Configurable middleware-level intrusion detection for embedded systems

Embedded systems have become integral parts of a diverse range of systems. Unfortunately, research on embedded system security, in general, and intrusion detection, in particular, has not kept pace. Embedded systems are, by nature, application specific and therefore frameworks for developing application-specific intrusion detection systems for distributed embedded systems must be researched, designed, and implemented. In this paper, we present a configurable middleware-based intrusion detection framework. First, we present a system model and a concrete implementation of a highly configurable intrusion detection framework that is integrated into MicroQoSCORBA, a highly configurable middleware framework developed for embedded systems. Our framework autogenerates application-specific intrusion detection systems by exploiting application-specific information accessible to the middleware framework (e.g., object interfaces and method signatures). Next, a set of configurable intrusion detection mechanisms suitable for embedded systems is presented. A performance evaluation of these mechanisms is presented at the end of the paper.