TRUSTCHECKPOINTS: Time Betrays Malware for Unconditional Software Root of Trust

• URL: http://arxiv.org/abs/2509.22762v1
• Date: Fri, 26 Sep 2025 14:27:48 GMT
• Title: TRUSTCHECKPOINTS: Time Betrays Malware for Unconditional Software Root of Trust
• Abstract summary: Current approaches to establish a root of trust depend on secret keys and/or specialized secure hardware.<n> TRUSTCHECKPOINTS is the first system to establish an unconditional software root of trust based on a formal model.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Modern IoT and embedded platforms must start execution from a known trusted state to thwart malware, ensure secure firmware updates, and protect critical infrastructure. Current approaches to establish a root of trust depend on secret keys and/or specialized secure hardware, which drives up costs, may involve third parties, adds operational complexity, and relies on assumptions about an attacker's computational power. In contrast, TRUSTCHECKPOINTS is the first system to establish an unconditional software root of trust based on a formal model without relying on secrets or trusted hardware. Developers capture a full-system checkpoint and later roll back to it and prove this to an external verifier. The verifier issues timing-constrained, randomized k-independent polynomial challenges (via Horner's rule) that repeatedly scan the fast on-chip memory in randomized passes. When malicious code attempts to persist, it must swap into slower, unchecked off-chip storage, causing a detectable timing delay. Our prototype for a commodity ARM Cortex-A53-based platform validates 192 KB of SRAM in approximately 10 s using 500 passes, sufficient to detect single-instruction persistent malware. The prototype then seamlessly extends trust to DRAM. Two modes (fast SRAM-bootstrap and comprehensive full-memory scan) allow trade-offs between speed and coverage, demonstrating reliable malware detection on unmodified hardware.

