# A Lightweight Moving Target Defense Framework for Multi-purpose Malware Affecting IoT Devices

arXiv: https://arxiv.org/abs/2210.07719 · HTML: https://mlsanity.com/paper/2210.07719/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 12 references that are in the map.
- First posted on arXiv 14 Oct 2022.

## Builds on (most cited first, 1 of 1)

- [A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets](https://mlsanity.com/paper/2008.03343/) (2020)

## Built on by (most cited first, 2 of 2)

- [RL and Fingerprinting to Select Moving Target Defense Mechanisms for Zero-day Attacks in IoT](https://mlsanity.com/paper/2212.14647/) (2022)
- [CyberForce: A Federated Reinforcement Learning Framework for Malware Mitigation](https://mlsanity.com/paper/2308.05978/) (2023)

## Abstract (arXiv)

Malware affecting Internet of Things (IoT) devices is rapidly growing due to the relevance of this paradigm in real-world scenarios. Specialized literature has also detected a trend towards multi-purpose malware able to execute different malicious actions such as remote control, data leakage, encryption, or code hiding, among others. Protecting IoT devices against this kind of malware is challenging due to their well-known vulnerabilities and limitation in terms of CPU, memory, and storage. To improve it, the moving target defense (MTD) paradigm was proposed a decade ago and has shown promising results, but there is a lack of IoT MTD solutions dealing with multi-purpose malware. Thus, this work proposes four MTD mechanisms changing IoT devices' network, data, and runtime environment to mitigate multi-purpose malware. Furthermore, it presents a lightweight and IoT-oriented MTD framework to decide what, when, and how the MTD mechanisms are deployed. Finally, the efficiency and effectiveness of the framework and MTD mechanisms are evaluated in a real-world scenario with one IoT spectrum sensor affected by multi-purpose malware.