CPS Device Identification via System Call Tracing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current device fingerprinting techniques are inadequate for identifying CPS devices in resource-limited environments, as they often require external stimulants, traffic monitoring, or specific network protocols, and are vulnerable to countermeasures, limiting their effectiveness in real-world applications.

Innovation Solution

The implementation of system and function call tracing, statistical correlation, and performance analysis techniques to create unique device class signatures, allowing for device and class identification without external stimulants or extensive traffic monitoring, suitable for resource-limited CPS devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If traditional device fingerprinting techniques are used, then device identification can be achieved, but they require external stimulants, traffic monitoring, or specific network protocols which increase device complexity and resource consumption

Engineering Contradiction:

Improvedevice identification accuracyVSAvoidfingerprinting system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The device performs self-identification by generating fingerprints from its own internal system calls and function execution patterns without requiring external stimulants or probes. The fingerprinting data is collected from the device's own operational behavior, eliminating the need for external measurement infrastructure.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent extracts identification features directly from system call traces and function execution patterns generated during normal device operation. By taking out only the essential behavioral characteristics from the device's operational data, the system achieves identification without requiring complex external measurement systems.

Inventive Principle:

Principle #2Taking out (Extraction)

2Adaptability or versatility

If passive blackbox based techniques are used for device class identification, then device type determination is possible, but the technique is limited to specific types of devices and network configurations

Engineering Contradiction:

Improvedevice type coverageVSAvoididentification reliability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system analyzes system call patterns and function execution behaviors that are fundamental to device operation across different device types and network configurations. By focusing on universal operational characteristics rather than device-specific features, the fingerprinting method achieves broad adaptability while maintaining reliable identification.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Measurement precision

If timing distributions between packets are used for fingerprinting, then device identification can be achieved, but the delay introduced by switches and routers significantly impacts accuracy

Engineering Contradiction:

Improveidentification accuracyVSAvoidnetwork delay impact

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The patent replaces network-based measurement mechanisms (packet timing analysis) with host-based measurement mechanisms (system call tracing). By substituting the measurement location from the network layer to the application layer on the device itself, the system eliminates the harmful effect of network delays and intermediate device interference on identification accuracy.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

4Measurement precision

If system and function call tracing is implemented, then unique device signatures can be created with high accuracy, but resource consumption increases

Engineering Contradiction:

Improvedevice signature accuracyVSAvoiddevice resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system implements partial tracing by monitoring only specific system calls and function executions that are relevant to device identification. By selecting only the essential behavioral patterns needed for fingerprinting rather than comprehensive tracing, the system achieves high identification accuracy while minimizing resource consumption on resource-constrained devices.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS10242193B1Method of resource-limited device and device class identification using system and function call tracing techniques, performance, and statistical analysis

Publication Date: 2019.03.26 FLORIDA INTERNATIONAL UNIVERSITY

AI summary

Methods for cyber physical systems device classification are provided. A method can include receiving system and function calls and parameters and a device performance index from an unknown CPS device and a device performance index of similar class of CPS devices, calculating an autocorrelation value between different realizations of the system and function calls and parameters of the known CPS device, determining whether the autocorrelation value is greater than a threshold amount, and storing the system and function calls and parameters and the device performance characteristics of the known CPS device in the database. A method can also include calculating a correlation between system and function calls and parameters of an unknown CPS device and known CPS devices classes included in the database, as well as determining whether the maximum correlation is also greater than a threshold amount.