System and method for performing on-cloud memory analysis, forensic and security operations on connected devices

1. A system for protecting Internet of Things (IoT) devices, including IoT objects, representing connected devices having limited processing power, from malicious code, which comprises:

an in-cloud server; and

a memory extraction module at each of said IoT devices, for extracting a copy of at least a portion of memory content from a given IoT device, and sending said copy to said in-cloud server; wherein:

said in-cloud server is operative for receiving and inspecting said extracted memory content;

said memory extraction module is operative to extract, either upon demand from said in-cloud server, or independently, the copied portion of the memory content, and to transmit said extracted memory content to said in-cloud server for inspection and verification;

said in-cloud server is operative to reconstruct, from said extracted memory content, a state of an operating system (OS) of the IoT device to determine and report results as to whether one or more structural elements of the OS have been compromised;

said in-cloud server includes a database that contains authentic and reliable data for comparison and verification with the extracted memory content which is received from the IoT devices;

said in-cloud server is operative to perform an analysis of the extracted memory content to find malware using static analysis methods; and

said in-cloud server is operative to perform an analysis of extracted memory content to find malicious behavior using behavioral and heuristics methods.

2. A system according to claim 1 , wherein said in-cloud server is adapted to perform one or more of the following additional operations:

an integrity check of the OS and its memory to possibly find a fault in the integrity of the OS or in hidden processes;

a cross-view check on resources to find root kits and hidden operations; and

a cross-view check and validation of memory contents of a plurality of IoT devices.

3. A system according to claim 1 , wherein following said operation to reconstruct, said in-cloud server performs one or more of the following:

(1) logging of the results;

(2) reporting the results, raising a warning or an alert in a case of detection of an unexpected code or behavior; and

(3) communicating and responding to an IoT request.

4. A system according to claim 1 , wherein the extracted memory content is either a persistent memory content or a non-persistent memory content.

5. A system according to claim 1 , wherein said memory extraction module is embedded within a kernel of a respective operating system of the IoT device.

6. A system according to claim 1 , wherein said memory extraction module is positioned within a trusted layer at the IoT device.

7. A system according to claim 1 , wherein said memory extraction module is positioned within a Trusted Execution Environment at the processor of the IoT device.

8. A system according to claim 1 , wherein the one or more structural elements are selected from the group consisting of:

a. process/thread list;

b. communication ports;

c. kernel modules;

d. objects in memory;

e. object in cache;

f. open/close files;

g. system status;

h. bootstrap information; and

i. memory corruptions.

9. A system according to claim 1 , wherein the OS of the IoT device is a proprietary OS.

10. A system according to claim 1 , wherein the extracted memory content includes persistent and non-persistent memory content.

11. A system according to claim 2 , wherein the fault is malicious code.

12. A system according to claim 2 , wherein following one or more of the additional operations, said in-cloud server performs one or more of the following:

(1) logging of results of the integrity check, the cross-view check on resources, or the cross-view check and validation of memory contents;

(2) reporting the results of the integrity check, the cross-view check on resources, or the cross-view check and validation of memory contents, raising a warning or an alert in a case of detection of an unexpected code or behavior; or

(3) communicating and responding to an IoT request.