IoT Device Malware Detection via Offloaded Meta-Information
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices lack sufficient computational resources to perform heavy monitoring operations, making it difficult to effectively monitor malware targeting them, as they often rely on data packet monitoring rather than process execution and file access monitoring.
Innovation Solution
A computer-implemented method where an IoT device receives meta-information from a network monitoring device about network data transfers, allowing it to detect and monitor file transfers and processes without needing to scan data, thereby offloading the computational workload and enabling the detection of malware by monitoring file executions and accesses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IoT device performs heavy monitoring operations to detect malware, then malware detection capability is improved, but computational resource consumption increases beyond device capacity
Solution Approach 1:
The patent introduces a network monitoring device as an intermediary that performs heavy monitoring operations and generates meta-information about network data transfers. The IoT device receives this pre-processed meta-information instead of performing heavy monitoring itself, thus maintaining malware detection capability while reducing computational resource consumption on the IoT device.
2Reliability
If IoT device monitors all network data transfers directly, then monitoring completeness is improved, but device complexity increases
Solution Approach 1:
The monitoring system is segmented into two parts: a network monitoring device that performs comprehensive network data transfer monitoring and generates meta-information, and an IoT device that receives and processes only the relevant meta-information. This segmentation maintains monitoring completeness while reducing the complexity burden on the IoT device.
3Measurement precision
If IoT device scans data packets to detect malware, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The network monitoring device performs preliminary monitoring and analysis of network data transfers, generating meta-information that contains key characteristics of the transferred data. The IoT device receives this pre-processed information and can quickly assess potential threats without performing time-consuming data scanning, thus maintaining detection accuracy while reducing processing time.
Data Source
AI summary
Monitoring a process on an Internet of Things (IoT) device is performed by receiving, by the IoT device, a network data transfer from an external device; and receiving, by the IoT device, meta-information of the network data transfer. The meta-information can be generated, based on the network data transfer, by a network monitoring device. Additionally, the IoT device detects a file storing data of the network data transfer based on the meta-information. Further, the IoT device monitors a process relating to the detected file on the IoT device.