MonPoly (Product): news timeline & CVEs

Hybrid Hierarchical Runtime Verification for Edge-IoT Security: Combining MonPoly and RTLola

A three-layer edge-IoT monitor pairs MonPoly with RTLola to catch coordinated attacks and silent compromised nodes.

The paper proposes a three-layer runtime-verification design for edge-IoT fleets: edge classification, gateway aggregation of short per-device windows, and a cloud tier running MonPoly and RTLola together. MonPoly checks first-order temporal patterns such as coordinated overflow and per-device multi-vector, escalation, and persistent-campaign activity, while RTLola checks a time-triggered silent-node property that event-triggered monitors miss once a device goes quiet. On a 15-actor Docker testbed with eight attack profiles plus a silent-bypass case, device-attributable incidents named attacker-labelled devices and RTLola caught silent bypasses. Per-event monitoring stayed in the microsecond range at the edge and gateway.

arXiv cs.CROct 7, 10:49 UTC · 1d agoResearch 2 sources1

Hierarchical Security Monitoring for Edge-IoT: A Formal Methods Approach

Hierarchical TeSSLa and MonPoly monitors detect cross-device edge-IoT attacks while sending only compact verdicts upstream.

The paper presents a hierarchical runtime-verification monitor that keeps edge-IoT detection cheap while still seeing coordinated multi-device attacks. Each device runs a lightweight TeSSLa specification over size, payload validity, rate, and timestamp drift, emitting a four-valued verdict per window at sub-microsecond per-event cost. A gateway MonPoly monitor consumes those verdicts at microsecond scale, and the uplink carries roughly one Boolean per aggregation window per node rather than raw packets. A container testbed covered buffer overflow, time spoofing, denial of service, and mixed APT patterns, and every alert includes a witness naming the device, tier, and predicate.

arXiv cs.CROct 7, 10:40 UTC · 1d agoResearch 2 sources1

Formal Runtime Verification for Tool-Using LLM Agents: An Offline Same-Benchmark Study on AgentDojo and STAC

Offline MFOTL monitoring flags about 70% of AgentDojo and STAC agent attacks but also 29% of benign runs.

Researchers evaluate metric first-order temporal logic as a reusable guardrail for tool-using LLM agents by replaying AgentDojo, STAC, and R-Judge trajectories through unmodified MonPoly, offline. Five generic obligations flag 71.8% of STAC attack chains and 70.1% of successful AgentDojo attacks, while firing on 29.3% of benign runs. Missing approvals and timestamps reduce history-dependent rules to risky action types. Binding provenance to the lookup that produced it stops a one-line evasion that defeated naive checks on 94-99% of otherwise flagged runs, and the authors propose a twelve-field enforcement-ready trace schema.

arXiv cs.CROct 7, 10:08 UTC · 1d agoAI safety & security2

MonPoly

Timeline3 articles

Appears with

Hybrid Hierarchical Runtime Verification for Edge-IoT Security: Combining MonPoly and RTLola

Hierarchical Security Monitoring for Edge-IoT: A Formal Methods Approach

Formal Runtime Verification for Tool-Using LLM Agents: An Offline Same-Benchmark Study on AgentDojo and STAC