Classifying malware variants into their respective families is a key challenge in malware analysis. This task is especially difficult with IoT malware because of code reuse and a variety of instruction set architectures (ISAs). Adversaries often reuse code across malware families through the same library functions, leaked source code, or known exploits. This practice makes it difficult for traditional Machine Learning (ML) classifiers to be reliable for malware classification. Further, IoT malware targets diverse instruction set architectures (ISAs), where differences in opcodes and registers create variations that hinder effective malware analysis. We present Ciao, a tool that uses an architecture-agnostic instruction representation and graph representation learning that captures family-specific logic even under heavy code reuse. Our evaluation of Ciao on a dataset of 9,954 IoT malware samples achieves an accuracy of 98.50%, a macro precision of 99.01%, and a macro recall of 98.94% in malware classification under code reuse, which outperforms existing techniques. Furthermore, in cross-architecture classification, where samples from one architecture are underrepresented, Ciao outperforms a model that uses architecture-specific instruction representation.

Time-Sensitive Networking (TSN) achieves deterministic communication using mechanisms like Time-Aware Shaping, which manages the timing of network traffic streams using a Gate Control List (GCL). The GCL operates according to a cyclic schedule by opening and closing gates for priority (egress) queues in out-bound ports. However, the cyclic schedule in the GCL introduces potential security vulnerabilities to schedule-based attacks. This type of attack exploits TSN’s deterministic schedules to manipulate traffic flow and can impact availability and safety. Traditional intrusion detection systems (IDS) are commonly employed in TSN to detect malicious activities by monitoring traffic patterns and bandwidth usage. However, schedule-based attacks can align malicious packets with legitimate traffic, making the attack more stealthy and harder to detect by rate-based IDS. This paper presents a novel schedule-based attack that synchronizes malicious traffic to exploit predictability in TSN’s GCL schedule. This attack causes an adversarial blocking in which low-priority traffic delays higher-priority traffic without being detected using a rate-based IDS. We demonstrate the feasibility and impact of this schedule-based attack on TSN with off-the-shelf hardware.

Security for real-time systems is increasingly important with the growth of connected real-time systems in safety-critical domains such as automotive, medical, and avionics. A crucial aspect of securing such systems is to understand the attacks that the current techniques cannot effectively safeguard against. Especially relevant are vulnerabilities of real-time systems arising from their rigid temporal guarantees and attacks that exploit such vulnerabilities. Randomization-based defense techniques can reduce side-channel inference, but such techniques are limited due to the strict timing bounds of real-time systems. In this article, we design and analyze NosyNeighbor , an inter-partition side-channel attack that exploits the timing guarantees of real-time systems to infer the timing parameters of a safety-critical task in a hierarchical system. Using an adaptive technique, NosyNeighbor can improve its inference over time and evade randomization-based defense. Experimental results show that NosyNeighbor can infer victim task execution with a precision of roughly 73% under normal system load, and with a recall of about 35% using multiple malicious tasks across partitions. NosyNeighbor is also effective under the common attack model with two malicious tasks in the system, with a precision of 64%.

Time-Sensitive Networking enables deterministic communication in cyber-physical systems using time-aware shapers governed by Gate Control Lists (GCL). Although this mechanism improves reliability, it also introduces vulnerabilities exploitable through schedule-based attacks. We show that, by analyzing traffic patterns, adversaries can estimate GCL parameters and reconstruct the schedule to inject precisely timed traffic. These injections can cause priority inversions, where low-priority flows delay high-priority traffic, degrading latency and schedulability. Such schedule-based attacks are particularly stealthy as conventional Intrusion Detection Systems (IDS) may fail to detect them. We implement this attack and conduct randomized experiments to evaluate the impact on synthetic workloads and on off-the-shelf hardware.

Due to hardware limitations and low cost, manufacturers often overlook security in widely deployed IoT devices, making them susceptible to attacks. Malware is one such attack that can cause extensive damage. In this work, we analyze a large corpus of IoT malware to extract features that emerge from the shared development and logistics in the malware development life cycle (MDLC), which we name operational features. We use these features to formulate a novel operational similarity concept for malware families and variants that complements existing code and behavior analysis.

In a network of mining pools that secure Bitcoin-like blockchains, it is known that a self-interested mining pool can dishonestly siphon off another pool’s mining rewards by executing a block withholding (BWH) attack. In this paper, we show that a BWH attack is always unprofitable for an initial startup period which is at least one difficulty retarget interval (approximately 14 days for Bitcoin). Furthermore, we prove that the payback period to recoup this initial startup cost is always at least as long as the initial unprofitable startup interval, and we show numerically that it can be substantially longer. Thus, the decision of whether or not to execute a BWH attack is not a dominant strategy, and the so called Miner’s Dilemma is not in fact a dilemma.

Arbitrary processor affinities are used in multiprocessor systems to specify the processors on which a task can be scheduled. However, affinity constraints can prevent some high priority real-time tasks from being scheduled, while lower priority tasks execute. This paper presents an implementation and evaluation of the Strong Arbitrary Processor Affinity scheduling on a real-time operating system, an approach that not only respects user-defined affinities, but also supports migration of a higher priority task to allow execution of a task limited by affinity constraints. Results show an improvement in response and turnaround times of higher priority tasks.

Several cyber-physical systems use real-time restart-based embedded systems with the Simplex architecture to provide safety guarantees against system faults. Some approaches have been developed to protect such systems from security violations too, but none of these approaches can prevent an adversary from modifying the operating system or application code to execute an attack that persists even after a reboot. In this work, we present a secure boot mechanism to restore real-time restart-based embedded systems into a secure computing environment after every restart. We analyze the delay introduced by the proposed security feature and present preliminary results to demonstrate the viability of our approach using an open-source bootloader and real-time operating system.