Anomaly Detection in Real-Time Multi-Threaded Processes Using Hardware Performance Counters
Anomaly Detection in Real-Time Multi-Threaded Processes Using Hardware Performance Counters
复制标题
使用硬件性能计数器进行实时多线程进程中的异常检测
DOI：
--
复制
发表时间：
2020
影响因子：
6.8
通讯作者：
F. Khorrami
中科院分区：
文献类型：
--
作者：
P. Krishnamurthy;R. Karri;F. Khorrami
我们提出了一种新的方法，用于对网络物理系统（CPS）中嵌入式处理器运行的软件进行实时监视。该方法使用硬件性能计数器（HPC）的实时监视，并适用于可编程逻辑控制器（PLC）实现实时控制器的多线程和中断驱动的过程。该方法使用黑框方法使用HPC介绍目标过程。在已知的良好工作条件下，在时间窗口上的HPC测量的时间序列用于训练机器学习分类器。在运行时，该训练有素的分类器将HPC测量的时间序列分类为基线（即，概率与从训练数据中学到的模型相对应）或异常。连续的时间Windows上的基线与异常标签具有鲁棒性，可抵抗嵌入式处理器上代码执行的随机变异性，并检测代码修改。我们证明了该方法对嵌入式PLC的有效性，以模拟基准工业流程（HITL）测试床。此外，为了说明方法的可扩展性，我们还将方法应用于运行代表性嵌入式控制过程的第二PLC平台。
We propose a novel methodology for real-time monitoring of software running on embedded processors in cyber-physical systems (CPS). The approach uses real-time monitoring of hardware performance counters (HPC) and applies to multi-threaded and interrupt-driven processes typical in programmable logic controller (PLC) implementation of real-time controllers. The methodology uses a black-box approach to profile the target process using HPCs. The time series of HPC measurements over a time window under known-good operating conditions is used to train a machine learning classifier. At run-time, this trained classifier classifies the time series of HPC measurements as baseline (i.e., probabilistically corresponding to a model learned from the training data) or anomalous. The baseline versus anomalous labels over successive time windows offer robustness against the stochastic variability of code execution on the embedded processor and detect code modifications. We demonstrate effectiveness of the approach on an embedded PLC in a hardware-in-the-loop (HITL) testbed emulating a benchmark industrial process. In addition, to illustrate the scalability of the approach, we also apply the methodology to a second PLC platform running a representative embedded control process.