Hardware-Performance-Counters-based anomaly detection in massively deployed smart industrial devices - LAAS - Laboratoire d'Analyse et d'Architecture des Systèmes Access content directly
Conference Papers Year : 2020

Hardware-Performance-Counters-based anomaly detection in massively deployed smart industrial devices

Abstract

Energy providers are massively deploying devices to manage distributed resources or equipment. These devices are used for example to manage the energy of smart factories efficiently or to monitor the infrastructure of smart-grids. By design, they typically exhibit homogeneous behavior, with similar software and hardware architecture. Unfortunately, these devices are also of interest to attackers aiming to develop botnets or compromise companies' security. This paper presents a new protection approach based on Hardware Performance Counters (HPC) to detect anomalies in massively deployed devices. These HPC are processed using outlier detection algorithms. Compared to existing solutions, we propose a lightweight approach based on a comparative analysis of devices' HPC without relying on the modeling of the software applications running on the devices. To assess the relevance and the effectiveness of the approach, a thorough experimental analysis is carried out in a representative industrial-type environment, sampling the data from 100 Raspberry Pi to simulate about 10,000 devices deployed simultaneously. The results show high detection and performance efficiency under different software profiles and attack payloads. Moreover, the calibration of the approach depends primarily on the hardware rather than the application software running on the devices. It should ease its deployment in an operational environment.
Fichier principal
Vignette du fichier
Anomaly_detection_on_a_large_scale_deployment_of_smart_devices_using_hardware_performance_counters(5).pdf (893.69 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03328251 , version 1 (29-08-2021)

Identifiers

Cite

Malcolm Bourdon, Pierre-François Gimenez, Eric Alata, Mohamed Kaâniche, Vincent Migliore, et al.. Hardware-Performance-Counters-based anomaly detection in massively deployed smart industrial devices. 19th IEEE International Symposium on Network Computing and Applications (NCA 2020), Nov 2020, Cambridge, MA, United States. ⟨10.1109/NCA51143.2020.9306726⟩. ⟨hal-03328251⟩
101 View
50 Download

Altmetric

Share

Gmail Facebook X LinkedIn More