#  Symmetry Enforced Fermi Surface Degeneracies Observed in Time-Reversal
Symmetry-Breaking Superconductor LaNiGa2

Matthew Staab  Department of Physics and Astronomy, University of California,
Davis, Davis, California $95616$, USA  Robert Prater  Department of Physics
and Astronomy, University of California, Davis, Davis, California $95616$, USA
Sudheer Sreedhar  Department of Physics and Astronomy, University of
California, Davis, Davis, California $95616$, USA  Journey Byland  Department
of Physics and Astronomy, University of California, Davis, Davis, California
$95616$, USA  Eliana Mann  Department of Physics and Astronomy, University of
California, Davis, Davis, California $95616$, USA  John A. Paulson School of
Engineering and Applied Sciences, Harvard University, Cambridge, MA, USA
Davis Zackaria  Department of Physics and Astronomy, University of California,
Davis, Davis, California $95616$, USA  Yunshu Shi  Department of Physics and
Astronomy, University of California, Davis, Davis, California $95616$, USA
Henry J. Bowman  Department of Physics and Astronomy, University of
California, Davis, Davis, California $95616$, USA  Andrew L. Stephens
Department of Physics and Astronomy, University of California, Davis, Davis,
California $95616$, USA  Myung-Chul Jung  Department of Physics, Arizona State
University, Tempe, AZ 85281, USA  Antia S. Botana  Department of Physics,
Arizona State University, Tempe, AZ 85281, USA  Warren E. Pickett  Department
of Physics and Astronomy, University of California, Davis, Davis, California
$95616$, USA  Valentin Taufour  Department of Physics and Astronomy,
University of California, Davis, Davis, California $95616$, USA  Inna Vishik
<EMAIL_ADDRESS>Department of Physics and Astronomy, University of
California, Davis, Davis, California $95616$, USA

###### Abstract

LaNiGa2 is superconductor that breaks time-reversal symmetry in the
superconducting state without any known nearby magnetism. Recently, single
crystals of LaNiGa2 have been synthesized, revealing a nonsymmorphic Cmcm
space group. Here, we report measurements of the electronic structure of
LaNiGa2 throughout the three-dimensional Brillouin zone (BZ) using angle-
resolved photoemission spectroscopy (ARPES). Our findings show broad
consistency with density functional theory (DFT) calculations and provide
evidence for degeneracies in the electronic structure that are predicted from
the space group. The calculations also predict four Fermi surfaces which cross
the purported nodal plane and should therefore form two degenerate pairs. We
report evidence for those predicted symmetry enforced degeneracies as well as
accidental near degeneracies throughout the BZ. These degeneracies and near-
degeneracies may play a role in the pairing mechanism of LaNiGa2. Our results
provide insight into the interplay between structure, Fermiology, and
superconductivity in unconventional superconductors with nonsymmorphic space
group.

##  I Introduction

Unconventional superconductors have mechanisms or phenomena that differ from
superconductors described by Bardeen-Cooper-Schrieffer (BCS) theory. The
normal state electronic properties of unconventional superconductors can
inform their superconducting mechanism as well as identify factors that raise
or lower the transition temperature, Tc. For example, the experimentally
established Fermiology of iron based superconductors influenced early
proposals of interband pairing [1, 2], and in cuprate high-temperature
superconductors, the normal-state pseudogap presents one of the most
formidable challenges to establishing the superconducting mechanism [3, 4].
Among superconductors that have been reported to break time reversal symmetry
below Tc, Sr2RuO4 has been the most heavily investigated, and its normal-state
band structure, particularly the van hove singularity [5, 6], has been
implicated in the origin of superconductivity and the evolution of Tc under
strain [7]. In other classes of superconductors, there are examples of
isostructural materials that alternately break/maintain time reversal symmetry
in the superconducting state, providing further indication that details of
Fermiology can play a role in the pairing state [8].

Time-reversal symmetry breaking (TRSB) superconductivity is relatively rare,
with only several dozen single-material (not heterostructure) candidates
identified to date [9, 10], and many of these compounds have magnetism or
magnetic fluctuations which may play a role in mediating TRSB
superconductivity [11, 12, 13]. LaNiGa2 is a rare example where magnetism is
absent due to the Ni bands being filled [14, 15]. This material has a
superconducting transition temperature, T${}_{c}\approx$2K [16], and most
prior studies have been on polycrystalline specimens. $\mu$SR experiments
reported the onset of spontaneous magnetization below Tc, interpreted as
demonstrating TRSB superconductivity [17].

The recent synthesis of single crystals has enabled a wider array of
experiments to understand structural, thermodynamic, and electronic properties
relevant to the superconducting mechanism [10]. More than enabling new
experiments, these single crystals demonstrated that the space group was
previously mis-identified as Cmmm, with the correct space group being Cmcm,
which is nonsymmorphic. The Cmcm space group imposes symmetry-enforced
degeneracies at the $k_{z}$ Brillouin zone boundary ($Z-T-A$ plane, Fig.
1(a)-(b)). Spin-orbit coupling (SOC) splits this degeneracy everywhere except
for the $k_{x}=0$ line on that plane, but only slightly [14]. The symmetry
enforced degeneracies and near-degeneracies of this space group are predicted
to contribute to the pairing mechanism in LaNiGa2 [14], and may be an
important for other inversion-symmetry-preserving superconductors with
nonsymmorphic space groups.

Other materials in the Cmcm space group have recently garnered attention due
to the degenerate features of their band structures. TaNiTe5 and TaPtTe5 are
two such examples of non-superconducting Cmcm crystals that have been shown by
ARPES to have Dirac nodal lines at the BZ boundary [18, 19]. Being non-
superconducting, these compounds show that it is not just the space group and
related Fermi surface degeneracies that make LaNiGa2 a superconductor.

Here we present the experimental normal-state electronic structure of TRSB
superconductor LaNiGa2 throughout the entire 3D BZ, as measured by ARPES. The
following results are presented: (1) broad agreement between density
functional theory (DFT) and measured electronic structure throughout 3D BZ.
(2) Evidence for Fermi surface degeneracies on $Z-T-A$ plane, within
resolution of experiment, via distinct bands merging into one approaching this
plane in parallel (Fig. 1(c)-(d)). (3) Evidence of predicted linear-crossings
of all bands when cutting perpendicular to $Z-T-A$ plane (Fig. 1(e)). (4)
Evidence for near-degeneracies of bands throughout the BZ separate from those
on the $Z-T-A$ plane. The relevance of these features to the proposed
mechanism of unconventional superconductivity will be discussed.

Fig. 1: Predicted Fermiology and Nodal Plane Features (a) The C-Orthorhombic
Brillouin zone with high symmetry points and axes labeled. The purported nodal
plane is the $k_{z}$ boundary, or the $Z-T-A$ plane. (b) The five Fermi
surfaces of LaNiGa2 shown in the Brillouin zone, reproduced from Ref. [10].
The pink dots indicate the SOC protected nodal points. Features labeled ‘nodal
line’ and ‘nodal loop’ are degenerate crossings at $E_{F}$ that get split by
SOC. (c)-(e) Schematic of predicted band structure degeneracies. (c)-(d) cuts
parallel to the nodal plane are expected to show band merging in energy and
momentum. (e) When piercing the predicted nodal plane, parallel to $k_{z}$,
the calculations predict a Dirac crossing of bands. In (b-e) The purple plane
is the purported nodal plane.

##  II Methods

Crystal growth and ARPES Measurements The samples were grown using the
technique described in the original single-crystal growth by Badger et al.
[10].

ARPES measurements were performed at Stanford Synchrotron Radiation
Lightsource (SSRL) beamline $5-2$. Samples were cleaved in-situ at pressure
better than $5\times 10^{-11}$ Torr and at temperatures less than $15K$. The
photon energy was varied as stated in relevant figures. The energy and
momentum resolution of the experiments were 25 meV and $\approx 0.01\AA^{-1}$
respectively. The beam spot size was approximately $20\mu m\times 30\mu m$
(’microARPES’) for all experiments.

