Detection of counterfeit and compromised devices using system and function call tracing techniques
View Patent ↗Frameworks, methods, and systems for securing a smart grid are provided. A framework can include data collection, call tracing techniques, and preparing call lists to detect counterfeit or compromised devices. The call tracing techniques can include call tracing and compiling all system and function calls over a time interval. The framework can further include data processing, in which a genuine device is identified and compared to unknown devices. A first statistical correlation can be used for resource-rich systems, and a second statistical correlation can be used for resource-limited systems. Threats of information leakage, measurement poisoning and store-and-send-later can be considered.
1. A framework for securing a smart grid, the framework comprising:
data collection comprising call tracing techniques and preparing call lists;
data processing comprising identifying genuine devices and creating a ground truth profile (GTP) database through a learning process, and comparing and correlating call lists of the genuine devices and the GTP database with call lists of unknown devices; and
determining whether the unknown devices are counterfeit or compromised,
the GTP database comprising: a) type and amount of system and function calls; and b) an entire system and function call list, both a) and b) being triggered during the learning process.
2. The framework according to claim 1 , the call tracing techniques comprising tracing and compiling all system and function calls over a time interval.
3. The framework according to claim 1 , the genuine device being identified using autocorrelation values.
4. The framework according to claim 1 , the data processing comprising comparing system and function call appearance frequency, and
the data processing further comprising comparing an order in which system and function calls are raised.
5. The framework according to claim 1 , the call tracing techniques comprising dynamic library interposition.
6. The framework according to claim 1 , the call tracing techniques comprising reverse engineering with ptrace.
7. The framework according to claim 1 , the framework considering threats of information leakage, measurement poisoning, and store-and-send-later.
8. The framework according to claim 2 , the data processing comprising direct system and function call comparison, and
the direct system and function call comparison not considering system or function call order and system or function call parameter values.
9. The framework according to claim 1 , the GTP database including different GTPs created with respect to different classes of the genuine devices.
10. A framework for securing a smart grid comprising:
data collection comprising call tracing techniques and preparing call lists;
data processing comprising identifying genuine devices and creating a ground truth profile (GTP) database through a learning process, and comparing and correlating call lists of the genuine devices and the GTP database with call lists of unknown devices; the data processing further comprising direct system and function call comparison, a first statistical correlation for low entropy systems, and a second statistical correlation for high entropy systems; and
determining whether the unknown devices are counterfeit or compromised,
the GTP database comprising: a) type and amount of system and function calls; and b) an entire system and function call list, both a) and b) being triggered during the learning process.
11. The framework according to claim 10 , the first statistical correlation comprising analyzing system call type and order.
12. The framework according to claim 10 , the first statistical correlation comprising assigning weights for different types of system and function calls depending on system and function call importance and application.
13. The framework according to claim 10 , the call tracing techniques comprising reverse engineering with ptrace.
14. The framework according to claim 10 , the direct system and function call comparison not considering system and function call order and system and function call parameter values.
15. The framework according to claim 10 , the second statistical correlation comprising removing randomness and creating new system and function call lists.
16. The framework according to claim 10 , the genuine device being identified using autocorrelation values.
17. The framework according to claim 13 , the call tracing techniques further comprising dynamic library interposition.
18. The framework according to claim 10 , the GTP database including different GTPs created with respect to different classes of the genuine devices.
19. A framework for securing a smart grid, the framework comprising:
data collection comprising call tracing techniques and preparing call lists, the call tracing techniques comprising call tracing and compiling all system and function calls over a time interval;
data processing comprising identifying genuine devices and creating a ground truth profile (GTP) database through a learning process, and comparing and correlating call lists of the genuine devices and the GTP database with call lists of unknown devices;
the data processing further comprising direct system and function call comparison that does not consider system and function call order and system and function call parameter values, a first statistical correlation for low entropy systems, and a second statistical correlation for high entropy systems;
the first statistical correlation comprising analyzing system and function call type and order, the first statistical correlation comprising assigning weights for different types of system and function calls depending on system and function call importance and application;
the second statistical correlation comprising removing randomness and creating new system and function call lists; and
determining whether the unknown devices are counterfeit or compromised,
the framework considering threats of information leakage, measurement poisoning, and store-and-send-later, and
the GTP database comprising: a) type and amount of system and function calls; and b) an entire system and function call list, both a) and b) being triggered during the learning process.
20. The framework according to claim 19 , the GTP database including different GTPs created with respect to different classes of the genuine devices.