Status-based Detection of malicious code in Internet of Things (IoT) devices

We categorize the malicious code in IoT devices, analyze their characters and disassemble them as far as basic actions. Then we simulate these basic malicious code running in the background and show that we indeed can find out the malicious activity of the IoT device by monitoring the runtime of identified service tasks. We choose fluctuation and abrupt change point as our detection features according to the simulation result, then we design and implement our detection system to detect the activity of a web camera. Our result show that malicious code can be detected by monitoring the device's running status.