Real-Time Operating System (RTOS) has become the main category of embedded systems. It is widely used to support tasks requiring real-time response such as printers and switches. The security of RTOS has been long overlooked as it was running in special environments isolated from attackers. However, with the rapid development of IoT devices, tremendous RTOS devices are connected to the public network. Due to the lack of security mechanisms, these devices are extremely vulnerable to a wide spectrum of attacks. Even worse, the monolithic design of RTOS combines various tasks and services into a single binary, which hinders the current program testing and analysis techniques working on RTOS. In this paper, we propose SFuzz, a novel slice-based fuzzer, to detect security vulnerabilities in RTOS. Our insight is that RTOS usually divides a complicated binary into many separated but single-minded tasks. Each task accomplishes a particular event in a deterministic way and its control flow is usually straightforward and independent. Therefore, we identify such code from the monolithic RTOS binary and synthesize a slice for effective testing. Specifically, SFuzz first identifies functions that handle user input, constructs call graphs that start from callers of these functions, and leverages forward slicing to build the execution tree based on the call graphs and pruning the paths independent of external inputs. Then, it detects and handles roadblocks within the coarse-grain scope that hinder effective fuzzing, such as instructions unrelated to the user input. And then, it conducts coverage-guided fuzzing on these code snippets. Finally, SFuzz leverages forward and backward slicing to track and verify each path constraint and determine whether a bug discovered in the fuzzer is a real vulnerability. SFuzz successfully discovered 77 zero-day bugs on 35 RTOS samples, and 67 of them have been assigned CVE or CNVD IDs. Our empirical evaluation shows that SFuzz outperforms the state-of-the-art tools (e.g., UnicornAFL) on testing RTOS.

Domain-Flux malware is hard to detect because of the variable C&C (Command and Control) domains which were randomly generated by the technique of domain generation algorithm (DGA). In this paper, we propose a Domain-Flux malware detection approach based on DNS failure traffic. The approach fully leverages the behavior of DNS failure traffic to recognize nine features, and then mines the DGA-generated domains by a clustering algorithm and determinable rules. Theoretical analysis and experimental results verify its efficiency with both test dataset and real-world dataset. On the test dataset, our approach can achieve a true positive rate of 99.82% at false positive rate of 0.39%. On the real-world dataset, the approach can also achieve a relatively high precision of 98.3% and find out 197,026 DGA domains by analyzing DNS traffic in campus network for seven days. We found 1213 hosts of Domain-Flux malware existing on campus network, including the known Conficker, Fosniw and several new Domain-Flux malwares that have never been reported before. We classified 197,026 DGA domains and gave the representative generated patterns for a better understanding of the Domain-Flux mechanism.

Traffic characteristics over space and time constitute an important aspect of cellular networks in consideration of resource provision, traffic engineering and system optimization. Despite recent progress in revealing temporal dynamics and spatial inhomogeneity of cellular traffic, limited knowledge about traffic dependence is gained. One of challenges comes from the absence of sustained observations at a network-wide scale. In this paper, we make an analysis on the week-long traffic generated by a large population of users in a city of China, and model traffic dependence along both space and time dimensions. The evaluation results suggest connections between spatio-temporal dependence of cellular traffic and the organization of human lives. Region differences are observed to impact traffic dependence to a great extent. Additionally, interactive knowledge between space and time enhances traffic prediction with a decrease in root-mean-square error of 2.8%~25.2%. We believe that these achievements will benefit multiple research and development areas such as network deploying and simulation researches.

BitTorrent(BT) has emerged as one of the most popular protocols for content sharing in recent years. Most BT applications are network-oblivious which brings great challenges to traffic engineering. As basic input information, network-wide BT traffic distribution is of vital importance for service providers (SP) or carriers to enforce appropriate control policies. Direct online measurement of network-wide BT traffic faces scalability issue, for it requires deploying application identification deep packet inspection (DPI) device on every subject link. In this paper, we propose a novel approach to estimate network-wide BT traffic distribution through combining sFlow and Tracker traffic analysis. Owing to a noticeable increase of BT traffic using random port numbers, sFlow alone is no longer sufficient for BT recognition. We tackle this problem by combining sFlow with information collected from BT tracker's traffic. With assistance of this information, BT samples can be accurately distinguished from other sFlow samples. The efficacy of our approach is evaluated through experiments on backbone links of campus network. Evaluation results show that our approach can reach a high accuracy in network-wide BT traffic estimation.