Overview
Leverages iOS process management data — CPU usage patterns, memory allocation, network connections, and privilege escalation attempts — to train ML models that classify and predict security vulnerabilities on mobile devices.
Data Collection
System telemetry is harvested from iOS process-level instrumentation across three attack categories. Buffer overflow scenarios produce anomalous memory allocation rates and irregular instruction pointer sequences. Privilege escalation manifests via unauthorized ptrace, mprotect, and task_for_pid invocations. Code injection is detected through anomalous mmap write-execute mappings and unexpected dlopen calls. Per-process snapshots at 100 ms capture CPU metrics (user/system time, context switches), memory metrics (RSS, page faults), network metrics (connection frequency, socket states), and syscall sequences.
Feature Engineering
Raw telemetry is transformed through three pipelines. Temporal windowing uses sliding windows of 1 s, 5 s, and 30 s to aggregate per-process statistics (mean, stddev, rate-of-change). Statistical aggregations compute histograms, skew, and kurtosis of memory distributions to discriminate heap-spray and stack-pivot behaviors. Syscall sequence encoding tokenizes traces via a vocabulary of 450 iOS system calls, embeds them as one-hot vectors, and passes them through a 1D convolutional encoder with positional encoding.
ML Models
Three architectures are trained. A CNN on syscall sequences uses three 1D convolutional layers (filter sizes [64, 128, 256]) followed by dense layers (256, 128 units, ReLU, 50% dropout) — excels at bursty exploitation patterns. A Random Forest with 500 trees and max depth 20 operates on statistical features, providing interpretable baselines via Gini importance. Ensemble fusion combines CNN and RF posteriors via soft voting weighted by per-class precision, with a logistic regression meta-classifier.
Attack Scenarios
Simulations based on real CVEs span six classes: Buffer Overflow (CVE-2021-1782), Privilege Escalation (CVE-2021-1786), Code Injection (CVE-2022-22616), Use-After-Free (CVE-2022-22662), Information Disclosure (CVE-2021-1809), and Denial of Service (CVE-2022-22665). Each runs on jailed iPad Air and iPhone 12 Mini devices (iOS 14-16), with labels verified via crash logs and kernel panics.
Results
The ensemble achieves 92.3% accuracy on held-out test data (120,000 windows). Per-class F1: Privilege Escalation 0.96, DoS 0.94, Buffer Overflow 0.92, Code Injection 0.91, Information Disclosure 0.90, Use-After-Free 0.86. Benign high-load scenarios cause 67% of false positives — a load-aware gating classifier reduced these by 31% post-hoc.
Feature Importance
Top Gini features: memory allocation rate stddev (5 s window, 0.142) for heap-based attacks; inter-syscall interval skew (30 s, 0.118) for bursty exploitation; thread creation rate (5 s, 0.097) for DoS and code injection; mprotect count (1 s, 0.088) for privilege escalation; and RSS growth delta 99th percentile (30 s, 0.076) for memory pressure. CNN Grad-CAM saliency maps localize key positions — early clusters at indices 3-8 within 200-call windows signal buffer overflow.
Key Contributions
- Collected and labeled iOS process telemetry dataset under various attack scenarios
- Trained neural network classifiers for vulnerability type identification
- Analyzed feature importance to identify strongest indicators of compromise
- Evaluated real-time classification performance on device
Impact
Enables proactive mobile threat detection by identifying vulnerability patterns before exploitation — reducing reliance on signature-based detection alone.