Online self-healing support for embedded systems

Lei Sun, Dennis K. Nilsson, Tomohiro Katori, Tatsuo Nakajima

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    1 Citation (Scopus)

    Abstract

    In this paper, online system-level self-healing support is presented for embedded systems. Different from off-line log analysis methods used by conventional intrusion detection systems, our research focuses on analyzing runtime kernel data structures hence perform self-diagnosis and self-healing. Inside the infrastructure, self-diagnosis and self-healing solutions have been implemented based on several selected critical kernel data structures. They can fully represent current system status and are also closely related with system resources. At runtime once any system inconsistency has been detected, predefined recovery functions are invoked. Our prototype is developed based on a lightweight virtual machine monitor, above on which the monitored Linux kernel, runtime detection and recovery services run simultaneously. The proposed infrastructure requires few modifications to current Linux kernel source code, thus it can be easily adopted into existing embedded systems. It is also fully software-based without introducing any specific hardware, therefore it is cost-efficient. The evaluation experiment results indicate that our prototype system can correctly detect inconsistent kernel data structures caused by security attacks with acceptable penalty to system performance.

    Original languageEnglish
    Title of host publicationProceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009
    Pages283-287
    Number of pages5
    DOIs
    Publication statusPublished - 2009
    Event2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009 - Tokyo
    Duration: 2009 Mar 172009 Mar 20

    Other

    Other2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009
    CityTokyo
    Period09/3/1709/3/20

    Fingerprint

    Embedded systems
    Data structures
    Recovery
    Online systems
    Intrusion detection
    Computer hardware
    Costs
    Experiments
    Linux
    Virtual machine

    ASJC Scopus subject areas

    • Computer Science Applications
    • Software

    Cite this

    Sun, L., Nilsson, D. K., Katori, T., & Nakajima, T. (2009). Online self-healing support for embedded systems. In Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009 (pp. 283-287). [5232025] https://doi.org/10.1109/ISORC.2009.31

    Online self-healing support for embedded systems. / Sun, Lei; Nilsson, Dennis K.; Katori, Tomohiro; Nakajima, Tatsuo.

    Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009. 2009. p. 283-287 5232025.

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Sun, L, Nilsson, DK, Katori, T & Nakajima, T 2009, Online self-healing support for embedded systems. in Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009., 5232025, pp. 283-287, 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009, Tokyo, 09/3/17. https://doi.org/10.1109/ISORC.2009.31
    Sun L, Nilsson DK, Katori T, Nakajima T. Online self-healing support for embedded systems. In Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009. 2009. p. 283-287. 5232025 https://doi.org/10.1109/ISORC.2009.31
    Sun, Lei ; Nilsson, Dennis K. ; Katori, Tomohiro ; Nakajima, Tatsuo. / Online self-healing support for embedded systems. Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009. 2009. pp. 283-287
    @inproceedings{4b0c522101ac4912aa29850dffbd72aa,
    title = "Online self-healing support for embedded systems",
    abstract = "In this paper, online system-level self-healing support is presented for embedded systems. Different from off-line log analysis methods used by conventional intrusion detection systems, our research focuses on analyzing runtime kernel data structures hence perform self-diagnosis and self-healing. Inside the infrastructure, self-diagnosis and self-healing solutions have been implemented based on several selected critical kernel data structures. They can fully represent current system status and are also closely related with system resources. At runtime once any system inconsistency has been detected, predefined recovery functions are invoked. Our prototype is developed based on a lightweight virtual machine monitor, above on which the monitored Linux kernel, runtime detection and recovery services run simultaneously. The proposed infrastructure requires few modifications to current Linux kernel source code, thus it can be easily adopted into existing embedded systems. It is also fully software-based without introducing any specific hardware, therefore it is cost-efficient. The evaluation experiment results indicate that our prototype system can correctly detect inconsistent kernel data structures caused by security attacks with acceptable penalty to system performance.",
    author = "Lei Sun and Nilsson, {Dennis K.} and Tomohiro Katori and Tatsuo Nakajima",
    year = "2009",
    doi = "10.1109/ISORC.2009.31",
    language = "English",
    isbn = "9780769535739",
    pages = "283--287",
    booktitle = "Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009",

    }

    TY - GEN

    T1 - Online self-healing support for embedded systems

    AU - Sun, Lei

    AU - Nilsson, Dennis K.

    AU - Katori, Tomohiro

    AU - Nakajima, Tatsuo

    PY - 2009

    Y1 - 2009

    N2 - In this paper, online system-level self-healing support is presented for embedded systems. Different from off-line log analysis methods used by conventional intrusion detection systems, our research focuses on analyzing runtime kernel data structures hence perform self-diagnosis and self-healing. Inside the infrastructure, self-diagnosis and self-healing solutions have been implemented based on several selected critical kernel data structures. They can fully represent current system status and are also closely related with system resources. At runtime once any system inconsistency has been detected, predefined recovery functions are invoked. Our prototype is developed based on a lightweight virtual machine monitor, above on which the monitored Linux kernel, runtime detection and recovery services run simultaneously. The proposed infrastructure requires few modifications to current Linux kernel source code, thus it can be easily adopted into existing embedded systems. It is also fully software-based without introducing any specific hardware, therefore it is cost-efficient. The evaluation experiment results indicate that our prototype system can correctly detect inconsistent kernel data structures caused by security attacks with acceptable penalty to system performance.

    AB - In this paper, online system-level self-healing support is presented for embedded systems. Different from off-line log analysis methods used by conventional intrusion detection systems, our research focuses on analyzing runtime kernel data structures hence perform self-diagnosis and self-healing. Inside the infrastructure, self-diagnosis and self-healing solutions have been implemented based on several selected critical kernel data structures. They can fully represent current system status and are also closely related with system resources. At runtime once any system inconsistency has been detected, predefined recovery functions are invoked. Our prototype is developed based on a lightweight virtual machine monitor, above on which the monitored Linux kernel, runtime detection and recovery services run simultaneously. The proposed infrastructure requires few modifications to current Linux kernel source code, thus it can be easily adopted into existing embedded systems. It is also fully software-based without introducing any specific hardware, therefore it is cost-efficient. The evaluation experiment results indicate that our prototype system can correctly detect inconsistent kernel data structures caused by security attacks with acceptable penalty to system performance.

    UR - http://www.scopus.com/inward/record.url?scp=70350602746&partnerID=8YFLogxK

    UR - http://www.scopus.com/inward/citedby.url?scp=70350602746&partnerID=8YFLogxK

    U2 - 10.1109/ISORC.2009.31

    DO - 10.1109/ISORC.2009.31

    M3 - Conference contribution

    SN - 9780769535739

    SP - 283

    EP - 287

    BT - Proceedings of the 2009 IEEE International Symposium on Object/Component/Service-Oriented Real-Time Distributed Computing, ISORC 2009

    ER -