{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,24]],"date-time":"2025-10-24T16:43:41Z","timestamp":1761324221602,"version":"3.41.0"},"reference-count":27,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2019,5,31]],"date-time":"2019-05-31T00:00:00Z","timestamp":1559260800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"national key research and development program of China","award":["2018YFB0803400"],"award-info":[{"award-number":["2018YFB0803400"]}]},{"name":"Nature Science Foundation of Jiangsu for Distinguished Young Scientist","award":["BK20170039"],"award-info":[{"award-number":["BK20170039"]}]},{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"crossref","award":["61702283"],"award-info":[{"award-number":["61702283"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"NUPTSF","award":["NY217135"],"award-info":[{"award-number":["NY217135"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Embed. Comput. Syst."],"published-print":{"date-parts":[[2019,5,31]]},"abstract":"<jats:p>As the Industry 4.0 or Internet of Things (IoT) era begins, security plays a key role in the Industry Internet of Things (IIoT) due to various threats, which include escape or Distributed Denial of Service (DDoS) attackers in the virtualization layer and vulnerability exploiters in the device layer. A successful cross-VM escape attack in the virtualization layer combined with cross-layer penetration in the device layer, which we define as an Advanced Persistent Escaper (APE), poses a great threat. Therefore, the development of detection and rejection methods for APEs across multiple layers in IIoT is an open issue. To the best of our knowledge, less effective methods are established, especially for vulnerability exploitation in the virtualization layer and backdoor leverage in the device layer. On the basis of this, we propose Escaper Cops (EscaperCOP), a detection method for cross-VM escapers in the virtualization layer and cross-layer penetrators in the device layer. In particular, a new detection method for guest-to-host escapers is proposed for the virtualization layer. Finally, a novel encryption method based on Identity-based Broadcast Encryption (IBBE) is proposed to protect the critical components in EscaperCOP, detection library, and control command library. To verify our method, experimental tests are performed for a large number of APEs in an IIoT framework. The test results have demonstrated the proposed method is effective with an acceptable level of detection ratio.<\/jats:p>","DOI":"10.1145\/3319615","type":"journal-article","created":{"date-parts":[[2019,6,6]],"date-time":"2019-06-06T12:28:42Z","timestamp":1559824122000},"page":"1-25","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Catching Escapers"],"prefix":"10.1145","volume":"18","author":[{"given":"Le-Tian","family":"Sha","sequence":"first","affiliation":[{"name":"College of Computer, Nanjing University of Posts and Telecommunications, Nanjing, Jiangsu Province, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fu","family":"Xiao","sequence":"additional","affiliation":[{"name":"College of Computer, Nanjing University of Posts and Telecommunications, Jiangsu High Technology Research Key Laboratory for Wireless Sensor Networks, Nanjing, Jiangsu Province, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hai-Ping","family":"Huang","sequence":"additional","affiliation":[{"name":"College of Computer, Nanjing University of Posts and Telecommunications, Jiangsu High Technology Research Key Laboratory for Wireless Sensor Networks, Nanjing, Jiangsu Province, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Chen","sequence":"additional","affiliation":[{"name":"College of Computer, Nanjing University of Posts and Telecommunications, Nanjing, Jiangsu Province, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ru-Chuan","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Computer, Nanjing University of Posts and Telecommunications, Nanjing, Jiangsu Province, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2019,6,5]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"Wikipedia contributors. 