Marco Martalò

Malware targeting Linux and Internet-of-Things (IoT) systems has grown into a severe threat; however, a significant gap remains in the maturity of defensive tools compared to those available for Windows ecosystems. Current approaches either rely on full-system virtualization through Virtual Machine sandboxes, which incur high overhead and limited scalability, or lightweight tracing tools that provide insufficient behavioral visibility. To address this gap, we present Emulix, a scalable dynamic analysis framework based on lightweight user-space emulation, which enables the analysis of Linux and IoT malware across multiple architectures, including x86, ARM, and MIPS platforms. Emulix avoids the heavy overhead of full system virtualization, providing at the same time deep runtime artifacts (including system and API call tracing, network traffic interception, and targeted memory extraction) while maintaining high resource efficiency through containerization. We evaluated Emulix using a three-tier methodology. A large-scale analysis of 3,536 IoT malware samples demonstrated a 70.7% successful execution rate with an average processing time of 45.25 seconds per sample, with behavioral artifacts successfully recorded for 92.02% of the corpus regardless of termination status, as Emulix continues capturing system calls, network traffic, and memory snapshots up to the point of any execution halt. Subsequent event-driven extraction and the case study show that Emulix successfully overcomes the critical limitations of standard emulation, effectively reducing the behavioral omission rate of vanilla Qiling by 98.38%. Furthermore, as a secondary outcome, Emulix's event-driven memory dumping successfully extracts obfuscated artifacts and Command-and-Control (C&C) indicators from packed malware, achieving a 99.04% improvement in artifact recovery compared to traditional static analysis. With these results, Emulix effectively bridges the gap between scalable multi-architecture support and fine-grained behavioral analysis, enabling reliable large-scale Linux malware analysis.

Secure and low-latency data exchange is gaining more and more attention in Internet of Things (IoT) applications. To achieve such stringent requirements, we propose to combine persistent connections and TLS session ticket resumption, as in WebSocket (WS) and QUIC, respectively. Considering the nodes of an IoT cluster as a single virtual entity, we propose to integrate an innovative network management strategy, which employs a publish-subscribe (Pub/Sub) architecture based on the Message Queuing Telemetry Transport (MQTT) protocol, for TLS session tickets sharing between cluster nodes to mitigate the session initialization latency. The proposed system is referred to as WS over QUIC and MQTT (WSQM) and its performance is experimentally assessed with IoT-compliant devices. Our results show that WSQM reduces the latency if compared with similar alternatives that rely on Transmission Control Protocol (TCP) and Transport Layer Security (TLS), as well as other QUIC-based protocols such as the HyperText Transfer Protocol version 3 (HTTP/3). Moreover, WSQM achieves minimal resource utilization in terms of percentage of RAM and CPU usage, thus highlighting its ability to meet the critical requirements of IoT applications.

The upcoming deployment of sixth-generation (6G) wireless networks promises to significantly outperform 5G in terms of data rates, spectral efficiency, device densities, and, most importantly, latency and security. To cope with the increasingly complex network traffic, Network Traffic Classification (NTC) will be essential to ensure the high performance and security of a network, which is necessary for advanced applications. This is particularly relevant in the Internet of Things (IoT), where resource-constrained platforms at the edge must manage tasks like traffic analysis and threat detection. In this context, balancing classification accuracy with computational efficiency is key to enabling practical, real-world deployments. Traditional payload-based and packet inspection methods are based on the identification of relevant patterns and fields in the packet content. However, such methods are nowadays limited by the rise of encrypted communications. To this end, the research community has turned its attention to statistical analysis and Machine Learning (ML). In particular, Convolutional Neural Networks (CNNs) are gaining momentum in the research community for ML-based NTC leveraging statistical analysis of flow characteristics. Therefore, this paper addresses CNN-based NTC in the presence of encrypted communications generated by the rising Quick UDP Internet Connections (QUIC) protocol. Different models are presented, and their performance is assessed to show the trade-off between classification accuracy and CNN complexity. In particular, our results show that even simple and low-complexity CNN architectures can achieve almost 92% accuracy with a very low-complexity architecture when compared to baseline architectures documented in the existing literature.

The rapid proliferation of IoT devices necessitates robust security measures to protect against malicious traffic. Anomaly detection, primarily through traffic classification supported by artificial intelligence and machine learning techniques, has emerged as a practical approach to enhancing IoT network security. Effective traffic classification requires efficient feature selection, which is critical for resource-constrained IoT devices with limited computational power, memory, and energy. This study proposes Statistical Moments Difference Thresholding, a feature selection method leveraging statistical central moments to identify significant features distinguishing between legitimate and malicious traffic. The aim is to reduce feature dimensionality while maintaining high detection accuracy. Validated on the MQTTset dataset through binary and multiclass classification using seven ML algorithms, the results highlight its ability to enhance computational efficiency without compromising performance, showcasing its potential in real-world IoT security applications.

