed Intrusion Detection Model Based on the Super-Peer Framework

Embedded network processor based parallel intrusion detection

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

A Virus Detection Framework based on SPMOS

Intrusion Detection And Simulation For High-Speed Networks

Research on Data Mining-based Intrusion Detection in Real-time Environment

Multi-agent based hybrid Intrusion detection system

VNIDA: Building an IDS Architecture Using VMM-Based Non-Intrusive Approach

Towards High-Performance Network Intrusion Prevention System on Multi-core Network Services Processor

Research on Object-Storage-based Intrusion Detection

An overview to Software Architecture in Intrusion Detection System

A Common On-board Hardware Architecture for Intrusion Detection System

Two-Tier Intrusion Detection Framework for Embedded Systems

Design of Concurrent Immune IDS System with Three Protection-Layers Based on IXP2350

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Hardware-Assisted Monitoring For Instruction Security In Embedded System

An Architecture for Distributed Intrusion Detection System

Hardware-Assisted Security Monitoring Unit for Real-Time Ensuring Secure Instruction Execution and Data Processing in Embedded Systems

Detection of Malicious Threats Exploiting Clock-Gating Hardware Using Machine Learning

A Supervised Intrusion Detection System for Smart Home IoT Devices