2018. Internet of things\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Internet_of_Things.  Wikipedia contributors. 2018. Internet of things\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Internet_of_Things."},{"key":"e_1_2_1_2_1","unstructured":"Wikipedia contributors. 2018. Stuxnet\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Stuxnet.  Wikipedia contributors. 2018. Stuxnet\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Stuxnet."},{"key":"e_1_2_1_3_1","unstructured":"Wikipedia contributors. 2017. Duqu\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Duqu.  Wikipedia contributors. 2017. Duqu\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Duqu."},{"key":"e_1_2_1_4_1","unstructured":"Wikipedia contributors. 2018. Flame (malware)\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Flame_(malware).  Wikipedia contributors. 2018. Flame (malware)\u2014Wikipedia the free encyclopedia. Retrieved from: https:\/\/en.wikipedia.org\/wiki\/Flame_(malware)."},{"key":"e_1_2_1_5_1","unstructured":"TREND MICRO. Understanding the VENOM vulnerability. Retrieved from: http:\/\/blog.trendmicro.com\/understanding-the-venom-vulnerability\/.  TREND MICRO. Understanding the VENOM vulnerability. Retrieved from: http:\/\/blog.trendmicro.com\/understanding-the-venom-vulnerability\/."},{"key":"e_1_2_1_6_1","unstructured":"Common vulnerabilities and exposures {EB\/OL}. University of Houston Libraries Houston Tex. Retrieved from http:\/\/cve.mitre.org\/.  Common vulnerabilities and exposures {EB\/OL}. University of Houston Libraries Houston Tex. Retrieved from http:\/\/cve.mitre.org\/."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1998.674827"},{"key":"e_1_2_1_8_1","volume-title":"Proceedings of the IEEE\/IFIP International Conference on Dependable Systems 8 Networks. 311--316","author":"Song Xiang","year":"2010","unstructured":"Xiang Song , Haibo Chen , and Binyu Zang . 2010 . Why software hangs and what can be done with it . In Proceedings of the IEEE\/IFIP International Conference on Dependable Systems 8 Networks. 311--316 . Xiang Song, Haibo Chen, and Binyu Zang. 2010. Why software hangs and what can be done with it. In Proceedings of the IEEE\/IFIP International Conference on Dependable Systems 8 Networks. 311--316."},{"key":"e_1_2_1_9_1","volume-title":"Proceedings Supplemental","volume":"2009","author":"Skarin Daniel","year":"2009","unstructured":"Daniel Skarin and Johan Karlsson . 2009 . Software mechanisms for tolerating soft errors in an automotive brake-controller . In Proceedings Supplemental Volume of the 2009 IEEE\/IFIP Conference on Dependable Systems and Networks (2009), 34--38. Daniel Skarin and Johan Karlsson. 2009. Software mechanisms for tolerating soft errors in an automotive brake-controller. In Proceedings Supplemental Volume of the 2009 IEEE\/IFIP Conference on Dependable Systems and Networks (2009), 34--38."},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2011.5958225"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.37"},{"volume-title":"Proceedings of the Usenix Security Symposium. 67--82","author":"Molnar David","key":"e_1_2_1_12_1","unstructured":"David Molnar , Cong Li Xue , and David A. Wagner . 2009. Dynamic test generation to find integer bugs in x86 binary Linux programs . In Proceedings of the Usenix Security Symposium. 67--82 . David Molnar, Cong Li Xue, and David A. Wagner. 2009. Dynamic test generation to find integer bugs in x86 binary Linux programs. In Proceedings of the Usenix Security Symposium. 67--82."},{"key":"e_1_2_1_13_1","first-page":"46","article-title":"Identifying and analyzing pointer misuses for sophisticated memory-corruption exploit diagnosis","volume":"47","author":"Zhang Mingwei","year":"2012","unstructured":"Mingwei Zhang , Aravind Prakash , Xiaolei Li , Zhenkai Liang , and Heng Yin . 