HSESR: Hierarchical Software Execution State Representation for Ultra-Low-Latency Threat Alerting over Internet of Things

To reduce attack risks in Internet of Things (IoT), many security vendors conduct software security analysis on IoT devices all the time. However, how to build an ultra-low-latency threat alerting strategy using software vulnerability information still faces challenges. Firstly, existing terminal threat detection methods for IoT systems relying on Indicators of Compromise (IoC) threat intelligence can only cover limited software vulnerabilities so the alert validity rate is still very low. Secondly, most users lack security knowledge and cannot proactively distinguish high-risk vulnerabilities, resulting in untimely reporting. In this paper, a novel hierarchical software execution state representation (HSESR) scheme is proposed for ultra-low latency threat alerting over IoT systems based on Beyond 5G. In HSESR, function call graphs are recorded and delivered to edge servers for swiftly identifying suspicious threat behaviors based on deep graph representation, while corresponding instruction sequences are delivered to the cloud data center for further matching the vulnerability information via recurrent semantic representation. To improve the effectiveness of HSESR, the graph representation is also actively encapsulated into the corresponding semantic representation, together acting as an implicit threat behavior signature, which is essential to associate with a security patch. Moreover, to accelerate the detection of suspicious behaviors, we also propose a deep reinforcement learning-based graph searching (DRL-GS) strategy to crop the huge function call graph of the entire software to timely report high-risk threat behaviors with minimized resource consumption. By instancing 1-day attacks on a simulated B5G-IoT system, the performance of HSESR is trustfully competitive against existing baselines, and the efficiency of threat detection was increased by 21.63%.