<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-03328254</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-23T23:47:08+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Anomaly detection using hardware performance counters on a large scale deployment</title>
            <author role="aut">
              <persName>
                <forename type="first">Malcolm</forename>
                <surname>Bourdon</surname>
              </persName>
              <idno type="halauthorid">2272108-0</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Eric</forename>
                <surname>Alata</surname>
              </persName>
              <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">eric-alata</idno>
              <idno type="idhal" notation="numeric">171876</idno>
              <idno type="halauthorid" notation="string">32730-171876</idno>
              <idno type="IDREF">https://www.idref.fr/124302505</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-5179-3253</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mohamed</forename>
                <surname>Kaâniche</surname>
              </persName>
              <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">mohamed-kaaniche</idno>
              <idno type="idhal" notation="numeric">13942</idno>
              <idno type="halauthorid" notation="string">23325-13942</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-2647-5472</idno>
              <idno type="IDREF">https://www.idref.fr/079087221</idno>
              <orgName ref="#struct-389097"/>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Vincent</forename>
                <surname>Migliore</surname>
              </persName>
              <email type="md5">e5c251eabcbf0da05c85b60dc2b7aad8</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">vincent-migliore</idno>
              <idno type="idhal" notation="numeric">175135</idno>
              <idno type="halauthorid" notation="string">32989-175135</idno>
              <idno type="IDREF">https://www.idref.fr/226904504</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-6834-4235</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Vincent</forename>
                <surname>Nicomette</surname>
              </persName>
              <email type="md5">856b9f10bee31e8f2d94eaf7778fdea7</email>
              <email type="domain">laas.fr</email>
              <idno type="idhal" notation="string">vincent-nicomette</idno>
              <idno type="idhal" notation="numeric">9967</idno>
              <idno type="halauthorid" notation="string">8756-9967</idno>
              <idno type="IDREF">https://www.idref.fr/078717639</idno>
              <idno type="ORCID">https://orcid.org/0000-0001-9482-004X</idno>
              <orgName ref="#struct-389097"/>
              <affiliation ref="#struct-389097"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Youssef</forename>
                <surname>Laarouchi</surname>
              </persName>
              <idno type="halauthorid">678291-0</idno>
              <affiliation ref="#struct-389097"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Mohamed</forename>
                <surname>Kaaniche</surname>
              </persName>
              <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
              <email type="domain">laas.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2021-08-29 13:21:06</date>
              <date type="whenModified">2025-10-22 18:04:08</date>
              <date type="whenReleased">2021-08-31 10:05:30</date>
              <date type="whenProduced">2020-01-29</date>
              <date type="whenEndEmbargoed">2021-08-29</date>
              <ref type="file" target="https://laas.hal.science/hal-03328254v1/document">
                <date notBefore="2021-08-29"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://laas.hal.science/hal-03328254v1/file/ERTS2020_paper_92.pdf" id="file-3328254-2919198">
                <date notBefore="2021-08-29"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="117708">
                <persName>
                  <forename>Mohamed</forename>
                  <surname>Kaaniche</surname>
                </persName>
                <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
                <email type="domain">laas.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-03328254</idno>
            <idno type="halUri">https://laas.hal.science/hal-03328254</idno>
            <idno type="halBibtex">bourdon:hal-03328254</idno>
            <idno type="halRefHtml">&lt;i&gt;10th European Congress Embedded Real Time Systems (ERTS 2020)&lt;/i&gt;, Jan 2020, Toulouse, France</idno>
            <idno type="halRef">10th European Congress Embedded Real Time Systems (ERTS 2020), Jan 2020, Toulouse, France</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-3328254-2919198"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-TLSE2">Université Toulouse 2</idno>
            <idno type="stamp" n="UNIV-TLSE3">Université de Toulouse</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INSA-TOULOUSE">Institut National des Sciences Appliquées de Toulouse</idno>
            <idno type="stamp" n="LAAS">Laboratoire d'analyse et d'architecture des systèmes</idno>
            <idno type="stamp" n="LAAS-TSF" corresp="LAAS-RISC">Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique</idno>
            <idno type="stamp" n="UT1-CAPITOLE">Université Toulouse 1 Capitole</idno>
            <idno type="stamp" n="LAAS-INFORMATIQUE-CRITIQUE" corresp="LAAS">LAAS-Informatique Critique</idno>
            <idno type="stamp" n="INSA-GROUPE">Groupe INSA</idno>
            <idno type="stamp" n="ERTS2020">Proceeding of the 10th European Congress on Embedded Real Time Systems</idno>
            <idno type="stamp" n="INSA-TOULOUSE-GEI" corresp="INSA-TOULOUSE">Génie Electrique et Informatique - INSA Toulouse</idno>