Related papers

• TroPUF: Evaluating Hardware Trojan Insertion in Delay-Based Physical Unclonable Functions [0.5156484100374058]
  Delay-based Physical Unclonable Functions (PUFs) are commonly used for device authentication and key generation.<n>The act of embedding hardware Trojans directly inside the PUF primitive presents a unique security risk that is not yet well understood.
  arXiv  Detail & Related papers  (2026-07-26T02:33:49Z)
• QUACK! Making the (Rubber) Ducky Talk: A Systematic Study of Keystroke Dynamics for HID Injection Detection [60.105690843777666]
  We show that robust, privacy-preserving detection is achievable using lightweight models operating solely on timing features.<n>Our analysis reveals that attacker sophistication does not monotonically translate into improved evasion.
  arXiv  Detail & Related papers  (2026-04-17T08:53:24Z)
• Towards Remote Attestation of Microarchitectural Attacks: The Case of Rowhammer [15.327433995073237]
  HammerWatch is a Rowhammer-aware remote attestation protocol that enables an external verifier to assess whether a system exhibits hardware-induced disturbance behavior.<n>We implement HammerWatch on commodity hardware and evaluate it on 20000 simulated benign and malicious access patterns.<n>Our results show that the verifier reliably distinguishes Rowhammer-like behavior from benign operation under conservative Activations.
  arXiv  Detail & Related papers  (2026-03-25T10:42:08Z)
• Detecting Object Tracking Failure via Sequential Hypothesis Testing [80.7891291021747]
  Real-time online object tracking in videos constitutes a core task in computer vision.<n>We propose interpreting object tracking as a sequential hypothesis test, wherein evidence for or against tracking failures is gradually accumulated over time.<n>We propose both supervised and unsupervised variants by leveraging either ground-truth or solely internal tracking information.
  arXiv  Detail & Related papers  (2026-02-13T14:57:15Z)
• FAARM: Firmware Attestation and Authentication Framework for Mali GPUs [0.463928297802265]
  Recent work has revealed MOLE, the first practical attack to compromise GPU Trusted Execution Environments (TEEs)<n>This paper presents FAARM, a lightweight and cryptographic framework that prevents MOLE-style firmware subversion.<n>FAARM reliably detects and blocks malicious firmware injections, rejecting tampered images before use and denying attempts after attestation.
  arXiv  Detail & Related papers  (2025-10-26T07:46:27Z)
• Threat Modeling for Enhancing Security of IoT Audio Classification Devices under a Secure Protocols Framework [0.22369578015657954]
  We present a security protocol that treats the edge device, cellular network and cloud as three separate trust domains.<n>A STRIDE-driven threat model and attack-tree analysis guide the design.<n>Data in transit is protected by TLS 1.3 and hybridised with Kyber and Dilithium to provide post-quantum resilience.
  arXiv  Detail & Related papers  (2025-09-18T06:25:50Z)
• RX-INT: A Kernel Engine for Real-Time Detection and Analysis of In-Memory Threats [0.0]
  We present RX-INT, a kernel-assisted system featuring an architecture that provides resilience against TOCTOU attacks.<n> RX-INT introduces a detection engine that combines a real-time thread creation monitor with a stateful Virtual Address Descriptor (VAD) scanner.<n>In our evaluation, RX-INT successfully detected a manually mapped region that was not identified by PE-sieve.
  arXiv  Detail & Related papers  (2025-08-05T19:43:25Z)
• Detecting Hardware Trojans in Microprocessors via Hardware Error Correction Code-based Modules [49.1574468325115]
  Hardware Trojans (HTs) enable attackers to execute unauthorized software or gain illicit access to privileged operations.<n>This manuscript introduces a hardware-based methodology for detecting runtime HT activations using Error Correction Codes (ECCs) on a RISC-V microprocessor.
  arXiv  Detail & Related papers  (2025-06-18T12:37:14Z)
• CRAFT: Characterizing and Root-Causing Fault Injection Threats at Pre-Silicon [3.6158033114580674]
  Fault injection attacks pose significant security threats to embedded systems.<n>Early detection and understanding of how physical faults propagate to system-level behavior are essential to safeguarding cyberinfrastructure.<n>This work introduces CRAFT, a framework that combines pre-silicon analysis with post-silicon validation to systematically uncover and analyze fault injection vulnerabilities.
  arXiv  Detail & Related papers  (2025-03-05T20:17:46Z)
• Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity [2.900892566337075]
  Kernel rootkits enable stealthy operation and are thus difficult to detect.<n>Existing detection approaches rely on signatures that are unable to detect novel rootkits or require domain knowledge about the rootkits to be detected.<n>Our framework injects probes into the kernel to measure time stamps of functions within relevant system calls, computes distributions of function execution times, and uses statistical tests to detect time shifts.<n>The evaluation of our open-source implementation on publicly available data sets indicates high detection accuracy with an F1 score of 98.7% across five scenarios with varying system states.
  arXiv  Detail & Related papers  (2025-03-04T08:43:38Z)
• Beyond Random Inputs: A Novel ML-Based Hardware Fuzzing [16.22481369547266]
  Hardware fuzzing is an effective approach to exploring and detecting security vulnerabilities in large-scale designs like modern processors. We propose a novel ML-based hardware fuzzer, ChatFuzz, to address this challenge. ChatFuzz achieves condition coverage rate of 75% in just 52 minutes compared to a state-of-the-art fuzzer.
  arXiv  Detail & Related papers  (2024-04-10T09:28:54Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• Evil from Within: Machine Learning Backdoors through Hardware Trojans [51.81518799463544]
  Backdoors pose a serious threat to machine learning, as they can compromise the integrity of security-critical systems, such as self-driving cars.<n>We introduce a backdoor attack that completely resides within a common hardware accelerator for machine learning.<n>We demonstrate the practical feasibility of our attack by implanting our hardware trojan into the Xilinx Vitis AI DPU.
  arXiv  Detail & Related papers  (2023-04-17T16:24:48Z)
• DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness [58.23214712926585]
  We develop a certified defense, DRSM (De-Randomized Smoothed MalConv), by redesigning the de-randomized smoothing technique for the domain of malware detection. Specifically, we propose a window ablation scheme to provably limit the impact of adversarial bytes while maximally preserving local structures of the executables. We are the first to offer certified robustness in the realm of static detection of malware executables.
  arXiv  Detail & Related papers  (2023-03-20T17:25:22Z)
• Mate! Are You Really Aware? An Explainability-Guided Testing Framework for Robustness of Malware Detectors [49.34155921877441]
  We propose an explainability-guided and model-agnostic testing framework for robustness of malware detectors. We then use this framework to test several state-of-the-art malware detectors' abilities to detect manipulated malware. Our findings shed light on the limitations of current malware detectors, as well as how they can be improved.
  arXiv  Detail & Related papers  (2021-11-19T08:02:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.