Intrusion Detection in Multicore Embedded Systems based on Artificial Immune Systems

Autor(es)

Horstmann, Leonardo Passig ; Frohlich, Antonio Augusto ; IEEE

• Tipo de documento: Artigo Científico
• Fonte: 2022 IEEE 27TH INTERNATIONAL CONFERENCE ON EMERGING TECHNOLOGIES AND FACTORY AUTOMATION (ETFA); v. N/A, p. 8-pg., 2022-01-01.

Resumo

In this paper, we address the problem of intrusion detection in multicore embedded systems through a self-nonself discrimination scheme based on Artificial Immune Systems. We collect runtime data to build a model in which the T-cells work as detectors for the system's sane behavior. The T-cells are represented by N-dimensional data points composed of samples of the N variables monitored during model building. A pre-established binding threshold is used for the T-cells generation. The difference between data points is measured as the distance between them. While training, whenever a collected sample fails to bind to an existing T-cell, it becomes a new one. After training, the threshold is adjusted to the maximum distance observed in the model. Therefore, the model definition follows an iterative clustering algorithm where each T-cell is a cluster centroid with threshold as the radius. Nonself detection consists of comparing collected samples to the T-cells in the model through a cluster membership verification. Whenever the incoming sample is not a member of any of the clusters, the sample is classified as nonself. A time complexity analysis indicates the suitability of the proposed technique for runtime operation, and offline experiments show this approach achieved a 97:17% non-self detection rate. (AU)

• Processo FAPESP: 20/05142-1 - Gateway seguro para a internet das coisas industriais
• Beneficiário: Antônio Augusto Medeiros Fröhlich
• Modalidade de apoio: Auxílio à Pesquisa - Parceria para Inovação Tecnológica - PITE
• Processo FAPESP: 21/02385-3 - Uso de Machine Learning e monitoramento de performance para verificação de integridade em Gateways IIoT
• Beneficiário: Leonardo Passig Horstmann
• Modalidade de apoio: Bolsas no Brasil - Programa Capacitação - Treinamento Técnico