Abstract:Detecting and diagnosing anomalies in networked embedded systems like sensor networks is a very difficult task, due to the variable workloads and severe resource constraints. We notice that most node-level debugging tools can provide detailed program information inside the node but fail to detect when and where a problem occurs in the network. On the other hand, most network-level diagnosis tools can effectively detect a problem from the network but fail to narrow down the problem within the node because they lack detailed program information. To close the gap, we propose D2, a new anomaly detection and diagnosis method by combining program profiling and symptom mining. D2 employs binary instrumentation to perform lightweight function count profiling. Based on the statistics, D2 uses PCA (Principal Component Analysis) based approach for automatically detecting network anomalies. Compared to previous methods, D2 is able to point programmers closer to the most likely causes by a novel approach combining statistical tests and program call graph analysis. We implement our method based on TinyOS 2.1.1 and evaluate its effectiveness by case studies in the development of a working sensor network. Results show that our method is effective for detecting and diagnosing problems in real-world sensor network systems, and at the same time, incurs an acceptable overhead.

Design and Implementation of Program Behavior Anomaly Detection System Based on System Service Hook

Packet Payload Based Anomalous Network Intrusion Detection

Malicious behavior monitoring technology based on Windows Service

An Intrusion Detection System Based On System Call

Anomaly Intrusion Detection Based on System Call

Design and Implementation of Network Worm Detection System for Internal Network

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

A Registry Table Anomaly Behaviors Detecting Technology for Recognizing Malicious Scripts

An Anomaly Detection Model Based on Dynamic Behavior and Character Patterns

Design and Implementation of Intrusion Detection System Based on System-Call

Design and Implementation of Program Behavior Analysis System at Ring 0 Level

Study on Abnormal Detection Based on System Call and Data Mining Technique

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

An Implementation of Windows System Call Interception Used For Access Control

Design and Implementation of Adaptive Intrusion Detection System Based on Web Access Behavior Relevancy

Approach to Anomaly Detection in Microservice System with Multi-Source Data Streams

Post-Deployment Anomaly Detection and Diagnosis in Networked Embedded Systems by Program Profiling and Symptom Mining

A Method for Host Abnormal Detection Based on Resource Availability

Deep Attentive Anomaly Detection for Microservice Systems with Multimodal Time-Series Data

DESIGNING AND IMPLEMENTING DISTRIBUTED TROJAN DETECTION SYSTEM

A Methodology for Hook-Based Kernel Level Rootkits.