LaNiGa2 single crystals grow in a platelet shape with typical dimensions of
$2mm\times 2mm$ (figure 2 (a)-(b)). The platelet-shaped samples are most
naturally cleaved $in\text{-}situ$ by mounting a ceramic top post on top of
the platelet, hereafter called the ‘natural cleave’ orientation. Cleaving the
crystal in the natural orientation allows for ARPES that approximately probes
of planes of constant $k_{y}$. In order to probe band structure at roughly
constant values of $k_{z}$ or $k_{x}$ without relying exclusively on the
lower-resolution photon energy tuning method, we mounted the platelet samples
on their thin-edge. This was done by etching a groove into the sample holder
and adhering the sample into the groove. The samples were mounted into the
groove with ultrahigh vacuum compatible Locktite, and a conductive pathway
created with the silver epoxy Epo-tek H21D. For data shown here, the samples
were pre-aligned using Laue [20] to have the $\vec{a}$ axis normal to the
sample holder. The thin-edge-mounted samples were broken $in\text{-}situ$
using a flat-edged wobble stick to apply uniform pressure across the face
without using a top post. This configuration of thin-edge cleaving was used to
probe the $k_{y}$ dependence of the electronic structure directly with ARPES.
MicroARPES is crucial for enabling measurements of thin-edge-cleaved samples.

Fig. 2: Sample Dimensions and XPS (a) LaNiGa2 sample pictured on millimeter
paper showing typical shape and size of the platelet crystals in the a-c plane
(natural orientation). (b) Image of the sample held on its side (thin-edge
orientation). (c) Projected density of states calculations along with XPS
measured with $144eV$ photons in the natural orientation.

Electronic Structure Calculations

Density functional theory calculations were carried out using the full-
potential linearized augmented planewave code Wien2k [21]. We used the Perdew-
Burke-Ernzerhof (PBE) version of the generalized gradient approximation as the
exchange-correlation functional [22]. The atomic coordinates used for these
calculations were those listed in [10, 14]. The muffin-tin sphere sizes were
2.50 a.u for La; 2.32 a.u for Ni, and 2.20 a.u for Ga. The plane wave cutoff
was determined by $R_{mt}^{min}K_{max}=7$, and the $k$-point mesh used was
$14\times 14\times 14$ for self-consistency and $34\times 34\times 33$ for the
projected density of states. The effects of spin-orbit coupling were included
by using the second variational method as implemented in Wien2k.

##  III Results

Fig. 2(c) shows an angle-integrated valence band spectrum, together with
calculated partial and total density of states. These x-ray photoelectron
spectroscopy (XPS) data are collected on the same natural cleave as ARPES
data. Maps of constant energy at the Fermi level ($E_{F}$), yielding Fermi
surface maps, are shown for four characteristic planes in momentum space in
Fig. 3. The associated DFT calculations are partially superimposed to
establish the alignment between theoretical and experimental Fermiology. The
displayed planes of the BZ are schematically shown in panel (a) by orange,
red, green, and blue lines which correspond to (b) $k_{x}=0$ (144 eV), (c)
$k_{y}=0$ (116 eV)), (c) $k_{y}=0.516\cdot 2\pi/c$ (124 eV), (e)
$k_{y}=2\pi/c$ (132 eV) respectively. Data for panel (b) were collected in the
thin-edge orientation directly probing the $k_{x}=0$ plane, which permits
spectra orthogonal to the purported nodal plane. Broader photon energy
dependence was preformed from $110eV$ to $144eV$, and is shown in the the SI,
where methods for establishing the relationship between photon energy and
$k_{\perp}$ (momentum perpendicular to surface plane) is also discussed [20].

Fig. 3: Observed Fermiology for selected planes in BZ. (a) Projection of the
BZ showing locations of the planes with colored lines corresponding to the
borders in (b-e). (b) Constant energy map integrated $45meV$ around the Fermi
energy at $144eV$ in the thin-edge orientation. (c-e) ARPES constant energy
maps integrated $50meV$ around the Fermi energy. Measured in the natural
platelet orientation at $116eV$, $124eV$ and $132eV$ respectively to access
the center and top of the BZ. DFT calculated Fermi crossings shown in (b-e)
are colored corresponding to the Fermi surfaces in Fig. 1. In (c-e) they are
only overlaid on half of the zone for clarity of the data. Purple plane in (a)
and dashed lines in (b-e) indicate $Z-T-A$ plane location. Black dashed lines
indicate the other BZ.

As discussed, one defining feature of the predicted electronic structure is
pairs of bands merging together when approaching the $Z-T-A$ plane. Fig. 4
shows that merging as a function of momentum both approaching the purported
$Z-T-A$ plane as well as the orthogonal zone boundary at a photon energy of
$120eV$.

Panels (a1-a4) show the spectra approaching (a1,a2), on (a3) and past (a4) the
predicted nodal plane. Panel (b) similarly shows the spectra approaching (b1,
b2) and on (b3) the zone boundary orthogonal to the predicted nodal plane.
Panel (c) shows the described locations of the cuts in panel (a) and (b) on-
top of a constant energy map integrated $\pm 50meV$ around the Fermi level.

Panel (a) has two separated bands in panels (a1, a2) that appear to merge in
panel (a3) and split again in (a4).

Panel (b) also shows two well separated bands in panel (b1) that closely
approach each other in panel (b3). Whereas spectra in (a2) and (b2) have
similar linewidth, the spectrum in (a3) is considerably sharper than (b3).
Calculated electronic structure for these cuts is overlaid with their color
corresponding to the Fermi surface number given in Fig. 1.

Fig. 4: Band merging in momentum at zone boundaries. (a1-a4) Spectra
approaching (a1,a2) at (a3) and beyond (a4) the $Z-T-A$ plane as a function of
$k_{z}$. (b1-b3) Spectra approaching (b1,b2) and on (b3) the BZ boundary along
$k_{x}$. (c) Constant energy map at the Fermi level with $120eV$ photons
indicating the location of the spectra in (a) and (b). (a-b) DFT predicted
bands are overlaid according to the color of the FS they create in Fig. 1.

With the thin-edge cleave perpendicular to $\vec{a}$, we can visualize bands
merging in energy approaching the $Z-T-A$ plane, because the observed bands
have band bottoms at lower binding energy. In Fig. 4 we only discussed merging
in momentum because the band bottoms are well below the displayed energy
range. Nevertheless, for cuts approaching the purported nodal plane in
parallel, bands always merge in both energy and momentum. Figure 5 shows
spectra along three parallel cuts moving progressively further from the zone
boundary (panels (b1-b3)). In panel (c), we compare energy distribution curves
(EDCs) at the $k_{y}=0$ point, where a band bottom is located. Panel (b1),
taken along the zone boundary, shows a single band in the spectrum and a
single peak in the EDC. As one moves away from the zone boundary, the bands
split in two as seen both in the image plots and the EDCs. The magnitude of
this split is $\approx 200meV$ for cuts differing by $\approx 6\%$ of the BZ.

Fig. 5: Band merging in energy, thin-edge cleave. (a) Fermi level constant
energy contour cropped from Fig. 3 (b) showing locations of cuts in (b1)-(b3).
Black and purple dashed lines indicate BZ boundaries. (b1)-(b3) ARPES spectra
at three parallel cuts (c) $k_{y}=0$ EDCs of panels (b1)-(b3) in green, blue,
offset for clarity. Dots are guide-to-the-eye for peak position Thin Edge:
LA_0151 From May 11, 2022“20220511_LaNiGa2”

So far we have provided evidence for band degeneracy at the $Z-T-A$ plane by
investigating the spectra along lines parallel to the $Z-T-A$ plane. The
second predicted signature of the $k_{z}$ BZ boundary is that for all cuts
perpendicular to it, all bands which cross the $Z-T-A$ plane should do so with
a Dirac-like (linear) crossing, up to SOC. In Fig. 6 (a) we show a spectrum
along the $k_{z}$ axis that shows a Dirac-like crossing at the $Z-T-A$ (purple
dashed line) $0.2eV$ below $E_{F}$. That spectrum, being along the $k_{z}$
axis, intercepts the nodal plane along the $Z-T$ line and is therefore
predicted to be protected against SOC splitting due to an additional symmetry.
In panels (b1) - (b3) of Fig. 6 we show three parallel cuts that intersect the
$Z-T-A$ plane successively closer to the purported nodal line. In the
experimental spectra, two linear crossings are clearly seen in (b1), which
successively move to lower binding energy approaching the momentum marked by
the ‘X’-shaped feature in the Fermi surface map (c). Finally, at the purported
nodal line (b3), a linear crossing is observed right at $E_{F}$. The crossings
in (b) are not protected from SOC and are therefore gapped, but their gap size
too small to be resolved in this work. The bottom of panels (b)-(c) show the
DFT calculated dispersion in the corresponding locations.

