Hierarchical Framework for Runtime Intrusion Detection in Embedded Systems

Existing intrusion detection systems typically rely on one or a few features to detect anomalies or intrusion in a system. Their ability to successfully detect intrusion largely hinges on these limited features, which often do not provide for a comprehensive and runtime detection, especially necessitated in multitude of embedded devices used in critical systems. To overcome this limitation of existing intrusion detection systems, this paper proposes a lightweight runtime hierarchical multimodal intrusion detection framework that can be realized on resource-constrained embedded systems. This work relies on various features such as power trace, System Call (SYSCALL) trace and Hardware Performance Counter (HPC) by leveraging the strengths of the individual features and combining them intelligently to overcome their individual limitations. Using a number of case studies, the proposed framework has been shown to reliably detect intrusion of different types at runtime, while still being sufficiently lightweight to be deployed in resource- constrained embedded systems.