Subcomponent timing-based detection of malware in embedded systems

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Scopus citations


Network-connected embedded systems require multiple lines of defense against malware. In addition to preventing malware by designing secure interfaces and software, anomaly-based detection is needed to detect malware that successfully infiltrates these defenses. Timing based anomaly detection strengthens embedded system security by detecting anomalies in the execution time of critical software tasks. However, existing timing based anomaly detection methods use a lumped timing model that aggregates the timing of the software, processor architecture, operating system scheduling, etc., and thereby incurs significant variability. We present a non-intrusive hardware detector supporting two novel timing models, including a lumped timing multi-range model that clusters timing into multiple range bounds, and a subcomponent timing model that defines bounds for timing subcomponents of events. Timing subcomponents include intrinsic software execution, instruction cache misses, data cache misses, and interrupts. The experimental results demonstrate that the detection based on subcomponent timing model achieves greater malware detection accuracy compared to the lumped timing model without increasing false positives.

Original languageEnglish (US)
Title of host publicationProceedings - 35th IEEE International Conference on Computer Design, ICCD 2017
PublisherInstitute of Electrical and Electronics Engineers Inc.
Number of pages8
ISBN (Electronic)9781538622544
StatePublished - Nov 22 2017
Event35th IEEE International Conference on Computer Design, ICCD 2017 - Boston, United States
Duration: Nov 5 2017Nov 8 2017


Other35th IEEE International Conference on Computer Design, ICCD 2017
Country/TerritoryUnited States


  • Anomaly detection
  • Embedded system security
  • Non-intrusive
  • Timing subcomponents
  • Timing-based detection

ASJC Scopus subject areas

  • Hardware and Architecture


Dive into the research topics of 'Subcomponent timing-based detection of malware in embedded systems'. Together they form a unique fingerprint.

Cite this