            <idno type="stamp" n="LAAS-RISC" corresp="LAAS">Réseaux, Informatique, Systèmes de Confiance</idno>
            <idno type="stamp" n="TOULOUSE-INP">Toulouse - INP</idno>
            <idno type="stamp" n="UNIV-UT3">Université Toulouse 3</idno>
            <idno type="stamp" n="UT3-INP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="UT3-TOULOUSEINP">Université de Toulouse / Toulouse INP</idno>
            <idno type="stamp" n="TEST7-HALCNRS">test 7 du portail hal cnrs</idno>
            <idno type="stamp" n="LAAS-TRUST" corresp="LAAS-RISC">Trustworthy systems: foundations and practices</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Anomaly detection using hardware performance counters on a large scale deployment</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Malcolm</forename>
                    <surname>Bourdon</surname>
                  </persName>
                  <idno type="halauthorid">2272108-0</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Eric</forename>
                    <surname>Alata</surname>
                  </persName>
                  <email type="md5">ff6809813cc09234bdc6fc38873ce9b8</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">eric-alata</idno>
                  <idno type="idhal" notation="numeric">171876</idno>
                  <idno type="halauthorid" notation="string">32730-171876</idno>
                  <idno type="IDREF">https://www.idref.fr/124302505</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-5179-3253</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mohamed</forename>
                    <surname>Kaâniche</surname>
                  </persName>
                  <email type="md5">1ee68888caed857a3dcbc2e53f464bff</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">mohamed-kaaniche</idno>
                  <idno type="idhal" notation="numeric">13942</idno>
                  <idno type="halauthorid" notation="string">23325-13942</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-2647-5472</idno>
                  <idno type="IDREF">https://www.idref.fr/079087221</idno>
                  <orgName ref="#struct-389097"/>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Vincent</forename>
                    <surname>Migliore</surname>
                  </persName>
                  <email type="md5">e5c251eabcbf0da05c85b60dc2b7aad8</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">vincent-migliore</idno>
                  <idno type="idhal" notation="numeric">175135</idno>
                  <idno type="halauthorid" notation="string">32989-175135</idno>
                  <idno type="IDREF">https://www.idref.fr/226904504</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-6834-4235</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Vincent</forename>
                    <surname>Nicomette</surname>
                  </persName>
                  <email type="md5">856b9f10bee31e8f2d94eaf7778fdea7</email>
                  <email type="domain">laas.fr</email>
                  <idno type="idhal" notation="string">vincent-nicomette</idno>
                  <idno type="idhal" notation="numeric">9967</idno>
                  <idno type="halauthorid" notation="string">8756-9967</idno>
                  <idno type="IDREF">https://www.idref.fr/078717639</idno>
                  <idno type="ORCID">https://orcid.org/0000-0001-9482-004X</idno>
                  <orgName ref="#struct-389097"/>
                  <affiliation ref="#struct-389097"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Youssef</forename>
                    <surname>Laarouchi</surname>
                  </persName>
                  <idno type="halauthorid">678291-0</idno>
                  <affiliation ref="#struct-389097"/>
                </author>
              </analytic>
              <monogr>
                <idno type="localRef">Rapport LAAS n° 20485</idno>
                <meeting>
                  <title>10th European Congress Embedded Real Time Systems (ERTS 2020)</title>
                  <date type="start">2020-01-29</date>
                  <date type="end">2020-01-31</date>
                  <settlement>Toulouse</settlement>
                  <country key="FR">France</country>
                </meeting>
                <imprint>
                  <date type="datePub">2020-01</date>
                </imprint>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Internet of Things (IoT)</term>
                <term xml:lang="en">Hardware performance counters</term>
                <term xml:lang="en">Anomaly detection</term>
                <term xml:lang="en">Cyber security</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-pf">Computer Science [cs]/Performance [cs.PF]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>The last recent years witnessed a massive and fast deployment of Internet of Things (IoT) devices. Most of them have not been designed with a careful analysis of security requirements, which makes them likely to include multiple vulnerabilities. Moreover, as these devices include various communication interfaces, they have become a privileged target for attackers. As a consequence, large scale attacks, such as Mirai, must be considered seriously and it is crucial to design and implement protection and intrusion detection mechanisms to mitigate the threats associated to the use of IoT devices in our daily activities as well in critical environments. This paper proposes an anomaly detection approach, in the particular context of a large scale deployment of identical IoT devices. Furthermore, we consider an attacker who can install and execute malicious software while continuing to execute legitimate software, in order to stay invisible as much as possible. The approach is based on the statistical analysis of Hardware Performance Counters (HPC) collected at a regular basis from these identical devices, and to highlight the outliers corresponding to significant deviations with respect to normal usage scenarios. This idea relies on the intuition that it is very difficult for the attacker to add some malicious software in a corrupted device without perturbing the HPCs. This paper presents this approach and the first experiments carried out to assess its relevance.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-389097" status="OLD">
