在物联网 (IoT) 网络中内存外代码运行器检测:一个轻量级的行为和语义分析框架
Jean Rosemond Dora1, Ladislav Hluchý1, Michal Staňo1
1Institute of Informatics, Slovak Academy of Sciences (IISAS), 84507 Bratislava, Slovakia.
Sensors (Basel, Switzerland)
|September 13, 2025
概括
这项研究引入了一个新的框架来检测内存外代码运行器,一种针对物联网设备的恶意软件. 多层次的方法通过分析隐藏威胁的内存和系统调用来增强网络安全.
科学领域:
- 网络安全 网络安全
- 物联网 (IoT) 安全 安全 物联网
- 恶意软件检测 恶意软件检测
背景情况:
- 物联网 (IoT) 设备的扩散增加了对复杂网络威胁的脆弱性.
- 内存贝代码运行者通过规避传统安全措施而构成重大风险.
- 资源有限的物联网系统需要专门的安全解决方案.
研究的目的:
- 为在物联网环境中检测内存外代码运行器提供一个全面的框架.
- 分析现有的安全限制和挑战,以检测这些先进威胁.
- 提出一种针对物联网网络量身定制的新多层检测方法.
主要方法:
- 开发了一个多层检测框架,将基于的异常得分和轻量级行为监测结合起来.
- 利用图形神经网络方法进行系统调用语义图形分析.
- 专注于进程内存的运行时分析,系统调用模式和网络行为.
主要成果:
- 拟议的框架通过分析微妙的妥协指标,有效地识别内存攻击.
- 对模拟和现实世界物联网攻击的实证评估证明了该方法的效率.
- 确定了在动态环境中实施检测框架的具体挑战.
结论:
- 开发的框架为保护物联网环境免受内存外代码运行器攻击提供了关键的进步.
- 运行时分析内存,系统调用和网络行为对于检测无文件恶意软件至关重要.
- 需要进一步的研究来应对实施挑战并优化性能.
相关概念视频
Leaky Scanning
5.6K
During most eukaryotic translation processes, the small 40S ribosome subunit scans an mRNA from its 5' end until it encounters the first start AUG codon. The large 60S ribosomal subunit then joins the smaller one to initiate protein synthesis. The location of the translation initiation is largely determined by the nucleotides near the start codon as there may be multiple translation initiation sites present on the mRNA. Marilyn Kozak discovered that the sequence RCCAUGG (where R...
5.6K
Machines
557
Machines are complex structures consisting of movable, pin-connected multi-force members that work together to transmit forces. One example of a machine is the cutting plier, which is used to cut wires by applying forces to its handles. When equal and opposite forces are exerted on the handles of the cutting plier, they cause the cutting edges to come together and apply equal and opposite reaction forces on the wire, which are greater than the applied forces.
A free-body diagram of the...
A free-body diagram of the...
557
Machines: Problem Solving II
648
Machines are complex structures consisting of movable, pin-connected multi-force members that work together to transmit forces. Consider a lifting tong carrying a 100 kg load. It comprises movable sections DAF and CBG linked together with member AB.
648
Types of Errors: Detection and Minimization
10.2K
Error is the deviation of the obtained result from the true, expected value or the estimated central value. Errors are expressed in absolute or relative terms.
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
Absolute error in a measurement is the numerical difference from the true or central value. Relative error is the ratio between absolute error and the true or central value, expressed as a percentage.
Errors can be classified by source, magnitude, and sign. There are three types of errors: systematic, random, and gross.
Systematic or...
10.2K
Mass Analyzers: Overview
1.6K
The mass analyzer is a crucial component of the mass spectrometer. In the ionization chamber, the vaporized sample is bombarded with a high-energy electron beam to generate a radical cation and further fragment into neutral molecules, radicals, and cations. A series of negatively charged accelerator plates accelerate the cations into the mass analyzer. The mass analyzer separates ions according to their mass-to-charge (m/z) ratios and then directs them to the detector. The common types of mass...
1.6K
Mass Analyzers: Common Types
1.4K
The quadrupole mass analyzer consists of four cylindrical metal rods arranged in a diamond carrying a DC voltage and a radio-frequency AC voltage. The motion of ions through the quadrupole depends on the field strength, causing only ions of a certain m/z to resonate successfully and strike the detector at a given field strength. Though the transmission rate for these analyzers is high, the exact elemental composition of the sample is not determined because of low resolution; however, they are...
1.4K
