Hybrid Hierarchical Runtime Verification for Edge-IoT Security: Combining MonPoly and RTLola
A three-layer edge-IoT monitor pairs MonPoly with RTLola to catch coordinated attacks and silent compromised nodes.
The paper proposes a three-layer runtime-verification design for edge-IoT fleets: edge classification, gateway aggregation of short per-device windows, and a cloud tier running MonPoly and RTLola together. MonPoly checks first-order temporal patterns such as coordinated overflow and per-device multi-vector, escalation, and persistent-campaign activity, while RTLola checks a time-triggered silent-node property that event-triggered monitors miss once a device goes quiet. On a 15-actor Docker testbed with eight attack profiles plus a silent-bypass case, device-attributable incidents named attacker-labelled devices and RTLola caught silent bypasses. Per-event monitoring stayed in the microsecond range at the edge and gateway.