Fig. 6: Linear crossings for cuts perpendicular to nodal plane. (a) Thin edge
orientation spectrum taken along the $\Gamma-Z$ line at a photon energy of
$144eV$. (b) Spectra taken in the natural orientation with $120eV$ photons
near a Fermi crossing at the zone boundary. (c) Constant energy contour from
the natural orientation indicating the location of cuts in (a-b). The cut from
(a) is along the $k_{y}=0\AA^{-1}$ line while (b-c) are from the $k_{y}\approx
0.09\AA^{-1}$ plane. (a-b)(bottom) DFT predicted bands are shown according to
the color of the FS they create in Fig. 1.

##  IV Discussion

We begin by addressing the lack of magnetism in LaNiGa2, previously justified
by filled Ni-3d bands. In DFT calculations of density of states (DOS), these
filled bands yield a large peak at $\approx 1.8eV$ binding energy in Fig. 2
(c). The measured XPS intensity, a rough proxy for DOS, is consistent with
this calculated feature, supporting the stated absence of magnetism in this
compound. We also note that recent nuclear magnetic/quadrupolar resonance and
magnetization measurements in the normal state further do not find evidence of
magnetic fluctuations or enhanced paramagnetism [23].

We now turn to the measured band structure, where we observe overall good
agreement between DFT and experiment throughout the 3D BZ. We note strong
matrix element effects [24], which is the reason why certain bands are
observed more, less, or not at all in certain regions of the BZ in the present
data. There do exist a few discrepancies between measured and predicted bands,
particularly in the most 3-dimensional bands which form FS 1 and 2. This can
be seen in Fig. 3 (c) where the ‘teardrop’ shaped pocket of FS 1 near
$k_{x}=-0.4\AA^{-1}$ is observed to be larger than predicted. Further, in
panel (d) we observe elongated features of FS 1 and 2 that appear similar to
those of panel (e). The more 2D Fermi surfaces, FS 3 and 5, show no observed
disagreement with the predicted electronic structure. Additionally, FS 1 and 2
show strong agreement with predictions in the thin-edge cleave shown in Fig. 3
(b).

The disagreements seen of FS 1 and 2 are then either: (1) real features of the
electronic structure not captured by the calculations, and constrained to only
small portions of the BZ or (2) artifacts arising from the photoemission
process due to momentum uncertainty in the $k_{\perp}$ direction. Arguing
against scenario (1), there is very good agreement between ARPES Fermi
surfaces and DFT with regards to FS1 and 2 in the thin-edge cleave data.
Elaborating on (2), the short inelastic mean free path (IMFP) of electrons
makes ARPES a surface sensitive measurement in the present range of photon
energies. We calculate the IMFP of electrons with kinetic energy of $110eV$
traveling through LaNiGa2 to be $\lambda=5\AA$ using a common empirical method
method [25]. This IMFP leads to an appreciable quantum uncertainty of the
perpendicular momentum $\Delta k_{\perp}=1/\lambda=0.2\AA^{-1}$ [26],
comprising $\approx 25\%$ of the BZ along $k_{y}$. Additionally, in ARPES
measurements there can be preferential sampling of bands which are being
probed by the spectrometer slit normal to their constant-energy surface. These
two effects: (1) $k_{\perp}$ broadening and (2) extremum-selective sampling
may explain the discrepancies observed in Fig. 3 as the extremum position
observed for FS 1 is at $k_{y}\approx 0.016\AA^{-1}$.

Now we turn to focus on the observed features at the purported nodal plane.
The first observation is bands merging when approaching the $Z-T-A$ plane with
parallel cuts (Fig. 4,5). While the calculations predict SOC splitting of the
bands along the nodal plane at all positions except the $Z-T$ line, the
splitting is extremely small in most locations. In Fig. 4 (a3) the splitting
between FS 2 and 3 is $5meV$, much smaller than our experimental resolution.
Also predicted are Dirac-like crossings for all bands when piercing the nodal
plane in perpendicular. This is observed for several distinct bands in Fig. 6
Momentum-space band merging can be additionally visualized in Fermi surface
maps, particularly in Fig. 3 (c)-(e), Fig. 4(c), and many other examples shown
in the SI [20]. These show an ‘X’-shaped feature at the BZ boundary along one
direction ($k_{z}$) but not along the other ($k_{y}$), consistent with the
location of the nodal plane. Notably, most of these observations are
discernible from data alone, independent from comparison to DFT calculations.

Beyond the nodal plane, we also present evidence for near-degeneracies
throughout the BZ. These near-degeneracies are particularly persistent at the
orthogonal zone boundary ($k_{x}$). FS 2 and 3 have near degeneracies not only
along the orthogonal BZ boundary but within the BZ at many values of $k_{y}$.
Near-degeneracies are observed in both the thin-edge Fermi surface as well as
broad ranges of the photon energy dependent natural-cleave Fermiology. Four
clear examples can be seen of near-degeneracies within the BZ in Fig. 3:
First, panel (b) shows degeneracy of FS 2 and 3 at
$k_{z}\approx-0.65\AA^{-1}$. Second, panel (c) shows a near-degeneracy of FS 2
and 3 at $k_{x}\approx-0.55\AA^{-1}$ where the bands are almost stuck until
they reach the $k_{x}$ zone boundary. Third, panel (d) shows FS 2 and 3 again
nearly degenerate and then stuck near the $k_{x}$ boundary. Finally, panel (e)
again shows FS 2 and 3 being nearly degenerate inside the BZ at
$k_{z}\approx-0.35\AA^{-1}$ nearly co-located with a near degeneracy of FS 3
and 4.

We now connect these results to prior work on this material. Early experiments
have laid out a set of constraints for the pairing symmetry and mechanism of
LaNiGa2. The point group symmetry of the crystal structure, which remains
unchanged with the newly assigned space group, only permits four order
parameters that break time reversal symmetry [17, 14]. All are non-unitary and
all have weak SOC, the latter constraint which is confirmed with the present
data. Additionally, heat capacity and superfluid density were shown to be
inconsistent with nodes of any kind [27, 10]. The latter showed better
consistency with a two-gap gamma model than a one-gap BCS fitting, which was
more recently bolstered by transverse-field $\mu$-SR measurements [28].

Together, these results point to a fully-gapped triplet state. The
superconducting wavefunction must be odd overall to comport with Fermion
exchange, so an even spin component implies an odd spatial component. This
presents a problem when one includes information about the Fermiology, as an
odd spatial wavefunction must change sign across the $\Gamma$ point, so a
Fermi surface that encloses $\Gamma$ should have a node, inconsistent with
experiments. The calculated Fermiology based on both the previous Cmmm [15]
and refined Cmcm [10, 14] crystal structure includes Fermi surfaces which
envelop the gamma point. In the present calculation, this includes a small
pocket of FS1, as well as FS2 and 3. Previously, this apparent inconsistency
was resolved by considering the multiband nature of this material, wherein
triplet pairing between nearly degenerate Fermi surfaces can ensure an overall
odd wavefunction [29], if the order parameter changes sign upon swapping band
index. This proposed internally antisymmetric nonunitary triplet pairing (INT)
state appears to be consistent with all experimental results about the
superconductivity in LaNiGa2 to date: TRSB below Tc [17], nodeless
superconducting gap [27, 10], consistency with two gaps [28], and
insensitivity of superconductivity to non-magnetic impurities [30].

