IoT plays an important role in daily life; commands and data transfer rapidly between the servers and objects to provide services. However, cyber threats have become a critical factor, especially for IoT servers. There should be a vigorous way to protect the network infrastructures from various attacks. IDS (Intrusion Detection System) is the invisible guardian for IoT servers. Many machine learning methods have been applied in IDS. However, there is a need to improve the IDS system for both accuracy and performance. Deep learning is a promising technique that has been used in many areas, including pattern recognition, natural language processing, etc. The deep learning reveals more potential than traditional machine learning methods. In this paper, sequential model is the key point, and new methods are proposed by the features of the model. The model can collect features from the network layer via tcpdump packets and application layer via system routines. Text-CNN and GRU methods are chosen because the can treat sequential data as a language model. The advantage compared with the traditional methods is that they can extract more features from the data and the experiments show that the deep learning methods have higher F1-score. We conclude that the sequential model-based intrusion detection system using deep learning method can contribute to the security of the IoT servers.

With the continuous advancement of machine learning, numerous malware detection methods that leverage this technology have emerged, presenting new challenges to the generation of adversarial malware. Existing function-preserving adversarial attacks fall short of effectively modifying portable executable (PE) malware control flow graphs (CFGs), thereby failing to bypass the graph neural network (GNN) models that utilize CFGs for detection. To solve this issue, we introduce a novel base modification method called active opcode insertion, which modifies PE CFGs while preserving functionality by inserting a processed sequence of benign and jump opcodes to connect with the original base block. Using reinforcement learning, MalAOI identifies optimal insertion points and benign opcode sequences to autonomously generate adversarial malware that evades GNN model detection. We tested our approach on the BODMAS and SOREL-20M datasets, and the results demonstrate that MalAOI-generated adversarial malware achieves an average evasion rate of 93.73% against the GNN detection model, with only 12.87% increase in byte size.

The Internet of Things (IoT) protocols are a core element of IoT systems, providing the fundamental support for communication and data exchange between devices. These protocols enable various devices to connect and work together. However, potential errors and vulnerabilities in IoT protocol implementations can make devices easily attacked. Therefore, ensuring the security of IoT protocols is of utmost importance. Common vulnerability detection methods, such as fuzzing, encounter significant challenges in assessing these implementations, mainly due to the need for extensive protocol knowledge, high time and resource consumption, as well as the difficulty of generating high-quality and targeted test cases.In order to solve the above issues, this paper presents an intelligent fuzzer, LIPFuzzer, for testing IoT protocols. Unlike common methods that heavily rely on the user's understanding of the protocol to generate test cases, LIPFuzzer, with the assistance of Large Language Models (LLMs), mutates real IoT protocol communication messages to automatically generate more targeted test cases. Specifically, it utilizes LLMs to understand the relative knowledge of protocols, analyze different categories of protocol messages, and identify recommended mutation fields in combination with the characteristics of IoT protocols, providing targeted mutation strategies for each category. In addition, we evaluate LIPFuzzer on several widely-used implementations of well-known IoT protocols (e.g. Modbus-TCP, MQTT, and CoAP). Experimental results indicate that, compared to widely-used protocol fuzzers such as Peach, LIPFuzzer generates test cases more conveniently and efficiently, while also discovering vulnerabilities more effectively.