2012 . Identifying and analyzing pointer misuses for sophisticated memory-corruption exploit diagnosis . Proc. West. Pharmacol. Soc. 47 , 47 (2012), 46 -- 49 . Mingwei Zhang, Aravind Prakash, Xiaolei Li, Zhenkai Liang, and Heng Yin. 2012. Identifying and analyzing pointer misuses for sophisticated memory-corruption exploit diagnosis. Proc. West. Pharmacol. Soc. 47, 47 (2012), 46--49.","journal-title":"Proc. West. Pharmacol. Soc."},{"key":"e_1_2_1_14_1","volume-title":"Symposium on Network and Distributed System Security (NDSS'12)","author":"Dewey David","year":"2012","unstructured":"David Dewey and Jonathon Giffin . 2012 . Static detection of C++ vtable escape vulnerabilities in binary code . In Symposium on Network and Distributed System Security (NDSS'12) . 69--83. David Dewey and Jonathon Giffin. 2012. Static detection of C++ vtable escape vulnerabilities in binary code. In Symposium on Network and Distributed System Security (NDSS'12). 69--83."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2338965.2336769"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of Black Hat USA","author":"Elhage Nelson","year":"2011","unstructured":"Nelson Elhage . 2011 . Virtunoid: A KVM guest-&gt;host privilege escalation exploit . In Proceedings of Black Hat USA 2011. 123--134. Nelson Elhage. 2011. Virtunoid: A KVM guest-&gt;host privilege escalation exploit. In Proceedings of Black Hat USA 2011. 123--134."},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the 25th USENIX Security Symposium. 19--35","author":"Xiao Yuan","year":"2016","unstructured":"Yuan Xiao , Xiaokuan Zhang , Yinqian Zhang , and Radu Teodorescu . 2016 . One bit flips, one cloud flops: Cross-VM row hammer attacks and privilege escalation . In Proceedings of the 25th USENIX Security Symposium. 19--35 . Yuan Xiao, Xiaokuan Zhang, Yinqian Zhang, and Radu Teodorescu. 2016. One bit flips, one cloud flops: Cross-VM row hammer attacks and privilege escalation. In Proceedings of the 25th USENIX Security Symposium. 19--35."},{"volume-title":"Proceedings of the Usenix Workshop on Offensive Technologies. 12--12","author":"Wang Gary","key":"e_1_2_1_18_1","unstructured":"Gary Wang , Zachary J. Estrada , Cuong Pham , Zbigniew Kalbarczyk , and Ravishankar K. Iyer . 2015. Hypervisor introspection: A technique for evading passive virtual machine monitoring . In Proceedings of the Usenix Workshop on Offensive Technologies. 12--12 . Gary Wang, Zachary J. Estrada, Cuong Pham, Zbigniew Kalbarczyk, and Ravishankar K. Iyer. 2015. Hypervisor introspection: A technique for evading passive virtual machine monitoring. In Proceedings of the Usenix Workshop on Offensive Technologies. 12--12."},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of Black Hat","author":"Costin Andrei","year":"2013","unstructured":"Andrei Costin and Jonas Zaddach . 2013 . Embedded devices security and firmware reverse engineering . In Proceedings of Black Hat 2013. 243--254. Andrei Costin and Jonas Zaddach. 2013. Embedded devices security and firmware reverse engineering. In Proceedings of Black Hat 2013. 243--254."},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of the USENIX Security Symposium. 95--110","author":"Costin Andrei","year":"2014","unstructured":"Andrei Costin , Jonas Zaddach , Aur\u00e9lien Francillon , Davide Balzarotti , and Sophia Antipolis . 2014 . A large-scale analysis of the security of embedded firmwares . In Proceedings of the USENIX Security Symposium. 95--110 . Andrei Costin, Jonas Zaddach, Aur\u00e9lien Francillon, Davide Balzarotti, and Sophia Antipolis. 2014. A large-scale analysis of the security of embedded firmwares. In Proceedings of the USENIX Security Symposium. 95--110."},{"key":"e_1_2_1_21_1","volume-title":"Proceedings of Usenix Conference on Offensive Technologies. USENIX Association, 167--181","author":"Maskiewicz Jacob","year":"2014","unstructured":"Jacob Maskiewicz , Benjamin Ellis , James Mouradian , and Hovav Shacham . 2014 . Mouse trap: Exploiting firmware updates in USB peripherals . In Proceedings of Usenix Conference on Offensive Technologies. USENIX Association, 167--181 . Jacob Maskiewicz, Benjamin Ellis, James Mouradian, and Hovav Shacham. 