| NSF Org: |
CNS Division Of Computer and Network Systems |
| Recipient: |
|
| Initial Amendment Date: | August 23, 2016 |
| Latest Amendment Date: | September 29, 2021 |
| Award Number: | 1615890 |
| Award Instrument: | Standard Grant |
| Program Manager: |
Daniela Oliveira
doliveir@nsf.gov (703)292-0000 CNS Division Of Computer and Network Systems CSE Directorate for Computer and Information Science and Engineering |
| Start Date: | October 1, 2016 |
| End Date: | September 30, 2022 (Estimated) |
| Total Intended Award Amount: | $453,413.00 |
| Total Awarded Amount to Date: | $453,413.00 |
| Funds Obligated to Date: |
|
| History of Investigator: |
|
| Recipient Sponsored Research Office: |
845 N PARK AVE RM 538 TUCSON AZ US 85721 (520)626-6000 |
| Sponsor Congressional District: |
|
| Primary Place of Performance: |
AZ US 85721-0001 |
| Primary Place of
Performance Congressional District: |
|
| Unique Entity Identifier (UEI): |
|
| Parent UEI: |
|
| NSF Program(s): | Secure &Trustworthy Cyberspace |
| Primary Program Source: |
|
| Program Reference Code(s): |
|
| Program Element Code(s): |
|
| Award Agency Code: | 4900 |
| Fund Agency Code: | 4900 |
| Assistance Listing Number(s): | 47.070 |
ABSTRACT
Embedded computing systems are found at the heart of medical devices, automotive systems, smartphone, etc. Securing these embedded systems is a significant challenge that requires new methods that address the power, time, and cost requirements under which these systems operate. Because embedded systems must meet precise time requirements, detecting changes in timing can indicate the presence of malware. This research investigates new models for capturing the expected behavior of embedded systems, in which time requirements play a pivotal role. The project is developing fast, low power, and low cost methods to detect changes from the expected behavior. The resulting knowledge and tools will provide developers with techniques to eliminate, detect, or mitigate malware and cyber-threats in embedded systems. This research will further enable the development of embedded systems with stronger security guarantees compared to the existing state-of-the-art.
This project is investigating formal timing-centric nominal system behavior models that capture the correct system execution behavior, thereby enabling efficient runtime detection of unauthorized system actions. The formal models combine well-founded techniques relying on execution call graphs, sequence models, system timing requirements, and statistical analysis of execution times. The researchers are developing secure, non-intrusive, and efficient hardware-based identification methods to detect deviations from the timing and sequence characteristics defined within the nominal system behavior models. To ensure efficiency, the researchers are investigating performance models and systematic methods to evaluate and optimize the tradeoffs between security achieved by these methods and the area and energy overheads of the monitoring hardware. The project team is also investigating novel methods for analyzing the timing of networked embedded systems to separate the intrinsic software execution time from the incidental execution time resulting from the underlying hardware architecture, operating system, and physical environment. The resulting methods will substantially advance the state-of-the-art by: a) enabling fast, accurate, and non-intrusive detection, b) providing robust new ways of detecting unauthorized operations, and c) extending anomaly-based detection capabilities to zero-day exploits.
PUBLICATIONS PRODUCED AS A RESULT OF THIS RESEARCH
Note:
When clicking on a Digital Object Identifier (DOI) number, you will be taken to an external
site maintained by the publisher. Some full text articles may not yet be available without a
charge during the embargo (administrative interval).
Some links on this page may take you to non-federal websites. Their policies may differ from
this site.
PROJECT OUTCOMES REPORT
Disclaimer
This Project Outcomes Report for the General Public is displayed verbatim as submitted by the Principal Investigator (PI) for this award. Any opinions, findings, and conclusions or recommendations expressed in this Report are those of the PI and do not necessarily reflect the views of the National Science Foundation; NSF has not approved or endorsed its content.
Embedded computing systems are found at the heart of medical devices, automotive systems, smartphone, etc. These systems are now commonly part of the Internet of Things, which opens new attack surfaces for bad actors. Every year, millions of new malware are created targeting these systems, and the rate at which they are created is increasing. Securing such systems is a significant challenge that requires new methods that address the power, time, and cost requirements under which these systems operate. This project investigated defining and utilizing formal system behavior models with novel statistical and probabilistic anomaly detection algorithms to rapidly detect attacks, intrusions, and malware. Because embedded systems must meet precise time requirements, detecting changes in timing can indicate the presence of malware. Leveraging this insight, the researchers developed new methods for fast, low power, and low cost anomaly-based detection of changes from the expected behavior indicating the presence of cyber threats. Intrusions, malware, and attacks can be detected at runtime by noticing execution behaviors that deviate from the expected normal timing. Importantly, anomaly-based detection provides protection against zero-day attacks (e.g., attacks that are yet unknown). To ensure efficient operation, the timing-based anomaly detection was implemented in hardware, yielding no performance overhead and as little as 1.85% power overhead. The accuracy of the timing-based anomaly detection was evaluated using two prototype systems, including a smart-connected pacemaker and an unmanned aerial vehicle. The resulting knowledge and tools provide designers and developers with techniques to eliminate, detect, or mitigate malware and cyber threats in a broad range of embedded systems.
Last Modified: 01/23/2023
Modified by: Jerzy W Rozenblit
Please report errors in award information by writing to: awardsearch@nsf.gov.
