Towards Anomaly Detection in Embedded Systems Application Using LLVM Passes

Ilahi, Sirine, Omotosho, Adebayo ORCID: https://orcid.org/0000-0002-1642-7610 and Hammer, Christian (2024) Towards Anomaly Detection in Embedded Systems Application Using LLVM Passes. In: 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC). IEEE, pp. 2448-2453. ISBN 9798350376968

Text 15790 Ilahi, S et al (2024) Towards_Anomaly_Detection_in_Embedded_Systems_Application_Using_LLVM_Passes.pdf - Published Version Restricted to Repository staff only Available under License All Rights Reserved. Download (784kB)

Abstract

Software security exploits, such as Return-Oriented Programming (ROP) attacks, have persisted for more than a decade. ROP attacks inject malicious behaviors into programs, posing serious risks to computing devices, and they can be particularly challenging to detect in systems with limited resources. In this paper, we introduce an approach that exploits Low-Level Virtual Machine (LLVM) passes, programmatic transformations applied during compilation, to detect ROP attacks in ARM-based embedded systems. By customizing LLVM passes, developers can integrate tailored security checks and optimisations into embedded systems requirements. Our approach is motivated by the use of Hardware Performance Counters (HPCs) for certain mitigations, which are not commonly available on all embedded systems. The experimental evaluation of our approach for detecting ROP attacks in real-world applications shows that it is feasible and can be extended to detect new attacks independently of an Operating System (OS). The storage overhead induced by our approach is approximately 55%.

Item Type:	Book Section
Uncontrolled Keywords:	Embedded systems; LLVM passes; Instrumentation; Return oriented programming; Security
Subjects:	H Social Sciences > HD Industries. Land use. Labor > HD28 Management. Industrial Management > HD61 Risk in industry. Risk management Q Science > QA Mathematics > QA76 Computer software
Divisions:	Schools and Research Institutes > School of Business, Computing and Social Sciences
Depositing User:	Kamila Niekoraniec
Date Deposited:	04 Feb 2026 10:27
Last Modified:	04 Feb 2026 10:30
URI:	https://eprints.glos.ac.uk/id/eprint/15790

University Staff: Request a correction | Repository Editors: Update this record