This work explores the application of anomaly detection techniques, specifically one-class support vector machine (SVM) and online change-point detection, to construct a model that can distinguish, in real-time, between the normal operation of an Amazon Alexa Virtual Assistant IoT device from anomalous operation due to malware infections. Despite the current absence of widespread malware for IoT devices, the anticipated rapid growth in deployment and use of IoT devices will likely attract many different malware attacks in the near future. Because of their highly specialized and, hence, predictable expected behavior, malware detection on IoT devices is not difficult given large training sets, long testing vectors, and extensive computational power. The challenge we address in this paper is to ascertain how quickly malware may be detected, i.e., the distribution on the number of system calls before a suitably high confidence decision may be made.

The Internet of Things (IoT) introduced new targets and attack vectors for malicious actors who infect insecure devices with malware in order to form large botnets that can launch distributed denial of service (DDoS) attacks. These botnets comprise various infected devices such as Internet-connected cameras and home routers. This paper focuses on the unsolved problem of creating robust malware detection to secure home routers. This research compares the effectiveness of three different approaches to behavioral malware detection on home endpoint routers through the observation of kernel-level system calls on these routers: i) principal component analysis (PCA), ii) one-class support vector machines, and iii) a naive anomaly detector based on unseen n-grams.

Safeguarding one’s router has received very little attention despite a plethora of router-specific malware, which has emerged recently. Here, we propose a systematic approach to distinguish a router infected by malware from a healthy router. Our key novelty is that we analyze the behavior of the router, thus not relying on binary signatures (like anti-virus software for computers). Our contribution is two fold. First, we develop a non-trivial emulation capability, to observe the behavior of a router. This capability allows to instantiate a virtual router with or without malware and feed it a pre-recorded data trace. This setup monitors the behavior at multiple layers including: OS system calls, process information, and the network layer. Second, using the emulated environment, we provide initial evidence that a behavior-based method can distinguish between infected and healthy routers. We have collected 820 router-specific malware binaries and an initial set of real data traces. We find that infected routers exhibit:(a) an initial spike and an overall 50% increase in the number of system calls,(b) an initial spike and a modest increase in the number of active processes. Our preliminary work is a promising step towards understanding and securing routers against malware infections.

Smartphone games lack the hardware interface afforded by other gaming media like controllers for consoles, keyboard and mouse for PCs, joysticks and buttons on arcade cabinets, etc. As such, many popular games focus on puzzle mechanics using the touch screen interface, such as Angry Birds[1] or Cut the Rope[2]. We focused on skill-based, reactionary gameplay with an intuitive and unique control scheme in Herbert, where the player moves the character around the world by tilting the device and free oneself from traps by shaking the device. We did this in order to minimize on-screen GUI clutter found in other games such as OMG Pirates![3], Street Fighter IV[4] and Zombieville, USA[5] while retaining the challenge enjoyment, and intuitiveness of skill based gaming. The web version of the game can be played at: https://www.cs.drexel.edu/~amd435/Herbert_Web.html