Toward Profiling IoT Processes for Remote Service Attestation
William A. Johnson, John Housley, Sheikh Ghafoor, Stacy Prowell · 2024
The Internet of Things (IoT) is ubiquitous in modern life and is being used very widely in industrial control systems, smart grids, home appliances and many more. IoT devices are used to get information from sensors, process information, and send signals to actuators and controllers. In general these devices form a distributed computing network while in operation. Malware in IoT or any embedded devices is a potential security threat. Detecting malware in such a setting while in operation is non-trivial, because these low power devices may not have the computational ability to perform traditional security operations. Additionally, an infected device may cause other machines to misbehave by interfering with the data they receive. Remote Attestation is a security service designed to detect an infection in a device well before the malware detonates. Recent works have turned their attention to service attestation, or attesting the service that a network provides, rather than the individual devices themselves. Traditional remote attestation schemes use cryptographic hashing algorithms as evidence, but this approach generates exponentially more hashes as heterogeneous IoT devices are added to the network and their jobs’ complexity increases. In this work, we propose an approach to collect the contents of executable virtual memory from an IoT device. We develop a protocol based on our approach that can build a profile of a process running on an IoT device, such evidence can be analyzed automatically with high granularity. We validate our protocol by testing on both a personal computer, and a real-world Industrial IoT device under process injection attacks. Our results show that our protocol will be able to detect small changes to process memory over time, and that an injection as small as one word can be detected and read.