Anomaly Detection in Multicore Embedded Systems
Resumo
In this paper, we present an Anomaly Detection implementation with the usage of Artificial Neural Network (ANN) for Multicore Embedded Systems. The detector is built over a sophisticated Real-Time Multicore scheduling framework that allowed capturing high-quality run-time data for the Machine Learning (ML) process and provided the necessary infrastructure for the ANN to be embedded. To conceive the detector we first defined a sane behaviour through a set of performance counters, providing the necessary information to define an anomaly. After describing the ML process and the ANN embedding details, we evaluate the results of the detection adding a different task to the execution and showing the embedded detector was able to successfully classify over 92% of the execution, never misinterpreting an anomaly as a sane task, with no interference on application execution time, once the anomaly detector runs on core 0, which is reserved for system management and control operations. Also, the maximum delay to detect that the running task is an anomaly was equal to 1 sampling of the performance monitoring counters (configured with captures spaced by 10ms, or 100 captures per second). We conclude the experiments showing the effectiveness of our online ANN anomaly detector by actuating on the suspension of the tasks classified as an anomaly, maintaining a sane execution by mitigating anomalies.
Referências
E. Viegas A. O. Santin A. França R. Jasinski V. A. Pedroni L. S. Oliveira "Towards an energy-efficient anomaly-based intrusion detection engine for embedded systems" IEEE Transactions on Computers vol. 66 no. 1 pp. 163-177 Jan 2017.
C. Zhou S. Huang N. Xiong S. Yang H. Li Y. Qin X. Li "Design and analysis of multimodel-based anomaly intrusion detection systems in industrial process automation" IEEE Transactions on Systems Man and Cybernetics: Systems vol. 45 no. 10 pp. 1345-1360 Oct 2015.
T. Mück A. A. Fröhlich G. Gracioli A. M. Rahmani J. G. Reis N. Dutt "CHIPS-AHOy: a predictable holistic cyber-physical hypervisor for MPSoCs" 18th International Conference on Embedded Computer Systems: Architectures Modeling and Simulation pp. 73-80 2018 [online] Available: https://doi.org/10.1145/3229631.3229642.
K. Singh M. Bhadauria S. A. McKee "Real Time Power Estimation and Thread Scheduling via Performance Counters" ACM SIGARCH Computer Architecture News pp. 46-55 2009 [online] Available: https://doi.org/10.1145/1577129.1577137.
M. Kim K. Kim J. R. Geraci S. Hong "Utilization-aware load balancing for the energy efficient operation of the big.LITTLE processor" 2014 Design Automation and Test in Europe Conference and Exhibition (DATE) pp. 46-55 2014 [online] Available: https://ieeexplore.ieee.org/document/6800437.
L. P. Horstmann J. L. C. Hoffmann A. A. Fröhlich "A Framework to Design and Implement Real-time Multicore Schedulers using Machine Learning" 24th IEEE Conference on Emerging Technologies and Factory Automation (ETFA) pp. 8 Sep. 2019.
Raspberry pi 3 model b 2019 [online] Available: https://www.raspberrypi.org/products/raspberry-pi-3-model-b/.
EPOS: Embedded Parallel Operating System 2019 [online] Available: https://epos.lisha.ufsc.br/.
Steffen Nissen "FANN:Fast Artificial Neural Network library".
S. K. Venkata I. Ahn D. Jeon A. Gupta C. Louie S. Garcia S. Belongie M. B. Taylor "SD-VBS: The San Diego vision benchmark suite" 2009 IEEE International Symposium on Workload Characterization (IISWC) pp. 55-64 october 2009 [online] Available: https://storage.googleapis.com/pub-tools-public-publication-data/pdf/36590.pdf.
E. W. L. Leng M. Zwolinski B. Halak "Hardware performance counters for system reliability monitoring" 2017 IEEE 2nd International Verification and Security Workshop (IVSW) pp. 76-81 2017 [online] Available: https://ieeexplore.ieee.org/document/8031548.
V. Jyothi X. Wang S. K. Addepalli R. Karri "BRAIN: BehavioR Based Adaptive Intrusion Detection in Networks: Using Hardware Performance Counters to Detect DDoS Attacks" 2016 29th International Conference on VLSI Design and 2016 15th International Conference on Embedded Systems (VLSID) pp. 587-588 2016 [online] Available: https://ieeexplore.ieee.org/document/7435029.
K. Ott R. Mahapatra "Hardware performance counters for embedded software anomaly detection" 2018 IEEE 16th Intl Conf on Dependable Autonomic and Secure Computing 16th Intl Conf on Pervasive Intelligence and Computing 4th Intl Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress(DASC/PiCom/DataCom/CyberSciTech) pp. 528-535 Aug 2018.
F. M. M. ul Islam M. Lin L. T. Yang K.-K. R. Choo "Task aware hybrid DVFS for multi-core real-time systems using machine learning" Information Sciences pp. 433-332 2018 [online] Available: https://www.sciencedirect.com/science/article/pii/S0020025517308897.
X. Wu V. Taylor "Utilizing Hardware Performance Counters to Model and Optimize the Energy and Performance of Large Scale Scientific Applications on Power-Aware Supercomputers" 2016 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW) pp. 1180-1189 2016 [online] Available: https://ieeexplore.ieee.org/document/7530001.
ARM Cortex-A53 MPCore Processor ARM 2016.
Heechul Yun Misc micro-benchmarks & tools 2019 [online] Available: https://github.com/heechul/misc/.
A. Dignös M. H. Böhlen J. Gamper "Temporal Alignment" ACM SIGMOD International Conference on Management of Data pp. 433-444 May 2012 [online] Available: https://doi.org/10.1145/2213836.2213886.
J. Miller "Short Report: Reaction Time Analysis with Outlier Exclusion: Bias Varies with Sample Size" The Quarterly Journal of Experimental Psychology Section A pp. 907-912 October 1991 [online] Available: https://doi.org/10.1080/14640749108400962.
L. A. Shalabi Z. Shaaban B. Kasasbeh "Data Mining: A Pre-processing Engine" Journal of Computer Science vol. 9 no. 2 pp. 735-739 2006.
H. Liu H. Motoda Computational Methods of Feature Selection Chapman and Hall/CRC 2007.
A. Ahmad L. Dey "A feature selection technique for classificatory analysis" Pattern Recognition Letters vol. 26 no. 1 pp. 43-56 2005.
