Internet of Everything (IoE) is a newly emerging trend, especially in homes. Marketing forces toward smart homes are also accelerating the spread of IoE devices in households. An obvious risk of the rapid adoption of these smart devices is that many lack controls for protecting the privacy and security of end users from attacks designed to disrupt lives and incur financial losses. Today the smart home is a system for managing the basic life support processes of both small systems, e.g., commercial, office premises, apartments, cottages, and largely automated complexes, e.g., commercial and industrial complexes. One of the critical tasks to be solved by the concept of a modern smart home is the problem of preventing the usage of IoE resources. Recently, there has been a rapid increase in attacks on consumer IoE devices. Memory corruption vulnerabilities constitute a significant class of vulnerabilities in software security through which attackers can gain control of an entire system. Numerous memory corruption vulnerabilities have been found in IoE firmware already deployed in the consumer market. This paper aims to analyze and explain the resource usage attack and create a low-cost simulation environment to aid in the dynamic analysis of the attack. Further, we perform controlled resource usage attacks while measuring resource consumption on resource-constrained victims' IoE devices, such as CPU and memory utilization. We also build a lightweight algorithm to detect memory usage attacks in the IoE environment. The result shows high efficiency in detecting and mitigating memory usage attacks by detecting when the intruder starts and stops the attack.
翻译:万物互联(IoE)是一项新兴趋势,尤其在家居领域。智能家居市场的营销力量也加速了IoE设备在家庭中的普及。这些智能设备快速普及的一个明显风险是,许多设备缺乏保护终端用户隐私与安全的控制机制,以抵御旨在扰乱生活并造成经济损失的攻击。如今,智能家居不仅用于管理小型系统(如商业办公场所、公寓、别墅)的基本生活支持流程,也用于管理大型自动化综合体(如商业和工业综合体)。现代智能家居概念需解决的关键任务之一,是防止IoE资源被滥用。近期,针对消费类IoE设备的攻击急剧增加。内存损坏漏洞是软件安全中的一类重要漏洞,攻击者可借此获取整个系统的控制权。在已部署于消费市场的IoE固件中,已发现大量内存损坏漏洞。本文旨在分析并解释资源使用攻击,并构建一种低成本仿真环境以辅助攻击的动态分析。此外,我们执行受控的资源使用攻击,同时测量受资源约束的受害IoE设备的资源消耗情况(如CPU和内存利用率)。我们还设计了一种轻量级算法,用于检测IoE环境中的内存使用攻击。结果表明,该算法通过检测攻击者开始和停止攻击的时机,在检测和缓解内存使用攻击方面具有高效性。