Hardware-assisted malware detection for embedded systems in smart grid

In smart grid, demand side management (DSM) became increasingly important to improve the energy efficiency. It requires sophisticated real-time embedded control systems to manage distributed energy resources. These network-connected systems will be exposed to wide range of security threats when incorporating information and communication technologies. Securing embedded systems has unique resource and timing constraints. We developed a real-time application-specific malware detection system that runs on a dedicated hardware implemented in FPGA. It runs in parallel with the embedded system being monitored and provides real-time feedback to the running application in case of security violation. The system adopts the anomaly-based malware detection techniques. We model the correct program behaviors as function call graph. The information is extracted from application source code offline before runtime. The system is able to detect any attack that causes the embedded application to deviate from the pre-defined permissible behavior with minimal hardware overheads.