The present work adds experimentally-motivated plausibility to that argument,
and proposes further experiments to understand and optimize superconductivity
in LaNiGa2. The Cmcm space group imposes symmetry-enforced degeneracies along
one plane of the BZ, the so-called ‘nodal plane.’ Our experiments find support
for this in three ways: bands merging in momentum approaching the nodal plane
with parallel cuts (Fig. 4), bands merging in energy approaching the nodal
plane with parallel cuts (Fig. 5), and all cuts perpendicular to the nodal
plane yielding Dirac-like crossings for all bands at all energies (Fig. 6).
Although SOC lifts this degeneracy on most of the nodal plane, there are still
three sources of degeneracy and near-degeneracy to support interband pairing:
(1) symmetry-enforced exact degeneracy at predicted nodal points along $Z-T$
line (2) near-degeneracy on nodal lines and nodal loop arising from symmetry
coupled with a small ( meV) amount of SOC (3) accidental near-degeneracies
including on the $k_{x}$ BZ boundary (Fig. 4(b)). The latter were present in
band structure calculations based on the previous Cmmm structure, but the
former two are a consequence of the Cmcm structure. The overall strong
agreement between DFT calculations and experiment throughout the 3D BZ further
supports the prediction of a nodal plane, as well as the presence of only weak
SOC [17], which is required for the experimentally-compatible pairing states.

Despite the growing body of knowledge on LaNiGa2, accelerated by the
availability of single crystals, questions still remain. Interband pairing
benefits from near-degeneracies throughout the BZ; the ones on the nodal plane
will remain as long as the crystal structure is unchanged, but the ones
outside the nodal plane may be tunable by uniaxial strain. The effect of this
tuning on Tc can further confirm the pairing mechanism that appears to be
supported by a plurality of experiments. Moreover, it can clarify if there are
pairing interactions outside of electron-phonon [31] which is the primary
candidate in LaNiGa2, such as originating magnetic phases which often
accompany TRSB superconductor. As an example of this, LaNiC2 was also thought
to be entirely non-magnetic, until pressure-dependent studies on single-
crystals revealed a hidden antiferromagnetic regime [32].

Another important direction is substitutional carrier tuning, which is
expected to maintain the nodal points, maintain near-degeneracies on the nodal
plane, but tune the presence of small hole-like pockets throughout the BZ,
clarifying their role in superconductivity, which is heretofore not considered
in detail. These new experiments should be pursued in conjunction with
revisiting foundational results about this material. In other materials,
claims of TRSB superconductivity have become less clear as more experimental
evidence emerged, most prominently in Sr2RuO4 [33, 34]. With that insight, we
emphasize the importance of repeating zero field $\mu$SR measurements, as well
as other experiments sensitive to TRSB in the superconducting state, on single
crystals of LaNiGa2 where the surface/volume ratio is smaller and the
constituency of impurities and inclusions may also be different.

Unconventional superconductors are a very broad class likely to contain a
diverse set of novel pairing mechanisms. The subset of those that break time
reversal symmetry is quite small, and the subset of these TRSB superconductors
that do not contain nearby magnetism is smaller yet. The present high quality
data, including in the unconventional thin-edge cleave geometry demonstrates
that LaNiGa2 can continue to yield experimental insights on momentum space
electronic structure and can serve as a benchmark for this set of rare
superconductors. One other example of TRSB superconductivity without nearby
magnetism is $4$Hb-TaS2. However, being a 2D Van der Waals material, $4$Hb-
TaS2 likely does not allow for a thin-edge cleave to be achieved in the same
way that LaNiGa2 is shown to here.

##  V Conclusions

We have performed the first comprehensive ARPES study of purported TRSB
superconductor LaNiGa2 throughout the 3D BZ. This material yields high quality
ARPES spectra. Additionally, we have demonstrated thin-edge cleaving in
platelet-like specimens to yield ARPES spectra of comparable quality to
conventional cleaving, with implications for further surface spectroscopy
studies of platelet specimens. Superconductivity is a low-energy phenomena
which necessarily is affected by the Fermiology of a material. This is
particularly true in the case of LaNiGa2 which has an expected gap size of
$k_{B}T_{c}\approx 0.6meV$ [14]. The Cmcm space group enforces band
degeneracies at the $k_{z}$ boundary, which constrains any Fermi surface that
crosses that plane to be degenerate with another. LaNiGa2 has 4 Fermi surfaces
which cross the $Z-T$ plane, two of which cross the additionally protected
$Z-T$ line and are degenerate even with SOC. These degenerate Fermi surfaces
are predicted to provide the platform which allows for the interband
superconductivity.

Our results have given evidence that predicted degenerate Fermi crossings are
present within our measurement resolution, and also shown that in other
regions of the BZ there are symmetry enforced as well as accidental nearly-
degenerate crossings. These nearly degenerate crossings are most prominent at
the $k_{x}$ boundaries. Known superconductors in nonsymmorphic space groups
are a fruitful avenue to search for TRSB [10], and LaNiGa2 is emblematic of
the important interplay between normal-state Fermiology and superconductivity
inherent in this approach.

Data Availability The ARPES data used in this manuscript will be available
following publication.

Acknowledgments We thank Filip Ronning, Donghui Lu, Makoto Hashimoto, and
Peter Abbamonte for helpful discussions. The synthesis and characterizations
were supported by the UC Laboratory Fees Research Program (LFR-20-653926). The
natural-cleave measurements in this manuscript was supported by AFOSR Grant
No. FA9550-18-1-0156, while the thin-edge cleave measurements were supported
by the Alfred P.Sloan Foundation(FG-2019-12170). Use of the Stanford
Synchrotron Radiation Lightsource, SLAC National Accelerator Laboratory, is
supported by the U.S. Department of Energy, Office of Science, Office of Basic
Energy Sciences under Contract No. DE-AC02-76SF00515. H.B. was supported by
the NSF-REU program PHY2150515. ASB was supported by the Alfred P. Sloan
Foundation (FG-2022-19086). MS and SS acknowledge partial support by the
advanced lightsource (ALS) graduate fellowship.

