Swarm Intelligence Malicious Device Detection in IoT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional device security evaluation techniques are inadequate for detecting malicious devices in large-scale IoT systems, as they require significant computing resources, are difficult to scale, and struggle with complex attack methods like code execution attacks and Return-oriented Programming (RoP) attacks, and centralized approaches are inefficient in responding to distributed device swarms.
Innovation Solution
A method and apparatus using swarm intelligence, specifically Ant Colony Optimization (ACO), where exploration ants detect and identify malicious devices by traversing device swarms, updating pheromone trail values, and aggregating local information to determine optimal solutions, allowing for efficient detection and isolation of malicious devices with reduced computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional device security evaluation techniques are used to verify device integrity, then security verification can be performed, but computing resources and time are excessively consumed
Solution Approach 1:
The patent segments the device verification process into multiple components: generating verification data from specific memory regions (code memory, data memory, stack, heap), creating hash values for each segment, and combining them into composite verification data. This segmentation allows distributed verification across multiple devices rather than centralized processing, reducing individual device computational burden while maintaining security reliability.
2Adaptability or versatility
If centralized trusted server verification is implemented for large-scale device swarms, then security management is centralized, but the system cannot efficiently respond to distributed device swarms and scales poorly
Solution Approach 1:
The patent merges verification capabilities across multiple devices by having each device verify composite verification data generated by other devices. Devices combine their individual verification results to reach consensus on device legitimacy. This distributed merging approach enables the system to scale to large device swarms while maintaining efficient response times, as verification is performed locally rather than requiring centralized server processing for each device.
3Device complexity
If simple code memory verification techniques are used, then verification process is simple, but the techniques cannot detect complex attacks like code execution attacks on data memory and Return-oriented Programming (RoP) attacks
Solution Approach 1:
The patent implements a universal verification mechanism that handles multiple attack vectors through a single comprehensive approach. The verification process universally covers code memory, data memory, stack, and heap regions, creating composite verification data that detects various attack types including code execution attacks, RoP attacks, and other malicious modifications. This multi-functional verification approach maintains relatively simple device-level operations while achieving comprehensive security coverage.
Data Source
AI summary
Disclosed herein are an apparatus and method for detecting a malicious device based on swarm intelligence. The method includes detecting a malicious device by causing at least one exploration ant to access a device swarm along movement routes in which pheromone trail values are taken into consideration, wherein the exploration ant is generated in response to a detection request received from a security management server, when the at least one exploration ant detects a suspicious device that is suspected to be a malicious device, causing the exploration ant to return along the movement routes in reverse order, and returning pheromone trail values generated by devices on the return movement routes to a malicious device detection apparatus, and identifying whether the suspicious device is the malicious device by calculating an optimal solution based on a local information set generated by aggregating the pheromone trail values returned for movement routes.