Journal Article

Profiling with trust: system monitoring from trusted execution environments

Hönig, Timo, Röckl, Jonas, Jung, Benedikt, Eichler, Christian, Schlenk, Ralph, Müller, Tilo

2024

Overview

Large-scale attacks on IoT and edge computing devices pose a significant threat. As a prominent example, Mirai is an IoT botnet with 600,000 infected devices around the globe, capable of conducting effective and targeted DDoS attacks on (critical) infrastructure. Driven by the substantial impacts of attacks, manufacturers and system integrators propose Trusted Execution Environments (TEEs) that have gained significant importance recently. TEEs offer an execution environment to run small portions of code isolated from the rest of the system, even if the operating system is compromised. In this publication, we examine TEEs in the context of system monitoring and introduce the Trusted Monitor (TM), a novel anomaly detection system that runs within a TEE. The TM continuously profiles the system using hardware performance counters and utilizes an application-specific machine-learning model for anomaly detection. In our evaluation, we demonstrate that the TM accurately classifies 86% of 183 tested workloads, with an overhead of less than 2%. Notably, we show that a real-world kernel-level rootkit has observable effects on performance counters, allowing the TM to detect it. Major parts of the TM are implemented in the Rust programming language, eliminating common security-critical programming errors.

• Publisher: Springer US,Springer,Springer Nature B.V
• Subject: Anomalies / Artificial intelligence / Business metrics / CAE) and Design / Circuits and Systems / Computer-Aided Engineering (CAD / Denial of service attacks / Detectors / Edge computing / Engineering / Internet of Things / Intrusion detection systems / Machine learning / Malware / Monitoring / Monitoring systems / Operating systems / Program errors / Programming languages / Rootkit / Software / Special Purpose and Application-Based Systems