In-Memory Shellcode Runner Detection in Internet of Things (IoT) Networks: A Lightweight Behavioral and Semantic...

Area of Science:

• Cybersecurity
• Internet of Things (IoT) Security
• Malware Detection

Background:

• The proliferation of Internet of Things (IoT) devices increases vulnerability to sophisticated cyber threats.
• In-memory shellcode runners pose a significant risk by evading traditional security measures.
• Resource-constrained IoT systems require specialized security solutions.

Purpose of the Study:

• To present a comprehensive framework for detecting in-memory shellcode runners in IoT environments.
• To analyze existing security limitations and challenges in detecting such advanced threats.
• To propose a novel, multi-layered detection approach tailored for IoT networks.

Main Methods:

• Developed a multi-layered detection framework combining entropy-based anomaly scoring and lightweight behavioral monitoring.
• Utilized Graph Neural Network methods for System Call Semantic Graph Analysis.
• Focused on runtime analysis of process memory, system call patterns, and network behavior.

Main Results:

• The proposed framework effectively identifies in-memory attacks by analyzing subtle indicators of compromise.
• Empirical evaluation against simulated and real-world IoT attacks demonstrated the approach's efficiency.
• Identified specific challenges in implementing the detection framework in dynamic environments.

Conclusions:

• The developed framework offers a crucial advancement in securing IoT environments against in-memory shellcode runner attacks.
• Runtime analysis of memory, system calls, and network behavior is vital for detecting fileless malware.
• Further research is needed to address implementation challenges and optimize performance.