Airmed：低端设备的高效自愈网络
Airmed: Efficient Self-Healing Network of Low-End Devices
摘要：
特定于应用的网络物理系统的激增，加上对这些系统的各种攻击（恶意软件，如Mirai和Hajime）的出现，强调了保护这些网络的必要性。大多数现有的安全措施仅集中在检测恶意软件的存在上。然而，鉴于大多数攻击一旦感染少数设备就能够通过网络传播，因此必须遏制病毒的传播，同时使用网络的通信能力系统地清理受影响的节点。为此，我们提出了Airmed -一种方法和系统，不仅可以检测物联网节点上应用软件的损坏，还可以使用其邻居进行自我纠正。Airmed的分散机制可以防止自传播恶意软件的传播，也可以用作更新此类物联网设备上的应用程序代码的技术。Airmed的创新之处包括一种新颖的布隆过滤器技术以及硬件支持，以从良性应用程序代码中识别恶意软件程序的位置，自适应自检以提高计算效率，以及统一的随机回退和流签名，用于安全和带宽高效的代码交换以纠正损坏的设备。我们评估Airmed的性能，使用嵌入式系统的安全架构的TrustLite在OMNeT++模拟器。结果表明，Airmed可以扩展到数千台设备，确保整个网络的更新，并且在内部和外部传播模型中可以在10分钟内恢复95%的节点。此外，我们评估内存和通信成本，并表明Airmed是有效的，产生非常低的开销。
英文摘要：
The proliferation of application specific cyber-physical systems coupled with the emergence of a variety of attacks on such systems (malware such as Mirai and Hajime) underlines the need to secure such networks. Most existing security efforts have focused on only detection of the presence of malware. However given the ability of most attacks to spread through the network once they infect a few devices, it is important to contain the spread of a virus and at the same time systematically cleanse the impacted nodes using the communication capabilities of the network. Toward this end, we present Airmed - a method and system to not just detect corruption of the application software on a IoT node, but to self correct itself using its neighbors. Airmed's decentralized mechanisms prevent the spread of self-propagating malware and can also be used as a technique for updating application code on such IoT devices. Among the novelties of Airmed are a novel bloom-filter technique along with hardware support to identify position of the malware program from the benign application code, an adaptive self-check for computational efficiency, and a uniform random-backoff and stream signatures for secure and bandwidth efficient code exchange to correct corrupted devices. We assess the performance of Airmed, using the embedded systems security architecture of TrustLite in the OMNeT++ simulator. The results show that Airmed scales up to thousands of devices, ensures guaranteed update of the entire network, and can recover 95% of the nodes in 10 minutes in both internal and external propagation models. Moreover, we evaluate memory and communication costs and show that Airmed is efficient and incurs very low overhead.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
