Power profile based runtime anomaly detection

Existing intrusion detection techniques that could once detect malicious applications effectively, now fail, since they are unable to keep up with the rapidly evolving zero-day attacks. Currently, anomaly detection is a widely used technique to detect zero-day attacks. However, anomaly detection based on system calls, control flow, network traffic, etc. are typically not suitable for closed platforms, such as PLC, that do not support any means of processor-based anomaly detection. Hence, in this paper, we propose a novel approach of real-time anomaly detection using the power profile of an application that can also be employed for closed platforms. Experimental results show that the proposed approach is sensitive enough to differentiate not only two different applications but also two functionally equivalent applications with different implementation. Additionally, while existing energy consumption based anomaly detection methods can detect anomalies only after an application finishes its execution, the proposed technique detects anomalies during execution, thereby enabling anomaly detection at an early stage.