Clustering system call arguments for remote attestation

Abstract

In trusted computing, remote attestation is an essential feature to determine the trustworthiness of a remote platform by analyzing its integrity. In this paper, we present a new paradigm that leverages clustering system call arguments for integrity measurement and reporting in remote attestation. The major contribution of this paper is two-folds: (1) We introduce a clustering process to characterize system call arguments. (2) We introduce model verification for efficient trust reporting. Our proposed technique is evaluated on a real world dataset extracted from a Linux System. The results show that different clustering algorithms can achieve different average accuracy while introduce low overheads. © Springer-Verlag Berlin Heidelberg 2012.