[Paper Review] HADES-IoT: A Practical Host-Based Anomaly Detection System for IoT Devices (Extended Version)

Dominik Breitenbacher, Ivan Homoliak+3 more|arXiv (Cornell University)|May 3, 2019

Advanced Malware Detection Techniques12 references4 citations

TL;DR

HADES-IoT is a lightweight, host-based anomaly detection system for Linux-based IoT devices that uses system call interception via a loadable kernel module (LKM) to enforce a whitelist of authorized behaviors. It achieves 100% detection accuracy for IoT malware like VPNFilter and IoTReaper with only 5.5% average memory overhead and minimal CPU load, making it practical for resource-constrained environments.

ABSTRACT

Internet of Things (IoT) devices have become ubiquitous and are spread across many application domains including the industry, transportation, healthcare, and households. However, the proliferation of the IoT devices has raised the concerns about their security, especially when observing that many manufacturers focus only on the core functionality of their products due to short time to market and low-cost pressures, while neglecting security aspects. Moreover, it does not exist any established or standardized method for measuring and ensuring the security of IoT devices. Consequently, vulnerabilities are left untreated, allowing attackers to exploit IoT devices for various purposes, such as compromising privacy, recruiting devices into a botnet, or misusing devices to perform cryptocurrency mining. In this paper, we present a practical Host-based Anomaly DEtection System for IoT (HADES-IoT) that represents the last line of defense. HADES-IoT has proactive detection capabilities, provides tamper-proof resistance, and it can be deployed on a wide range of Linux-based IoT devices. The main advantage of HADES-IoT is its low performance overhead, which makes it suitable for the IoT domain, where state-of-the-art approaches cannot be applied due to their high-performance demands. We deployed HADES-IoT on seven IoT devices to evaluate its effectiveness and performance overhead. Our experiments show that HADES-IoT achieved 100% effectiveness in the detection of current IoT malware such as VPNFilter and IoTReaper; while on average, requiring only 5.5% of available memory and causing only a low CPU load.

Motivation & Objective

• To address the growing security risks in IoT devices due to poor security practices and lack of standardized security measurement.
• To develop a practical intrusion detection system that operates efficiently on resource-constrained IoT devices.
• To provide proactive detection and tamper-proof resistance for IoT systems using host-based behavioral analysis.
• To minimize performance overhead while maintaining high detection accuracy for real-world IoT malware.

Proposed method

• HADES-IoT uses a loadable kernel module (LKM) to intercept system calls at the kernel level, enabling low-level control over user-space program execution.
• It enforces a whitelist of authorized system call sequences derived from normal device operation, blocking any deviation as potentially malicious.
• The system profiles legitimate behavior by monitoring system calls during a one-hour training phase on each device to build a baseline profile.
• The LKM-based architecture ensures that unauthorized binaries cannot execute, providing strong tamper resistance.
• System call monitoring is performed in real time with constant-time lookup for whitelist validation, minimizing CPU overhead.
• The system is designed to be portable and deployable on diverse Linux-based IoT devices without requiring source code or application-level instrumentation.

Experimental results

Research questions

• RQ1 Can a host-based anomaly detection system be built that is both effective and efficient enough for deployment on resource-constrained IoT devices?
• RQ2 How can system call interception via a loadable kernel module be used to achieve real-time, low-overhead anomaly detection in IoT environments?
• RQ3 To what extent can a whitelist-based approach detect known and unknown IoT malware with minimal false positives?
• RQ4 What is the actual performance overhead (CPU and memory) of such a system on real IoT hardware?

Key findings

• HADES-IoT achieved 100% detection effectiveness for five types of IoT malware, including well-known families like VPNFilter and IoTReaper.
• The system required only 5.5% of available memory on average across seven tested IoT devices, demonstrating low memory footprint.
• CPU overhead remained minimal, with performance impact scaling only with the number of spawned processes, not with whitelist size.
• The system could extract an accurate device profile in just one hour of normal operation, enabling quick deployment.
• The LKM-based architecture provided strong tamper resistance, preventing unauthorized execution of binaries.
• The approach is practical for real-world deployment on diverse, low-end IoT devices without requiring source code or kernel recompilation.