In this paper, the experimental results on microphone virtualization in realistic automotive scenarios are presented. A Temporal Convolutional Network (TCN) was designed in order to estimate the acoustic signal at the driver’s ear positions based on the knowledge of monitoring microphone signals at different positions—a technique known as virtual microphone. An experimental setup was implemented on a popular B-segment car to acquire the acoustic field within the cabin while running on smooth asphalt at variable speeds. In order to test the potentiality of the TCN, microphone signals were recorded in two different scenarios, either with or without the front passenger. Our experimental results show that, when training is performed in both scenarios, the adopted TCN is able to robustly adapt to different conditions and guarantee a good average performance. Furthermore, an investigation on the parameters of the Neural Network (NN) that guarantee the sufficient accuracy of the estimation of the virtual microphone signals while maintaining a low computational complexity is presented.

The last years have been characterized by strong market exploitation of the Internet of Things (IoT) technologies in different application domains, such as Industry 4.0, smart cities, and eHealth. All the relevant solutions should properly address the security issues to ensure that sensor data and actuators are not under the control of malicious entities. Additionally, many applications should at the same time provide low-latency communications, as in the case for instance of remote control of industrial robots. Low latency and security are two of the most important challenges to be addressed for the successful deployment of IoT applications. These issues have been analyzed by several scientific papers and surveys that appeared in the last decade. However, few of them consider the two challenges jointly. Moreover, the security aspects are primarily investigated only in specific application domains or protocol levels and the latency issues are typically investigated only at low layers (e.g., physical, access). This paper addresses this shortcoming and provides a systematic review of state-of-the-art solutions for providing fast and secure IoT communications. Although the two requirements may appear to be in contrast to each other, we investigate possible integrated solutions that minimize device connection and service provisioning. We follow an approach where the proposals are reviewed by grouping them based on the reference architectural layer, i.e., access, network, and application layers. We also review the works that propose promising solutions that rely on the exploitation of the QUIC protocol at the higher levels of the protocol stack.

The Internet of Things (IoT) has revolutionized the world, connecting billions of devices that offer assistance in various aspects of users’ daily lives. Context-aware IoT applications exploit real-time environmental, user-specific, or situational data to dynamically adapt to users’ needs, offering tailored experiences. In particular, Location-Based Services (LBS) exploit geographical information to adapt to environmental settings or provide recommendations based on users’ and nodes’ positions, thus delivering efficient and personalized services. To this end, there is growing interest in developing IoT localization systems within the scientific community. In addition, due to the sensitivity and privacy inherent to precise location information, LBS introduce new security challenges. To ensure a more secure and trustworthy system, researchers are studying how to prevent vulnerabilities and mitigate risks from the early design stages of LBS-empowered IoT applications. The goal of this study is to carry out an in-depth examination of localization techniques for IoT, with an emphasis on both the signal-processing design and security aspects. The investigation focuses primarily on active radio localization techniques, classifying them into range-based and range-free algorithms, while also exploring hybrid approaches. Next, security considerations are explored in depth, examining the main attacks for each localization technique and linking them to the most interesting solutions proposed in the literature. By highlighting advances, analyzing challenges, and providing solutions, the survey aims to guide researchers in navigating the complex IoT localization landscape.

In this article, hybrid radio/inertial mobile target tracking for accurate and smooth path estimation is considered. The proposed tracking approach builds upon an ultra wideband (UWB)-based positioning algorithm, based on the linear hyperbolic positioning system (LinHPS), with Time-Difference-of-Arrival (TDoA) processing and anchors concentrated on a single hotspot at the center of the environment where the target moves. First, we design an adaptive radio-based extended Kalman filter (AREKF), which does not require a priori statistical knowledge of the noise in the target movement model and estimates the measurement noise covariance, at each sampling time, according to a proper lookup table (LUT). In order to improve the performance of AREKF, we incorporate inertial data collected from the target and propose three “hybrid” radio/inertial algorithms, denoted as hybrid inertial measurement unit (IMU)-aided radio-based EKF (HIREKF), hybrid noisy control EKF (HNCEKF), and hybrid control EKF (HCEKF). Our results on experimentally acquired paths show that the proposed algorithms achieve an average instantaneous position estimation error on the order of a few centimeters. Moreover, the minimum target path length estimation error, obtained with HCEKF, is on the order of 6% and 1% for two paths with lengths equal to approximately 17 and 46 m, respectively.