With the exponential rise of internet-connected devices, the number of Internet of Things (IoT) devices has surpassed that of traditional IT devices. This proliferation in IoT adoption can be attributed to the growing demand for manufacturing automation and the desire for enhanced quality of life, leading to the production of smart devices in various industries. However, this rapid adoption has caught the attention of malicious actors, resulting in a significant increase in cyber-attacks targeting IoT devices. In response to this emerging threat landscape, research on IoT security has been active. Nevertheless, the lack of commercial tools specifically designed for IoT device security raises concerns about the ability of security research and adoption to keep pace with the rising number of malicious actors. To address this gap, this study focuses on introducing a novel mechanism for detecting malware in IoT devices. By conducting experiments, we demonstrate that using Hardware Performance Counters (HPCs), complemented by physical features such as power consumption, can improve the current malware detection capabilities. Specifically, we employ Recurrent Neural Networks (RNN) and Multi-Layer Perception Neural Networks (MLP) to achieve a remarkable detection accuracy of 95% within a timeframe of less than 10 seconds from infection.

Abstract Diverse layers of defence play an important role in the design of defence-in-depth architectures. The use of Intrusion Detection Systems (IDSs) are ubiquitous in this design. But the selection of the “right” IDSs in various configurations is an important decision that the security architects need to make. Additionally, the ability of these IDSs to adapt to the evolving threat-landscape also needs to be investigated. To help with these decisions, we need rigorous quantitative analysis. In this paper, we present a diversity analysis of open-source IDSs, Snort and Suricata, to help security architects tune/deploy these IDSs. We analyse two types of diversities in these IDSs; configurational diversity and functional diversity. In the configurational diversity analysis, we investigate the diversity in the sets of rules and the Blacklisted IP Addresses (BIPAs) these IDSs use in their configurations. The functional diversity analysis investigates the differences in alerting behaviours of these IDSs when they analyse real network traffic, and how these differences evolve. The configurational diversity experiment utilises snapshots of the rules and BIPAs collected over a period of 5 months, from May to October 2017. The snapshots have been collected for three different off-the-shelf default configurations of the Snort IDS and the Emerging Threats (ET) configuration of the Suricata IDS. The functional diversity investigates the alerting behaviour of these two IDSs for a sample of the real network traffic collected in the same time window. Analysing the differences in these systems allows us to get insights into where the diversity in the behaviour of these systems comes from, how does it evolve and whether this has any effect on the alerting behaviour of these IDSs. This analysis gives insight to security architects on how they can combine and layer these systems in a defence-in-depth deployment.

Phase-locking in a charge pump (CP) phase lock loop (PLL) is said to be inevitable if all possible states of the CP PLL eventually converge to the equilibrium where the input and output phases are in lock. We verify this property for a CP PLL using a mixed deductive and bounded verification methodology. This involves a positivity check of polynomial inequalities (which is an NP-Hard problem) so we use the sound but incomplete Sum of Squares (SOS) relaxation algorithm to provide a numerical solution.

Phase-locking in a charge pump (CP) phase lock loop (PLL) is said to be inevitable if all possible states of the CP PLL eventually converge to the equilibrium, where the input and output phases are in lock and the node voltages vanish. We verify this property for a CP PLL using deductive verification. We split this complex property into two sub-properties defined in two disjoint subsets of the state space. We deductively verify the first property using multiple Lyapunov certificates for hybrid systems, and use the Escape certificate for the verification of the second property. Construction of deductive certificates involves positivity check of polynomial inequalities (which is an NP-Hard problem), so we use the sound but incomplete Sum of Squares (SOS) relaxation algorithm to provide a numerical solution.

We present a novel mixed time and frequency domain approach to the formal verification of oscillators properties which are specified in the frequency domain. We use robust periodogram specification to specify the oscillator behaviour in the close vicinity of the limit cycle. Using SAT modulo ODE (SMO) for Bounded Model Checking (BMC) of the non-linear hybrid automata, we show that the oscillator hybrid timed traces satisfy frequency domain specifications.