Logo image
Back
calBERT: Securing Routers Serving IoT Networks using Contrastive Augmented Learning
Conference proceeding   Open access

calBERT: Securing Routers Serving IoT Networks using Contrastive Augmented Learning

John Carter, Spiros Mancoridis, Pavlos Protopapas, Brian Mitchell and Benji Lilley
Proceedings of the 6th ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, pp 23-32
23 Jun 2026
DOI: https://doi.org/10.1145/3806008.3811704
Featured in Collection :   Research Supported by Drexel Libraries' OA Programs
url
https://doi.org/10.1145/3806008.3811704View
Published, Version of Record (VoR) Open Access via Drexel Libraries Read and Publish Program 2026 Open CC BY-NC-ND V4.0

Abstract

Security and privacy -- Malware and its mitigation
Previous work on home router security has shown that using system calls to train a transformer-based language model built on a BERT-style encoder using contrastive learning is effective in detecting several types of malware, but the performance remains limited at low false positive rates. In this work, we demonstrate that using a high-fidelity eBPF-based system call sensor, together with the novel introduction of contrastive augmented learning (which introduces controlled mutations of negative samples), improves detection performance, especially at low false positive rates. For example, for one malware pattern described below, detection at a 0.5% target false positive rate increases from 0% in the previous work to 70.56% using our contrastive augmented learning approach. However, for some of the system call results, such as for the stealthy advanced persistent threat (APT) malware, the detection could be improved at the lowest false positive rates examined. To this end, we introduce a novel network packet abstraction language that enables the creation of a pipeline similar to the system call data and show that the introduction of network behavior yields improved performance for network-focused malware at low false positive rates. In more than one case, detection at the lowest false positive rate improves from 0.00% using system calls to 100.00% using network traffic. Lastly, we implement these methods in an online router anomaly detection framework to validate the approach in an Internet of Things (IoT) deployment environment.

Metrics

1 Record Views

Details

Logo image