Stealthy Rootkits vs Low-Power IoT Devices: A Process-level Colonel Blotto Game

Kernel-level rootkits are considered stealthy malware versions that can target Internet of Things (IoT) devices as part of large-scale Advanced Persistent Threats. These can gain root privileges and easily hide their attack traces within the system. Several rootkit detection approaches have been proposed, but they lack the consideration of power resource limitation on battery-based edge devices. To address these limitations, this paper models the interaction between stealthy malware and the device’s anomaly detection algorithm as a Colonel Blotto game in order to produce the set of mixed strategies that optimize the allocation of security resources dedicated to monitoring kernel-level processes and detecting abnormal system calls while preserving device power. We present the models for both versions of the game, static and dynamic, to reflect a realistic deployment scenario. The preliminary numerical results show that the strategic resource allocation enabled by the proposed game model achieves better security compared to non-strategic scenarios that do not consider the attacker’s resource budget.