2014. Mouse trap: Exploiting firmware updates in USB peripherals. In Proceedings of Usenix Conference on Offensive Technologies. USENIX Association, 167--181."},{"key":"e_1_2_1_22_1","volume-title":"Proceedings of the Usenix Workshop on Offensive Technologies. 2--2.","author":"Weinmann Ralf Philipp","year":"2012","unstructured":"Ralf Philipp Weinmann . 2012 . Baseband attacks: Remote exploitation of memory corruptions in cellular protocol stacks . In Proceedings of the Usenix Workshop on Offensive Technologies. 2--2. Ralf Philipp Weinmann. 2012. Baseband attacks: Remote exploitation of memory corruptions in cellular protocol stacks. In Proceedings of the Usenix Workshop on Offensive Technologies. 2--2."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1945023.1945039"},{"key":"e_1_2_1_24_1","first-page":"S121","article-title":"Collecting sensitive information from Windows physical memory","volume":"4","author":"Qian Zhao","year":"2009","unstructured":"Zhao Qian and Cao Tianjie . 2009 . Collecting sensitive information from Windows physical memory . J. Comput. 4 , 1 (2009), S121 -- S131 . Zhao Qian and Cao Tianjie. 2009. Collecting sensitive information from Windows physical memory. J. Comput. 4, 1 (2009), S121--S131.","journal-title":"J. Comput."},{"key":"e_1_2_1_25_1","doi-asserted-by":"crossref","first-page":"528","DOI":"10.1109\/TIFS.2015.2503271","article-title":"Fast detection of transformed data leaks","volume":"11","author":"Shu Xiaokui","year":"2015","unstructured":"Xiaokui Shu , Jing Zhang , Danfeng Daphne Yao , and Wu Chun Feng . 2015 . Fast detection of transformed data leaks . IEEE Trans. Inform. Forens. Secur. 11 , 3 (2015), 528 -- 542 . Xiaokui Shu, Jing Zhang, Danfeng Daphne Yao, and Wu Chun Feng. 2015. Fast detection of transformed data leaks. IEEE Trans. Inform. Forens. Secur. 11, 3 (2015), 528--542.","journal-title":"IEEE Trans. Inform. Forens. Secur."},{"key":"e_1_2_1_26_1","first-page":"1","article-title":"Collective data-sanitization for preventing sensitive information inference attacks in social networks","volume":"99","author":"Cai Zhipeng","year":"2016","unstructured":"Zhipeng Cai , Zaobo He , Xin Guan , and Yingshu Li . 2016 . Collective data-sanitization for preventing sensitive information inference attacks in social networks . IEEE Trans. Depend. Secure Comput. PP , 99 (2016), 1 -- 1 . Zhipeng Cai, Zaobo He, Xin Guan, and Yingshu Li. 2016. Collective data-sanitization for preventing sensitive information inference attacks in social networks. IEEE Trans. Depend. Secure Comput. PP, 99 (2016), 1--1.","journal-title":"IEEE Trans. Depend. Secure Comput. PP"},{"volume-title":"Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys","author":"Delerabl\u00e9e C\u00e9cile","key":"e_1_2_1_27_1","unstructured":"C\u00e9cile Delerabl\u00e9e . 2007. Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys . Springer Berlin Heidelberg , 200--215. C\u00e9cile Delerabl\u00e9e. 2007. Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys. Springer Berlin Heidelberg, 200--215."}],"container-title":["ACM Transactions on Embedded Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319615","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3319615","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:54:34Z","timestamp":1750204474000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3319615"}},"subtitle":["A Detection Method for Advanced Persistent Escapers in Industry Internet of Things Based on Identity-based Broadcast Encryption (IBBE)"],"short-title":[],"issued":{"date-parts":[[2019,5,31]]},"references-count":27,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2019,5,31]]}},"alternative-id":["10.1145\/3319615"],"URL":"https:\/\/doi.org\/10.1145\/3319615","relation":{},"ISSN":["1539-9087","1558-3465"],"issn-type":[{"type":"print","value":"1539-9087"},{"type":"electronic","value":"1558-3465"}],"subject":[],"published":{"date-parts":[[2019,5,31]]},"assertion":[{"value":"2018-02-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-02-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2019-06-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}