IoT Anti-Malware via Function Call Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT and PoS devices, due to their limited resources, are vulnerable to malware and security issues, making it impractical to run full anti-malware systems, and existing solutions fail to effectively prevent forbidden function calls that could lead to malicious activities.
Innovation Solution
Implementing a lightweight anti-malware strategy that hooks forbidden function calls, generates notifications, and updates a list of forbidden functions specific to each device's intended functionality, preventing execution and potentially disabling the device to prevent malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full anti-malware system is implemented, then security protection capability is improved, but device resource consumption increases beyond what IoT devices can sustain
Solution Approach 1:
The anti-malware system is segmented into two parts: a lightweight monitoring component running on the resource-constrained IoT device that only performs function call interception and basic detection, and a cloud-based analysis component that handles complex malware analysis and response actions. This segmentation allows the device to maintain security functionality while consuming minimal local resources.
Solution Approach 2:
A cloud-based server acts as an intermediary between the IoT device and the full anti-malware analysis capability. The device sends intercepted function calls and suspicious activity data to the cloud for analysis, receiving back verdicts and response instructions. This intermediary approach enables comprehensive security analysis without requiring full anti-malware resources on the device itself.
2Measurement precision
If comprehensive malware detection is implemented, then detection accuracy is improved, but processing time increases which is unacceptable for real-time security
Solution Approach 1:
The system performs preliminary action by pre-defining forbidden function call patterns and suspicious behavior signatures that are specific to IoT devices. When a function call is intercepted, the system immediately checks it against these pre-established patterns rather than performing full malware analysis, enabling rapid detection of known malicious patterns without time-consuming comprehensive scanning.
Solution Approach 2:
The system skips full malware analysis for routine function calls by using a tiered detection approach: first checking against a lightweight local blacklist of forbidden functions, then selectively submitting only suspicious cases to cloud analysis. This allows the majority of legitimate function calls to be processed instantly while maintaining the option for deeper analysis when needed.
3Productivity
If a lightweight monitoring system is used, then device resource usage is reduced, but the ability to detect and prevent sophisticated malware is weakened
Solution Approach 1:
The system implements feedback by continuously monitoring function calls, analyzing patterns of suspicious behavior, and dynamically updating the list of forbidden functions based on detected malware techniques. The cloud component receives feedback from multiple devices about new malware variants and updates the detection rules accordingly, allowing the lightweight local system to maintain high detection effectiveness through continuous learning and adaptation.
Solution Approach 2:
The cloud-based analysis platform serves multiple devices simultaneously, providing universal malware analysis capabilities that benefit all connected IoT devices. A single cloud instance can analyze malware patterns across thousands of devices, updating defense rules that protect all of them, thereby achieving comprehensive protection through a shared multi-functional system rather than requiring full local capabilities on each device.
Data Source
AI summary
Methods apparatus, systems, and articles of manufacture for IoT and PoS anti-malware are disclosed. An example method includes detecting a combination of function calls. Whether the combination of function calls is a forbidden combination of function calls for the device is detected based on a limited intended functionality of the device. The forbidden combination of function calls includes a first function call and a second function call. The first function call is allowed in isolation from the second function call. The second function call is allowed in isolation from the first function call. In response to determining that the combination of function calls is forbidden for the device, a responsive action is performed.