Probabilistic Estimation of Threat Intrusion in Embedded Systems for Runtime Detection

Nadir A. Carreon, Sixing Lu, Roman Lysecky

Research output: Contribution to journalArticlepeer-review

5 Scopus citations


With billions of networked connected embedded systems, the security historically provided by the isolation of embedded systems is no longer sufficient. Millions of new malware are created every month and zero-day attacks are becoming an increasing concern. Therefore, proactive security measures are no longer enough to provide protection to embedded systems. Instead, reactive approaches that detect attacks that can circumvent the proactive defenses and react upon them are needed. Anomaly-based detection is a common reactive approach employed to detect malware by monitoring anomalous deviations in the system execution. Timing-based anomaly detection detects malware by monitoring the system's internal timing, which offers unique protection against mimicry malware compared to sequence-based anomaly detection. However, previous timing-based anomaly detection methods focus on each operation independently at the granularity of tasks, function calls, system calls, or basic blocks. These approaches neither consider the entire software execution path nor provide a quantitative estimate of the presence of malware. This article presents a novel model for specifying the normal timing for execution paths in software applications using cumulative distribution functions of timing data in sliding execution windows. A probabilistic formulation is used to estimate the presence of malware for individual operations and sequences of operations within the paths. Operation and path-based thresholds are determined during the training process to minimize false positives. Finally, the article presents an optimization method to assist system developers in selecting which operations to monitor based on different optimization goals and constraints. Experimental results with a smart connected pacemaker, an unmanned aerial vehicle, and seven sophisticated mimicry malware implemented at different levels demonstrate the effectiveness of the proposed approach.

Original languageEnglish (US)
Article number3432590
JournalACM Transactions on Embedded Computing Systems
Issue number2
StatePublished - Mar 2021


  • Embedded system security
  • anomaly detection
  • medical device security
  • software security
  • timing-based detection

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture


Dive into the research topics of 'Probabilistic Estimation of Threat Intrusion in Embedded Systems for Runtime Detection'. Together they form a unique fingerprint.

Cite this