Anomaly detection in Cyber-Physical Systems based on Hardware Performance Counters

Abstract: In this project work the basis for an anomaly detection system in ARM processors was researched on. Specifically, the focus was set to determine the performance monitoring units (PMU) in the processor which allow the reliable detection of anomalies. This was achieved by injecting targeted faults on the assembly level into the binary file to represent attacks on a physical level in a consistent way. A set of three PMUs was determined to reach a detection rate of 56.67% to 66.67% (depending on the test scenario) in the selected scenarios. However, the expected detection rate is higher for real-world attacks, due to the broad nature of the executed tests. In addition, it was observed that the readout frequency of these PMUs is critical, and in general, it is advisable to expose the values after each function call, or in the case of security-sensitive sections, multiple times within functions.