IoT Device Cyber-Attack Detection via System Call Baseline Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices lack effective security mechanisms to detect cyber-attacks, particularly zero-day attacks and those not conforming to known signatures, and are vulnerable due to limited computational resources and incompatible anti-virus/malware applications.
Innovation Solution
A system that creates a baseline profile of initial processes and system calls on IoT devices, monitors subsequent activities, and detects anomalies by comparing them to the baseline, using cryptographic nonces and machine learning to identify potential cyber-attacks without relying on network traffic analysis or attack signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus and anti-malware applications are deployed on IoT devices, then security detection capability is improved, but computational resource consumption and storage requirements increase beyond what IoT devices can provide
Solution Approach 1:
The patent extracts the security detection functionality from traditional resource-intensive anti-virus applications and implements a lightweight alternative using anomaly detection algorithms that monitor system calls and processes. This extracted approach provides security detection capability while consuming minimal computational resources suitable for IoT devices with constrained processing power and memory.
Solution Approach 2:
The patent changes the detection parameters from signature-based matching (computationally intensive) to statistical anomaly detection based on system call patterns and process behavior. By altering the detection methodology parameters, the system achieves security monitoring with significantly reduced computational overhead and storage requirements on IoT devices.
2Reliability
If traditional anti-virus applications are installed on IoT devices, then malware detection is improved, but device compatibility and resource constraints are worsened
Solution Approach 1:
The patent creates a universal security monitoring system that functions across diverse IoT device types (smart speakers, thermostats, cameras, locks, etc.) by monitoring fundamental system calls and process behaviors rather than relying on device-specific implementations. This multi-functional approach achieves malware detection compatibility across various IoT platforms and operating systems without requiring device-specific optimizations.
3Reliability
If network traffic-based intrusion detection is used, then attack detection capability is improved, but computational overhead and network performance impact increase
Solution Approach 1:
The patent introduces an intermediary lightweight monitoring agent that operates at the application layer rather than intercepting and analyzing network traffic. This intermediary monitors system calls and process behaviors locally, providing attack detection capability without introducing network overhead or impacting network performance, as it bypasses the network stack entirely.
4Measurement precision
If comprehensive security monitoring is implemented on IoT devices, then attack detection accuracy is improved, but storage requirements and computational overhead increase
Solution Approach 1:
The patent implements partial monitoring by focusing on critical system calls and processes that are most indicative of attacks, rather than comprehensively logging all device activities. This selective monitoring approach maintains high attack detection accuracy by concentrating resources on high-value indicators while minimizing storage requirements and computational overhead on resource-constrained IoT devices.
Data Source
AI summary
An example system may comprise a first computing device comprising instructions executable by a hardware processor to: create, responsive to detecting a second computing device initially attempting to connect to a network, an unpopulated baseline profile for the second computing device; populate the baseline profile with initial processes running on the second computing device and initial system calls made by the initial processes during an initial operation time period of the second computing device; monitor, during a subsequent operation time period of the second computing device, subsequent processes running on the second computing device and subsequent system calls made by the subsequent processes; and detect an attack on the second computing device based on a comparison of the subsequent processes and the subsequent system calls to the populated baseline profile.