Search papers, labs, and topics across Lattice.
This paper presents a model-based approach to enhance run-time cybersecurity through the integration of software and hardware monitoring for control-flow anomaly detection and attack identification. By employing a dual-layer monitoring system, the method significantly improves the detection of camouflaged attacks that traditional systems might misclassify as benign. The authors demonstrate this with an authentication service case study, where the combined architecture shifts the diagnosis of an anomaly from a low-severity issue to a high-confidence identification of a serious intrusion.
Attackers can no longer rely on camouflage to evade detection, as this dual-layer monitoring approach dramatically improves diagnostic accuracy in identifying cyber threats.
Methods to increase the resilience of systems to cyber-attacks become increasingly important. Control-flow monitoring provides a principled basis to ensure integrity and detect possible anomalies at run-time. Once anomalies have been detected, so-called attack trees can be used to identify possible types of attacks. However, this approach is vulnerable to camouflage, by which attackers try to evade detection (and correct identification) by deliberately manipulating also the system's observed control flow. In this paper, we outline a model-based approach that provides more robust intrusion detection and attack identification through an architecture that combines software- with hardware-based monitoring. In this approach, software-level observation indicates suspicious activities, while hardware-level monitoring checks them separately in more detail, making it much harder for attacks to camouflage themselves and go undetected. We illustrate the approach with an authentication-service example that captures a realistic failure mode: a software-level observer sees an anomalous but apparently harmless control-flow deviation, maps it to a benign root cause in an attack tree, but misses the true intrusion. A second, independent hardware control-flow monitor observes the actual transition sequence and thereby changes the attack-tree diagnosis from a low-severity configuration or maintenance issue to a high-confidence code-injection or control-flow hijack. In this scenario, the proposed combination of control-flow anomaly detection, attack-tree based intrusion identification, and hardware-based monitoring can improve not only anomaly detection, but also the diagnostic precision of attack-tree-based cyber-attack identification.
