Implementation of a HostBased Intrusion Detection System for Avionic Applications Today, aircraft are protected by strong safety properties, qualified operators and processbased security measures. However, considering the recent evolution of inflight services towards more connectivity, resource sharing and advanced entertainment functionalities, together with the increase of threats targeting embedded systems, the potential malicious modification of an aircraft application must be seriously considered for future systems. In this context, several solutions can be developed to improve aircraft security. In particular, Hostbased Intrusion Detection Systems (HIDS) are relevant to deal with targeted threats such as an insider attack. This paper presents the specific constraints of building an HIDS onboard an aircraft, and discusses some relevant solutions that satisfy these constraints. These solutions are evaluated in terms of detection efficiency and resource consumption in order to select the solution that allows the best tradeoff between efficiency and performances. The implementation of this solution on an embedded avionic computer is also described.

Evaluation Framework for Network Intrusion Detection Systems for InVehicle CAN Modern vehicles are complex safety critical cyber physical systems, that are connected to the outside world, with all security implications it brings. Different network intrusion detection systems (NIDSs) proposed for the CAN bus, the predominant type of invehicle network, to improve security are hard to compare due to disparate evaluation methods adopted. In this paper we provide the means to compare CAN NIDSs on equal footing and evaluate the ones detailed in the literature. Based on this we observe some limitation of existing approaches and why in the CAN setting it is intrinsically difficult to distinguish benign from malicious payload. We argue that xe2x80x9cmeaningawarexe2x80x9d detection (a concept we define) which is challenging (but perhaps not impossible) to create for this setting.