PhD position on Characterizing and Detecting IoT Malware

The Centrum voor Veiligheid en Digitalisering (Centre for Safety and Digitalisation, CVD) is a knowledge institute in which companies and public organisations are collaborating on questions related to this theme. In this context, the University of Twente, Saxion University of Applied Sciences, and the Police Academy of the Netherlands are setting up a joint research program around this time. The research program is centered around the 3 focus areas of the CVD: critical data & infrastructure, actionable intelligence and cyberresilience.

For each research line, we are looking for two PhD students to work on this theme. The PhD students will work in a multidisciplinary fashion, in close collaboration with each other, and with the supervision teams with members from the different CVD partners.

About the Project
Internet of Things (IoT) devices have become ubiquitous. While they automate and simplify many aspects of users' lives, recent large-scale attacks have shown that their sheer number poses a severe threat to the Internet infrastructure. In fact, cybercriminals have started to target this new technology for malicious purposes. In particular, we have witnessed the development and spreading of IoT-targeted malware, which infects IoT devices to create botnets and run distributed attacks. Unfortunately, because of the fundamental technological differences of the IoT ecosystem (e.g., low power and limited computational resources), traditional malware analysis and defense approaches are not applicable in this setting.

In this project, we will first design and develop methodologies and tools to understand and characterize IoT malware. This will allow us to depict a comprehensive picture of the current threat landscape and to identify the common properties of this new class of malicious behaviors. Then, we will leverage the obtained knowledge to research novel lightweight approaches to effectively and efficiently detect malware infections in IoT devices, mitigating dangerous attacks. Finally, we will investigate the scenario of supply chain attacks, i.e., malware being injected into third-party libraries that are embedded in the building process of IoT firmware.