Mitigating Exploitation Attacks on Linux-Based IoT Devices Through System-Call Hooking

By 2025, the number of Internet of Things devices is projected to reach a staggering 75.44 billion. A significant majority more than 71 % of these devices rely on Linux-based operating systems. The security challenges associated with Linux-based IoT devices are multifaceted (i.e., weak passwords, unpatched software). Traditional intrusion detection systems, designed for more conventional computing environments, struggle to address these unique IoT security concerns due to the resource limitations of IoT devices and the inherent opacity of the IoT framework. To tackle these emerging threats, we introduce VNPTIoTGuard, a robust intrusion detection system. VNPTIoTGuard leverages low-level system information obtained through system-call hooking to identify abnormal behaviors indicative of exploitation attempts. For experiment, we installed VNPTIoTGuard on two distinct IoT devices with similar architectures: the ONT iGate GW020-H and GW040-H (but not limited to commercial IoT devices running on Linux). The results demonstrate that VNPTIoTGuard achieves a high detection rate for infections.