## References

  * Kordyuk [2012] A. A. Kordyuk, Low Temperature Physics 38, 888 (2012).
  * Zabolotnyy  _et al._ [2009] V. B. Zabolotnyy, D. S. Inosov, D. V. Evtushinsky, A. Koitzsch, A. A. Kordyuk, G. L. Sun, J. T. Park, D. Haug, V. Hinkov, A. V. Boris, C. T. Lin, M. Knupfer, A. N. Yaresko, B. Büchner, A. Varykhalov, R. Follath, and S. V. Borisenko, Nature 457, 569 (2009).
  * Fradkin and Kivelson [2012] E. Fradkin and S. A. Kivelson, Nature Physics 8, 864 (2012).
  * Hashimoto  _et al._ [2014] M. Hashimoto, I. M. Vishik, R.-H. He, T. P. Devereaux, and Z.-X. Shen, Nature Physics 10, 483 (2014).
  * Yokoya  _et al._ [1996] T. Yokoya, A. Chainani, T. Takahashi, H. Katayama-Yoshida, M. Kasai, and Y. Tokura, Phys. Rev. Lett. 76, 3009 (1996).
  * Wang  _et al._ [2013] Q. H. Wang, C. Platt, Y. Yang, C. Honerkamp, F. C. Zhang, W. Hanke, T. M. Rice, and R. Thomale, Europhysics Letters 104, 17013 (2013).
  * Sunko  _et al._ [2019] V. Sunko, E. Abarca Morales, I. Marković, M. E. Barber, D. Milosavljević, F. Mazzola, D. A. Sokolov, N. Kikugawa, C. Cacho, P. Dudin, H. Rosner, C. W. Hicks, P. D. C. King, and A. P. Mackenzie, npj Quantum Materials 4, 46 (2019).
  * Shang  _et al._ [2018] T. Shang, M. Smidman, S. K. Ghosh, C. Baines, L. J. Chang, D. J. Gawryluk, J. A. T. Barker, R. P. Singh, D. M. Paul, G. Balakrishnan, E. Pomjakushina, M. Shi, M. Medarde, A. D. Hillier, H. Q. Yuan, J. Quintanilla, J. Mesot, and T. Shiroka, Phys. Rev. Lett. 121, 257002 (2018).
  * Ghosh  _et al._ [2020a] S. K. Ghosh, M. Smidman, T. Shang, J. F. Annett, A. D. Hillier, J. Quintanilla, and H. Yuan, Journal of Physics: Condensed Matter 33, 033001 (2020a).
  * Badger  _et al._ [2022] J. R. Badger, Y. Quan, M. C. Staab, S. Sumita, A. Rossi, K. P. Devlin, K. Neubauer, D. S. Shulman, J. C. Fettinger, P. Klavins, S. M. Kauzlarich, D. Aoki, I. M. Vishik, W. E. Pickett, and V. Taufour, Communications Physics 5, 10.1038/s42005-021-00771-5 (2022).
  * Rømer  _et al._ [2020] A. T. Rømer, A. Kreisel, M. A. Müller, P. J. Hirschfeld, I. M. Eremin, and B. M. Andersen, Phys. Rev. B 102, 054506 (2020).
  * Aoki  _et al._ [2022] D. Aoki, J.-P. Brison, J. Flouquet, K. Ishida, G. Knebel, Y. Tokunaga, and Y. Yanase, Journal of Physics: Condensed Matter 34, 243002 (2022).
  * Farhang  _et al._ [2023] C. Farhang, N. Zaki, J. Wang, G. Gu, P. D. Johnson, and J. Xia, Phys. Rev. Lett. 130, 046702 (2023).
  * Quan  _et al._ [2022] Y. Quan, V. Taufour, and W. E. Pickett, Physical Review B 105, 10.1103/PhysRevB.105.064517 (2022).
  * Singh [2012] D. J. Singh, Physical Review B - Condensed Matter and Materials Physics 86, 10.1103/PhysRevB.86.174507 (2012).
  * Zeng and Lee [2002] N. L. Zeng and W. H. Lee, Physical Review B - Condensed Matter and Materials Physics 66, 1 (2002).
  * Hillier  _et al._ [2012] A. D. Hillier, J. Quintanilla, B. Mazidian, J. F. Annett, and R. Cywinski, Physical Review Letters 109, 10.1103/PhysRevLett.109.097001 (2012).
  * Hao  _et al._ [2021] Z. Hao, W. Chen, Y. Wang, J. Li, X. M. Ma, Y. J. Hao, R. Lu, Z. Shen, Z. Jiang, W. Liu, Q. Jiang, Y. Yang, X. Lei, L. Wang, Y. Fu, L. Zhou, L. Huang, Z. Liu, M. Ye, D. Shen, J. Mei, H. He, C. Liu, K. Deng, C. Liu, Q. Liu, and C. Chen, Physical Review B 104, 10.1103/PhysRevB.104.115158 (2021).
  * Xiao  _et al._ [2022] S. Xiao, W.-H. Jiao, Y. Lin, Q. Jiang, X. Yang, Y. He, Z. Jiang, Y. Yang, Z. Liu, M. Ye, D. Shen, and S. He, Physical Review B 105, 10.1103/physrevb.105.195145 (2022).
  * [20] See Supplemental Information.
  * Blaha  _et al._ [2020] P. Blaha, K. Schwarz, F. Tran, R. Laskowski, G. K. H. Madsen, and L. D. Marks, The Journal of Chemical Physics 152, 074101 (2020).
  * Perdew  _et al._ [1996] J. P. Perdew, K. Burke, and M. Ernzerhof, Phys. Rev. Lett. 77, 3865 (1996).
  * Sherpa  _et al._ [2023] P. Sherpa, I. Vinograd, Y. Shi, S. A. Sreedhar, C. Chaffey, T. Kissikov, M.-C. Jung, A. S. Bontana, A. P. Dioguardi, R. Yamamoto, M. Hirata, G. Conti, S. Nemsak, J. R. Badger, P. Klavins, I. Vishik, V. Taufour, and N. J. Curro, arXiv preprint arXiv:2311.06988 (2023).
  * Moser [2017] S. Moser, Journal of Electron Spectroscopy and Related Phenomena 214, 29 (2017).
  * Tanuma  _et al._ [1987] S. Tanuma, C. Powell, and D. Penn, Surface Science 192, L849 (1987).
  * Strocov [2003] V. Strocov, Journal of Electron Spectroscopy and Related Phenomena 130, 65 (2003).
  * Weng  _et al._ [2016] Z. F. Weng, J. L. Zhang, M. Smidman, T. Shang, J. Quintanilla, J. F. Annett, M. Nicklas, G. M. Pang, L. Jiao, W. B. Jiang, Y. Chen, F. Steglich, and H. Q. Yuan, Physical Review Letters 117, 10.1103/PhysRevLett.117.027001 (2016).
  * Sundar  _et al._ [2023] S. Sundar, M. Yakovlev, N. Azari, M. Abedi, D. M. Broun, H. U. Ozdemir, S. R. Dunsiger, D. Zackaria, V. Taufour, and J. E. Sonier, arXiv preprint arXiv:2311.00069 (2023).
  * Ghosh  _et al._ [2020b] S. K. Ghosh, G. Csire, P. Whittlesea, J. F. Annett, M. Gradhand, B. Újfalussy, and J. Quintanilla, Physical Review B 101, 10.1103/PhysRevB.101.100506 (2020b).
  * Ghimire  _et al._ [2023] S. Ghimire, K. R. Joshi, E. H. Krenkel, M. A. Tanatar, Y. Shi, M. Konczykowski, R. Grasset, V. Taufour, P. P. Orth, M. S. Scheurer, and R. Prozorov, arXiv preprint arXiv:2311.12222 (2023).
  * Tütüncü and Srivastava [2014] H. M. Tütüncü and G. P. Srivastava, Applied Physics Letters 104, 10.1063/1.4862329 (2014).
  * Landaeta  _et al._ [2017] J. F. Landaeta, D. Subero, P. Machado, F. Honda, and I. Bonalde, Phys. Rev. B 96, 174515 (2017).
  * Pustogow  _et al._ [2019] A. Pustogow, Y. Luo, A. Chronister, Y. S. Su, D. A. Sokolov, F. Jerzembeck, A. P. Mackenzie, C. W. Hicks, N. Kikugawa, S. Raghu, E. D. Bauer, and S. E. Brown, Nature 574, 72 (2019).
  * Chronister  _et al._ [2021] A. Chronister, A. Pustogow, N. Kikugawa, D. A. Sokolov, F. Jerzembeck, C. W. Hicks, A. P. Mackenzie, E. D. Bauer, and S. E. Brown, Proceedings of the National Academy of Sciences 118, e2025313118 (2021).
  * Damascelli [2004] A. Damascelli, Physica Scripta 2004, 61 (2004).

##  VI Supplemental Information

##  VII Reconstructed vs Direct energy vs momentum spectra

In this work, much of the data were collected as Fermi surface maps in
deflector mode, from which arbitrary energy vs momentum cuts can be
constructred. Two types of energy vs momentum spectra are used in the
manuscript. Direct spectra have their parallel momentum (x-axis) along the
detector slit. In contrast, reconstructed spectra are produced by stacking
EDCs from varying deflector angles together, in order to produce cuts in
directions perpendicular to direct ones. The reconstructed spectra in the
manuscript are the following: Fig. 4 (b) panels, Fig. 5 (b) panels, Fig. 6 (b)
panels. A similar reconstruction procedure can be used to reproduce a plane in
the BZ perpendicular to the cleavage plane, by stacking together spectra
collected with different photon energy.

##  VIII Crystal Alignment

Laue diffraction utilizes reflections of a polychromatic X-ray beam and those
X-rays whose wavelength satisfy the Laue equations (Bragg condition) with the
lattice are coherently reflected and form bright spots on the detector. These
diffraction spots can then be used to easily orient the crystal, especially if
one knows the crystal symmetry beforehand. In Fig. S1, we show the Laue image
for LaNiGa2. After alignment, samples are scored along the desired axis in
order to preserve alignment when performing ARPES. This is especially critical
for mounting samples in a known orientation for the thin-edge cleave.

