Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

CMDiagnostor: an Ambiguity-Aware Root Cause Localization Approach Based on Call Metric Data

Distance Based Root Cause Analysis and Change Impact Analysis of Performance Regressions

CMMD: Cross-Metric Multi-Dimensional Root Cause Analysis

Root-Cause Metric Location for Microservice Systems Via Log Anomaly Detection

Multi-stage Location for Root-Cause Metrics in Online Service Systems.

Localizing Failure Root Causes in a Microservice through Causality Inference

Self-Adaptive Root Cause Diagnosis for Large-Scale Microservice Architecture

Generic and Robust Localization of Multi-dimensional Root Causes.

Beyond Sharing: Conflict-Aware Multivariate Time Series Anomaly Detection

Locating the Clues of Declining Success Rate of Service Calls

Practical Anomaly Detection over Multivariate Monitoring Metrics for Online Services

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

RAPMiner: A Generic Anomaly Localization Mechanism for CDN System with Multi-dimensional KPIs

Fault Diagnosis for Test Alarms in Microservices Through Multi-source Data

Magnifier: Online Detection of Performance Problems in Large-Scale Cloud Computing Systems

MicroHECL: High-Efficient Root Cause Localization in Large-Scale Microservice Systems

OCRCL: Online Contrastive Learning for Root Cause Localization of Business Incidents

MS-Rank: Multi-Metric and Self-Adaptive Root Cause Diagnosis for Microservice Applications

On Root Cause Localization and Anomaly Mitigation through Causal Inference

Generic and Robust Performance Diagnosis Via Causal Inference for OLTP Database Systems

A Search Based Context-Aware Approach for Understanding and Localizing the Fault Via Weighted Call Graph