2026-07-20T14:52:17Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:10893 2024-03-12T11:59:10Z ddc:004 open_access

System Calls Instrumentation for Intrusion Detection in Embedded Mixed-Criticality Systems Kadar, Marine Tverdyshev, Sergey Fohler, Gerhard Instrumentation Mixed-criticality Real-Time System Calls Host Intrusion Detection Systems System call relative information such as occurrences, type, parameters, and return values are well established metrics to reveal intrusions in a system software. Many Host Intrusion Detection Systems (HIDS) from research and industry analyze these data for continuous system monitoring at runtime. Despite a significant false alarm rate, this type of defense offers high detection precision for both known and zero-day attacks. Recent research focuses on HIDS deployment for desktop computers. Yet, the integration of such run-time monitoring solution in mixed-criticality embedded systems has not been discussed. Because of the cohabitation of potentially vulnerable non-critical software with critical software, securing mixed-criticality systems is a non trivial but essential issue. Thus, we propose a methodology to evaluate the impact of deploying system call instrumentation in such context. We analyze the impact in a concrete use-case with PikeOS real-time hypervisor. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Marine Kadar and Sergey Tverdyshev and Gerhard Fohler 2019 Is Part Of OASIcs, Volume 73, 4th International Workshop on Security and Dependability of Critical Embedded Real-Time Systems (CERTS 2019) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/OASIcs.CERTS.2019.2 urn:nbn:de:0030-drops-108933 https://drops.dagstuhl.de/entities/document/10.4230/OASIcs.CERTS.2019.2 eng https://creativecommons.org/licenses/by/3.0/legalcode