Fig. S1: Laue image of LaNiGa2 sample showing the orientations of the a and c
axes. The red dots are the simulated diffraction peaks, taking into account
both the X-ray source intensity and the structure factor. The simulation well
distinguishes between the a and c axes. This orientation allows for samples to
be mounted on the thin edge with the desired axis normal to the sample holder.

##  IX Determining $k_{\perp}$

ARPES uses conservation of energy as well as momentum to probe electronic
structure of materials. In the case of momenta parallel to the surface, there
is no change in potential along that direction so momentum conservation is
trivial, modulo a momentum kick from the photon which is only relevant at much
higher photon energy than presently employed. However, in the case of momentum
perpendicular to the surface, there is a potential energy discontinuity due to
the termination of the crystal. That additional change provides an extra term
to the relevant energy for determining the momentum. As given in equation 1
below the additional term $V_{0}$, called the inner potential. This can be
determined experimentally by observing the periodicity of electronic structure
as a function of photon energy [35]. However, as discussed in the manuscript,
the extreme surface sensitivity of the present experiments tends to mute
dispersions in the $k_{\perp}$ direction, so additional methods are used.

$k_{\perp}=\frac{1}{\hbar}\sqrt{2m(E_{kin}\cos^{2}\theta+V_{0}})$ (1)

We determine the value of the inner potential to be $15eV$in order to align
features seen in the photon energy dependence of spectra with the following
justifications:

(1) Photon energy dependent stacked Fermi crossings, as seen in SI Fig. S2
provide a rough guide to the inner potential. However, because the observed
bands are quasi-2D they do not constrain the inner potential more than
$V_{0}\approx 17\pm 3eV$. Further attempts were made with other locations in
the BZ with similar results.

(2) Dispersion tracking as a function of photon energy, as seen in SI Fig. S3.
A band is reconstructed along $k_{\perp}$ and compared to band structure
calculations. $V_{0}$ is adjusted to yield the best agreement between
experiment and theory.

Strategies (1) and (2) allowed us to constrain the inner potential to be
$V_{0}\approx 15\pm 1eV$. Any further constraint would require multiple BZs of
periodicity to ascertain.

Fig. S2: Photon energy dependence of and near the $Z-T-A$ plane. The top and
bottom panel show constant binding energy contour ARPES maps over a range of
photon energies from $110eV$ to $144eV$. (Top) $k_{x}$ near the BZB boundary,
at the location shown by the solid red line in main text Fig. 4 (c). (Bottom)
On the $k_{z}=\pi/c$ plane, probing the SOC split Dirac lines and loop.
Overlaid on both are the DFT calculated Fermi crossings. Fig. S3: Photon
energy dependence of $Z-T$ line. (left) The dispersion measured along the
$Z-T$ measured in the thin-edge orientation. (right) Photon energy dependent
reconstruction of the $Z-T$ line from data taken in the natural orientation.
EDCs were taken at $k_{z}=\pi/c$ and $k_{x}=0$ and stacked at many photon
energies which reconstructs the $Z-T$ line from measurements on a natural
cleave. The perpendicular momentum ($k_{y}$) is displayed along the bottom
axis using an inner potential of $15eV$.

To ascertain which perpendicular momentum is probed with $144eV$ in the thin-
edge cleave ($k_{x}$ in this orientation), we compared the obtained Fermi
surface maps with the DFT calculations at multiple values of $k_{x}$. Three
nearby values of $k_{x}$ are shown in Fig. S4. Just a $0.08\AA^{-1}$
difference in $k_{x}$ changes makes an dramatic difference in the Fermiology,
and at $k_{x}=0.08\AA^{-1}$, there are experimental features, particularly
along $k_{y}=0\AA^{-1}$ which are no longer captured by the calculations, as
compared to the good fit for $k_{x}=0\AA^{-1}$ and $k_{x}=0.04\AA^{-1}$.
Because a constant kinetic energy probes a sphere in momentum space, the true
difference in measured $k_{x}$ from the center of the zone to the $k_{z}$
boundary ($\approx 0.7\AA^{-1}$) is approximately $0.05\AA^{-1}$. That
curvature along with the agreement of observed Fermiology to the DFT
calculations on the $k_{x}=0\AA^{-1}$ plane allow us to determine that a
photon energy of $144eV$ probes the $k_{x}=0\AA^{-1}$ plane within an
uncertainty of $\approx 0.04\AA^{-1}$.

Fig. S4: Comparison of Thin-edge 144eV Fermi Surface with Nearby Theory The
ARPES data is the same for all panels. It is a constant energy map at the
Fermi energy taken on the thin edge with a photon energy of $144eV$. The three
panels are overlaid with DFT calculations from different $k_{x}$ values.

##  X Other ways of visualizing nodal plane

In the main text, we showed bands merging as individual cuts approach the
nodal plane, and in Fig. S2 we demonstrate the same for an entire plane. This
Figure shows constant energy maps as a function of perpendicular momentum near
(top panel) and on (bottom panel) the $k_{z}$ BZ boundary, along with their
respective DFT overlays. This Figure was reconstructed from data collected in
the natural cleave geometry. In this image, the most prominently observed
bands are those corresponding to calculated bands FS 4 and 5 (blue, maroon).
There is a clear splitting of bands away from the BZ boundary and merging at
the BZ, across the whole probed plane.

Inspired by Fig. 8 of Y. Quan et al. [14], we show the ARPES spectra through
the predicted nodal points along $k_{x}$, $k_{y}$, and $k_{z}$ in Fig. S5.
These spectra are broadly consistent with the predicted electronic structure,
which is overlaid and colored corresponding to the Fermi surfaces they create.
The predicted SOC protected nodal crossings are highlighted by a pink circle.
Fig. S5 (a) was measured at 124eV in the natural cleave while (b) and (c) were
measured in the thin-edge orientation at 144eV. Panel (b) was reconstructed
from a deflector scan, as described in the first section of the SI.

Fig. S5: Spectra through the Predicted Nodal Points (a) ARPES spectrum along
the $k_{x}$ direction at a photon energy of 124eV in the natural cleave
orientation. (b) ARPES measured along $k_{y}$ at the zone boundary in the
thin-edge orientation. (c) ARPES measured along the $k_{z}$ axis in the thin-
edge orientation. All panels have DFT overlaid colored corresponding to the FS
they create. Locations of the predicted nodal points are highlighted with a
pink circle.

Fermi surface maps taken between 110 eV and 144 eV are shown in Fig. S6. The
nodal plane is oriented horizontally (at constant $k_{z}$) for each panel,
same as similar to Figures in the main text. ‘X’-shaped features are clearly
seen on the nodal plane in most of the Fermi surface maps, as further evidence
of the distinct Fermiology of this space group. These maps were produced using
an integration window of $50meV$ around the Fermi energy, and Fig. S7 shows
the Fermi surface map at 116eV produced with different integration windows.
With different integration windows, the consistency/inconsistency with DFT
calculations is unchanged, indicating that correspondence with theory is
unaffected by this variable.

Fig. S6: Constant energy maps at multiple photon energies Fermi surface maps
integrated $50meV$ around the Fermi energy are shown at a range of photon
energies from $110eV$ to $144eV$ in steps of $2eV$. Gray box in each Fig.
outlines the Brillouin zone boundary at that photon energy as determined by an
inner potential of $15eV$.  Fig. S7: Comparison of Energy Integration Windows
(a) Fermi surface map using a photon energy of $116eV$ and integrated $15meV$
around the Fermi level. (b) Same as (a) with an integration window of $50meV$.
Both panels have overlaid the calculated Fermi surface on the left half of the
data. Black and purple dashed lines indicate the BZ boundary along th $k_{x}$
and $k_{z}$ directions respectively.

