Log2Evt: Constructing high-level events for IoT Systems through log-code execution path correlation

Abstract

The detection of cyberattacks in IoT ecosystems requires comprehensive log auditing across distributed devices, yet the volume and heterogeneity of IoT logs exceed traditional analysis capabilities. Therefore, it is essential to narrow down the scope of forensics precisely and efficiently to target attack-related events. Existing schemes have the disadvantage of low accuracy and flexibility. We propose a novel approach that synthesizes high-level security events from low-level IoT logs by correlating firmware execution traces with runtime call stack contexts. Our approach implements lightweight monitoring probes at critical IoT workflow points and employs an IoT-optimized Common Ancestor algorithm for log sequence analysis. The experiments demonstrate a 15% improvement in accuracy compared to the rule-based matching scheme. Additionally, the results highlight the influence of the threshold parameter and show that the approach has minimal impact on program operation. The approach effectively addresses the challenges of protocol fragmentation and resource constraints in IoT environments, providing a foundation for robust security monitoring in smart city deployments.