Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

CrypTody: Cryptographic Misuse Analysis of IoT Firmware Via Data-flow Reasoning

Hardware-Assisted Control-Flow Integrity Enhancement for IoT Devices

One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware

A Large-Scale Empirical Analysis of the Vulnerabilities Introduced by Third-Party Components in IoT Firmware

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

CryptoEval: Evaluating the Risk of Cryptographic Misuses in Android Apps with Data-Flow Analysis

Identifying Privilege Separation Vulnerabilities in IoT Firmware with Symbolic Execution

Toward Hybrid Static-Dynamic Detection of Vulnerabilities in IoT Firmware

To Fix or Not to Fix: A Critical Study of Crypto-misuses in the Wild

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Exploring Automatic Cryptographic API Misuse Detection in the Era of LLMs

Demystifying and Detecting Cryptographic Defects in Ethereum Smart Contracts

CRYLOGGER: Detecting Crypto Misuses Dynamically

Faster and Better: Detecting Vulnerabilities in Linux-based IoT Firmware with Optimized Reaching Definition Analysis

A Multi-Level Architecture for Hardware Trojan and Vulnerability Runtime Detection and Response Towards Cryptographic IP.

Hardware Trojans in Chips: A Survey for Detection and Prevention

argXtract: Deriving IoT Security Configurations via Automated Static Analysis of Stripped ARM Binaries

UVSCAN: Detecting Third-Party Component Usage Violations in IoT Firmware

Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be

AutoFirm: Automatically Identifying Reused Libraries inside IoT Firmware at Large-Scale

Physical Devices-Agnostic Hybrid Fuzzing of IoT Firmware