##  XI XPS

In Fig. S8 we show a survey XPS scan of LaNiGa2 taken at a photon energy of
$144eV$. This spectrum shows all of the expected peaks for La, Ni, and Ga with
the addition of possible contamination of Al from the growth as well as Au
which was evaporated on the sample holder prior to cleaving the sample in
order to provide a Fermi level reference.

Fig. S8:  XPS of LaNiGa2 The XPS spectrum was taken at $144eV$. Black
annotations show the locations of all known La, Ni, and Ga peaks in the shown
binding energy range. The red annotations show the locations of likely
contaminant atoms from the growth and sample preparation methods to explain
unexpected peaks.


# A Lightweight Moving Target Defense Framework for Multi-purpose Malware
Affecting IoT Devices

Jan von der Assen1, Alberto Huertas Celdrán1, Pedro M. Sánchez Sánchez2,
Jordan Cedeño1,
Gérôme Bovet3, Gregorio Martínez Pérez2, Burkhard Stiller1 1Communication
Systems Group CSG, Department of Informatics, University of Zurich UZH,
CH–8050 Zürich, Switzerland
[vonderassen, huertas, cedeno<EMAIL_ADDRESS>2Department of Information
and Communications Engineering, University of Murcia, 30100–Murcia, Spain
[pedromiguel.sanchez<EMAIL_ADDRESS>3Cyber-Defence Campus, armasuisse
Science & Technology, CH–3602 Thun, Switzerland
<EMAIL_ADDRESS>
###### Abstract

Malware affecting Internet of Things (IoT) devices is rapidly growing due to
the relevance of this paradigm in real-world scenarios. Specialized literature
has also detected a trend towards multi-purpose malware able to execute
different malicious actions such as remote control, data leakage, encryption,
or code hiding, among others. Protecting IoT devices against this kind of
malware is challenging due to their well-known vulnerabilities and limitation
in terms of CPU, memory, and storage. To improve it, the moving target defense
(MTD) paradigm was proposed a decade ago and has shown promising results, but
there is a lack of IoT MTD solutions dealing with multi-purpose malware. Thus,
this work proposes four MTD mechanisms changing IoT devices’ network, data,
and runtime environment to mitigate multi-purpose malware. Furthermore, it
presents a lightweight and IoT-oriented MTD framework to decide what, when,
and how the MTD mechanisms are deployed. Finally, the efficiency and
effectiveness of the framework and MTD mechanisms are evaluated in a real-
world scenario with one IoT spectrum sensor affected by multi-purpose malware.

###### Index Terms:

Moving Target Defense, IoT devices, Multi-purpose malware

##  I Introduction

Society is experiencing a massive increment of Internet of Things (IoT)
devices deployed over multiple real-world scenarios such as industry, home,
health, transport, or agriculture. The IoT devices used in the previous
environments present particularities in terms of hardware, operating systems,
services, and data. However, there are also remarkable inter-scenario
similarities such as the connectivity to the internet and limitations in terms
of CPU, memory, and storage. These aspects, combined with the complexity of
deploying detection and mitigation cybersecurity mechanisms, make IoT devices
one of the most desired targets for cyberattacks [1].

Cybersecurity studies acknowledge this fact, since the number of cyberattacks
affecting heterogeneous IoT devices is increasing every year [2]. In addition,
cybercriminals are moving towards the usage of multi-purpose malware, where
malicious behaviors such as remote control, data leakage, encryption, mining,
code execution hiding, and other hostile actions can be perpetrated by
individual malware samples. This fact complicates the challenge of defending
IoT devices since detection and mitigation mechanisms must be varied, and they
usually consume many resources.

Assuming that perfect security is not realistic in any system, in 2009, a
novel cyberdefense paradigm called Moving target defense (MTD) was introduced
[3]. MTD proposes to continuously change different aspects (like, for example,
network, data, or runtime environment) of a given device or system to prevent
or mitigate ongoing or future cyberattacks. Therefore, the idea is to reduce
the attack surface and make it more difficult for attackers to exploit
vulnerabilities.

Despite the progress achieved by existing MTD-based solutions, as stated in
[4], a limited amount of work is dedicated to IoT devices. More in detail, the
following challenges are still open: ch1) lack of IoT MTD mechanisms moving
different parameters to mitigate multipurpose malware affecting data
integrity, availability, and confidentiality; ch2) lack of on-host systems
suitable for IoT devices and able to deploy MTD mechanisms proactively and
reactively, and ch3) lack of work evaluating the efficiency of MTDs in real
testbeds. To improve these challenges, the main contributions of this work
are:

  * •

Four MTD mechanisms changing the network, data, and runtime environment of IoT
devices to mitigate multi-purpose malware (covering ch1 and code available in
[5]).

  * •

A lightweight and IoT-oriented MTD framework able to decide what, when, and
how the proposed four MTDs are deployed in a reactive and proactive way
(covering ch2).

  * •

The evaluation of the effectiveness and efficiency of the framework and the
MTD mechanisms in a real-world scenario with a spectrum sensor affected by
multi-purpose malware showing behaviors of Botnet, Ransomware, Rootkit, and
Backdoor (covering ch3).

The remainder of this article is organized as follows. Section II reviews
existing IoT MTD mechanisms. While Section III presents four novel IoT MTDs,
Section IV provides a framework to manage them. Section V evaluates and
compares the framework performance and efficiency in a real-world scenario.
Finally, Section VI draws conclusions and next steps.

##  II Related Work

A recent review of IoT MTD techniques concludes that IoT MTD is still
immature, and novel techniques deployed in real-world scenarios should be
prioritized [4]. Moreover, the authors present WHAT, WHEN, and HOW as design
principles for MTDs. The WHAT represents the components of the system that are
changed to secure the system, being Network, Data, Software, Runtime
Environment, and Platform the most representative. The WHEN indicates the
moment in which the system should change the WHAT, and The HOW is the way in
which the WHAT is moved. Finally, the authors categorized the 32 existing IoT
MTD works according to the WHAT principle, where 54% focused on the network,
20% on runtime, 13% on software, 10% on data, and 3% on the platform.

Starting from the network category, the one with the most MTDs, [6] proposes
$\mu$MT6D, an MTD mechanism oriented to constrained devices that limit the
time window for reconnaissance attacks through IP address rotation. [7]
presents AShA, a method allowing a fast, secure, and collision-free address
renewal of IPv6. The previous two solutions have been tested in simulated
environments before the malware infection happens. In contrast, the work at
hand not only protects against network attacks (proactively and reactively)
but also against attacks affecting data and runtime environments. Continuing
with the runtime category, [8] proposes the combination of software and
hardware mitigation. From the software perspective, it uses a randomization
approach that modifies the layout of the executable code, preventing code-
reuse attacks. From hardware, it isolates the binary code to avoid exposing
executed code to attackers. Compared to the work at hand, this solution fails
against attacks manipulating links to libraries. Dealing with the data
category, [9] presents a side-channel resilient MTD mechanism for
electromagnetic-based side-channel attacks. The proposed solution applies
rekeying at suitable intervals to reduce the computational and communication
overhead. Another MTD focused on data is [10]. It proposes a Dynamic Key-
Length-Based Security Framework (DLSeF) that uses a shared key that is
frequently updated to ensure end-to-end security. Compared to the work at
hand, the previous two solutions do not prevent attacks affecting data
encryption.

TABLE I: Comparison of IoT MTD Mechanisms. Network (N), Runtime (R), Data (D), Proactive (Pr), Reactive (Re). Sol. Year |  Attack |  What |  How |  When |  Eval.
---|---|---|---|---|---
[6] 2018 |  C&C |  N |  IP Shuffle |  Pr |  Sim.
[7] 2019 |  C&C |  N |  IPv6 Shuffle |  Pr |  Sim.
[8] 2015 |  Code Reuse |  R |  Code Random. |  Pr |  HW
[9] 2020 |  Side-channel |  D |  Encryption Key |  Pr |  -
[10] 2016 |  Side-channel |  D |  App. Encr. Key |  Pr |  Sim.
Ours |  C&C, Ransomware, Rootkit, Backdoor |  N, R, D |  IP & Format Shuffle, Library Sanitation, Data Honeypot |  Pr, Re |  HW

TABLE I compares the main aspects covered by previous works. As can be seen,
attacks performed by recent malware able to encrypt and steal sensitive data,
change libraries, and hide themselves are not considered by existing MTDs.
Furthermore, most MTDs are evaluated in simulated scenarios. Finally, there is
no framework able to deploy MTD mechanisms when needed.

