IEEE Consumer Electronics Magazine - September/October 2021 - 103

Figure 1. Training and detection processes of a standard system call-based HIDS.
systems' regular operation will not be affected.
For the intrusion detection approaches of
embedded systems, the detection results should
be accurate; the detection speed should be fast;
the resource usage should be less.
The host-based intrusion detection system
(HIDS) is an essential research domain of cybersecurity.
HIDS analyzes host log data to discover
intrusive behaviors. System call-based HIDS
techniques have been widely implemented in
embedded systems and proven useful in intrusion
detection. In Linux, a system call is applied
while a process requests a service of the kernel.
System call-based HIDS scans streaming system
call traces to identify anomalies. System call
traces are a kind of important fine-grained host
log data. Figure 1 illustrates the training and
detection processes of a standard system-call
based HIDS.
Artificial intelligence (AI) approaches, such
as machine learning algorithms, have been
explored by researchers along with system callbased
HIDS techniques for detecting malicious
activities of embedded systems. For example,
Feizolah et al.4 investigated some feature extraction
methods of malware detection systems for
mobile devices and found that system call was
the most commonly used dynamic feature.
Although system call-based techniques have
been proven effective in intrusion detection for
embedded systems, most of them are based on
the traditional standalone structure, which has
several shortcomings. It is challenging to detect
complex and distributed attacks, and training
detection models on a single host may be time
consuming.5 Therefore, it is essential to provide
a tradeoff between security and resources for
IDS.6 There are some research works in the consumer
technology society about enhancing the
September/October 2021
security-resources balance. For example,
Lin et al. proposed an edge computing IDS and
investigated the requirement of resource allocation.7
However, their work has not been prototyped
yet. Vaseer et al. proposed an IDS with
promising accuracy and packet delivery for the
mobile ad-hoc network.8 However, their work
did not consider the security of the IDS itself.
Currently, public cloud computing can offer
secure storage and computing services for dataintensive
tasks. Meanwhile, big data processing
engines such as Apache Spark9 can help developers
with stable and scalable data analytics works.
Combining Spark and cloud computing is an
opportunity to enhance the HIDS. Motivated by
this situation, in this article, a two-tier scalable
framework will be proposed for embedded systems
to reduce the latency and improve the scalability
of HIDS. The framework is based on Apache
Spark9 and is deployed in the cloud environment.
HIDS FRAMEWORK
Figure 2 depicts the two-tier HIDS framework
for embedded systems. The first tier includes
interfaces installed in embedded devices for
data collection. The second tier includes an analytics
center in the cloud environment. In the
first tier, the interfaces collect system call traces
from Linux processes. The data will be transferred
to the analytics center in the second tier
for analysis, and the intermediate results can be
cached in the detection database. The detection
results given by the analytics center can be
timely reported to the devices to take further
defensive responses. The analytics center is
composed of a Spark cluster, and Spark MLlib is
utilized for analysis. Google cloud storage is utilized
as the detection database.
103
IEEE Consumer Electronics Magazine - September/October 2021

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - September/October 2021
