Online Self-Healing Support for Embedded Systems

Paper in proceeding, 2009

In this paper, online system-level self-healing support is presented for embedded systems. Different from off-line log analysis methods used by conventional intrusion detection systems, our research focuses on analyzing runtime kernel data structures hence perform self-diagnosis and self-healing. Inside the infrastructure, self-diagnosis and self-healing solutions have been implemented based on several selected critical kernel data structures. They can fully represent current system status and are also closely related with system resources. At runtime once any system inconsistency has been detected, predefined recovery functions are invoked. Our prototype is developed based on a lightweight virtual machine monitor, above on which the monitored Linux kernel, runtime detection and recovery services run simultaneously. The proposed infrastructure requires few modifications to current Linux kernel source code, thus it can be easily adopted into existing embedded systems. It is also fully software-based without introducing any specific hardware, therefore it is cost-efficient. The evaluation experiment results indicate that our prototype system can correctly detect inconsistent kernel data structures caused by security attacks with acceptable penalty to system performance.