Exploiting Java Stack Forensics for Runtime Monitoring of IoT Services

Internet of Things (IoT) services play an increasingly important role in modern society with the more deployment in critical infrastructures. Ensuring IoT systems operating in a secure and safe environment is becoming a mandatory and urgent requirement. We have proposed a non-intrusive runtime monitoring mechanism in our previous work, but only runtime of C applications is considered in it. With the widely use of Java applications, the runtime monitoring of Java services is quite essential and important. However, the existing memory forensics on user processes are mainly focused on native stack of C or Java heap, which cannot meet the requirements of runtime monitoring of IoT services. In this paper, We propose an approach to dump and semantically reconstruct a Java stack, where a history of executed methods is obtained. We show the algorithms to extract methods in calling and the associated parameters, which are further encapsulated to be IoT events in XML format for runtime monitoring of IoT services, from Java stacks. The challenge of determining whether a stack frame is interpreted or compiled when reconstruct frames from the bottom to the top of the stack is solved. Experiments and evaluations show that the reconstruction is feasible and effective, with low resource occupation and real-time responses.