          <orgName>Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique</orgName>
          <orgName type="acronym">LAAS-TSF</orgName>
          <date type="end">2024-08-31</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.laas.fr/public/fr/tsf</ref>
          </desc>
          <listRelation>
            <relation active="#struct-459" type="direct"/>
            <relation active="#struct-81148" type="indirect"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116255" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="indirect"/>
            <relation active="#struct-217752" type="indirect"/>
            <relation name="UPR8001" active="#struct-441569" type="indirect"/>
            <relation active="#struct-448187" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-459" status="OLD">
          <idno type="IdRef">199278792</idno>
          <idno type="ISNI">0000 0001 2188 216X </idno>
          <idno type="RNSR">199517454Y</idno>
          <idno type="ROR">https://ror.org/03vcm6439</idno>
          <orgName>Laboratoire d'analyse et d'architecture des systèmes</orgName>
          <orgName type="acronym">LAAS</orgName>
          <date type="start">1968-01-01</date>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>7 Av du colonel Roche 31077 TOULOUSE CEDEX 4</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.laas.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-81148" type="direct"/>
            <relation name="443875" active="#struct-443875" type="indirect"/>
            <relation active="#struct-116255" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-443875" type="indirect"/>
            <relation active="#struct-116256" type="direct"/>
            <relation active="#struct-217752" type="direct"/>
            <relation name="UPR8001" active="#struct-441569" type="direct"/>
            <relation active="#struct-448187" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-81148" status="VALID">
          <idno type="IdRef">026404354</idno>
          <idno type="ISNI">0000000121902837</idno>
          <idno type="ROR">https://ror.org/0443n9e75</idno>
          <orgName>Université Toulouse Capitole</orgName>
          <orgName type="acronym">UT Capitole</orgName>
          <date type="start">1970-01-01</date>
          <desc>
            <address>
              <addrLine>2 rue du Doyen-Gabriel-Marty - 31042 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ut-capitole.fr/</ref>
          </desc>
          <listRelation>
            <relation name="443875" active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-443875" status="VALID">
          <idno type="ROR">https://ror.org/017tgbk05</idno>
          <orgName>Communauté d'universités et établissements de Toulouse</orgName>
          <orgName type="acronym">Comue de Toulouse</orgName>
          <desc>
            <address>
              <addrLine>41 Allée Jules Guesde, 31000 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-toulouse.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-116255" status="VALID">
          <idno type="IdRef">026388766</idno>
          <idno type="ISNI">0000 0001 2286 8343</idno>
          <idno type="ROR">https://ror.org/01h8pf755</idno>
          <idno type="Wikidata">Q858979</idno>
          <orgName>Institut National des Sciences Appliquées - Toulouse</orgName>
          <orgName type="acronym">INSA Toulouse</orgName>
          <date type="start">1963-10-21</date>
          <desc>
            <address>
              <addrLine>135, avenue de Rangueil - 31077 Toulouse cedex 4</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-toulouse.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-116256" status="VALID">
          <idno type="IdRef">026403994</idno>
          <idno type="ROR">https://ror.org/04ezk3x31</idno>
          <orgName>Université Toulouse - Jean Jaurès</orgName>
          <orgName type="acronym">UT2J</orgName>
          <date type="start">1971-01-01</date>
          <desc>
            <address>
              <addrLine>5 allées Antonio Machado - 31058 Toulouse Cedex 9</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse2.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-217752" status="OLD">
          <idno type="IdRef">026404672</idno>
          <idno type="ISNI">0000000121617331</idno>
          <idno type="ROR">https://ror.org/02v6kpv12</idno>
          <idno type="Wikidata">Q1273188</idno>
          <orgName>Université Toulouse III - Paul Sabatier</orgName>
          <orgName type="acronym">UT3</orgName>
          <date type="end">2025-01-01</date>
          <desc>
            <address>
              <addrLine>118 route de Narbonne - 31062 Toulouse</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-tlse3.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-448187" status="VALID">
          <idno type="IdRef">026388820</idno>
          <idno type="ISNI">0000000121766169</idno>
          <idno type="ROR">https://ror.org/033p9g875</idno>
          <orgName>Institut National Polytechnique (Toulouse)</orgName>
          <orgName type="acronym">Toulouse INP</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.inp-toulouse.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-443875" type="direct"/>
          </listRelation>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>