##  III IoT MTD mechanisms

This section presents novel MTD mechanisms to mitigate multi-purpose malware
controlling IoT devices, encrypting data, hiding malicious commands, or
leaking sensitive data.

###  III-A File Encryption

This novel reactive MTD mechanism creates a honeypot with dummy files on the
IoT device (victim). It traps ransomware in a dynamic expanding and collapsing
directory and file tree with dummy files, in the meanwhile the encrypting
process is discovered and killed. The goal is to keep as much data safe as
possible, while focusing exclusively on the encryption behavior shared by
multiple ransomware implementation. Related malicious phases commonly found in
Ransomware, such as cryptographic key exchange with a C&C server, are covered
by other MTD techniques.

Before providing the MTD details, it is important to know that most of the
existing ransomware samples recursively encrypt files. To mitigate it, first,
the proposed MTD is deployed in the directory in which files are being
encrypted. Then, it moves to a random existing subdirectory, and creates a new
subdirectory with dummy files. Once a given number of dummy files per
directory is created, it moves to a new subdirectory and repeats the process.
This movement is done because once the encryption on a directory starts, no
new files added to that directory are encrypted. Additionally, the MTD deletes
dummy files when they are encrypted to avoid depleting scarce disk space.
Figure 1 shows a flowchart with the previous steps. This creation of dummy
files is key to create a file-based honeypot that allows the ransomware to be
stalled and identified. Lastly, the MTD monitors all running processes to
identify and kill the encrypting process. For that, the CPU usage of all
processes is monitored, and all processes falling below a minimum threshold
are discarded due to encrypting files is a CPU-intensive task. In the next
step, processes included in a whitelist are filtered out. Finally, the MTD
monitors how many files are opened by each process of the suspicious list
within a minute. If the number of open files exceeds a configurable threshold,
the process is killed.

Figure 1: File Encryption Flowchart

###  III-B File Format

This novel reactive MTD shuffles the extensions of IoT sensors files to hide
them from malware such as backdoors and ransomware affecting data
availability, integrity, or confidentiality. This MTD relies on the fact that
some malware families select target files according to their extensions.

To achieve the previous functionality, this MTD creates pseudo extensions
consisting of alphanumeric strings randomly generated and replaces selected
file extensions with the pseudo ones. The MTD maintains a dictionary to track
the relationship between valid and pseudo extensions. When a new pseudo
extension is created, the MTD checks in the dictionary if it is valid or used.
This is done to avoid collisions during reconstruction. Then, once malware is
mitigated, the pseudo extensions are replaced with genuine ones.

###  III-C Libraries

This novel MTD changes the Linux runtime environment of the IoT sensor
reactively or proactively to reduce or mitigate manipulations of legitimate
libraries to execute malicious code (done by rootkits). More in detail, this
MTD sanitizes corrupted libraries and unlinks fake libraries.

When running applications on Linux, it is possible to preload needed libraries
through the LD_PRELOAD environment variable contained in the
/etc/ld.so.preload file. In particular, LD_PRELOAD links shared libraries that
are preloaded on the user-space, taking precedence over preloaded libraries of
the kernel-space. Therefore, malware like rootkits take advantage of this and
modify this environmental variable to preload malicious libraries hiding
themselves. Additionally, rootkits can unlink the /etc/ld.so.preload file from
the dynamic linker, and a malicious file is linked in its place. To prevent or
mitigate these behaviors, this MTD sanitizes i) the ld.so.preload file with a
backup containing the right value of the LD_PRELOAD variable, and ii) the
dynamic link to the /etc/ld.so.preload file. Regarding the first action, the
MTD guarantees that LD_PRELOAD points to the legitimate libc.so.6 library.
Therefore, typical malicious behaviors of rootkits such as files hiding or
disabled access files are prevented. Dealing with the second action, the MTD
overwrites the /lib/arm-linux-gnueabihf/ld-2.24.so file with the string
/etc/ld.so.preload to link again with the proper library.

###  III-D IP Address

This is an adaptation of existing MTD mechanisms shuffling the IP address of
IoT devices (victim) to mitigate the impact of malware based on C&C (like
Botnets). The main difference compared to related work is that it works with
private addresses and can be executed proactively or reactively to disrupt the
communication between the IoT sensor and C&C. The MTD is designed so that it
cuts communication to all types of C&C servers, whether the server is running
on the device or on an external host (locally or publicly reachable).

From the implementation perspective, the MTD mechanism creates a list with all
IP addresses available in the private network where the IoT device is
connected. It is done by generating a list with all IP addresses of the
private network and then removing the IPs assigned to active devices (obtained
with the arp-scan command). After that, a given IP address from the list is
randomly chosen, and the IoT device requests to migrate to that IP using
ifconfig. Then, the MTD checks if there is internet connectivity. If so, the
migration is successful, and the legitimate services of the IoT device are
restarted. If there is no connectivity, the MTD removes the IP from the list
of possible ones, chooses a new IP, and checks its connectivity. This sequence
is repeated until a successful migration.

##  IV Lightweight Hybrid MTD Framework

This section presents a novel MTD framework for IoT devices. The framework
objective is to decide WHEN, HOW, and WHAT MTD mechanisms explained in Section
III should be deployed to mitigate multi-purpose malware. Figure 2 shows the
modules and components of the proposed framework, which are all deployed on
the IoT device.

Figure 2: IoT-oriented MTD Framework Architecture

  * •

MTD Decision. This module decides WHEN to deploy MTD mechanisms.

  * •

MTD Enforcement. This module deals with HOW and WHAT MTD mechanisms are
deployed.

The MTD Decision module focuses on WHEN to deploy MTD mechanisms according to
proactive and reactive criteria. For the proactive approach, the system
administrator defines in the Action or Time Rule component the actions or time
windows that need to be met by the IoT device to deploy MTDs. Periodically,
the Engine component checks the criteria and sends an alarm to the MTD
Enforcement module. This approach is the most lightweight and does not need
previous knowledge to make the WHEN decision. However, the lack of information
also complicates further decisions about HOW and WHAT MTD should be deployed.

The reactive approach can facilitate this decision, but it increases the
computational complexity and decision time of the MTD Decision module. In
particular, the reactive process decides WHEN to deploy MTDs according to the
output of a supervised Machine Learning (ML)-based process able to classify
the IoT device behavior. More in detail, first, the Data Acquisition component
periodically collects kernel events of the IoT device related to CPU, memory,
file system, network interface, scheduler, drivers, and random numbers usage.
Then, the Data Curation component preprocesses the events and extracts
relevant features. Feature vectors are stored and labeled in a dataset created
by the Dataset Generation component. The monitoring, data curation, and
dataset generation processes are repeated for normal and malicious behaviors
of multi-purpose malware. After that, the Algorithm Selection component
selects a set of classification algorithms, the Model Training trains the ML
models with the created dataset, and the Model Evaluation detects the IoT
device behavior, which is sent to the upper module.

The MTD Enforcement module decides HOW and WHAT MTD mechanism (proposed in
Section III) should be deployed according to the outputs of the previous
module. For that, the Selection & Deployment component defines a set of rules
deciding the MTD mechanisms that should be deployed. If the IoT device
behavior is available (reactive approach), it deploys the most suitable MTD
for that behavior. If not (proactive approach), all proactive MTDs are
deployed simultaneously. An example of policies is provided below.

  * •

If [Rootkit] $\rightarrow$ deploy [Libraries MTD]

  * •

If [Ransomware] $\rightarrow$ deploy [File Encryption MTD]

  * •

If [Botnet] $\rightarrow$ deploy [IP Address MTD]

  * •

If [Backdoor] $\rightarrow$ deploy [File Format MTD]

  * •

If [action] or [time] $\rightarrow$ deploy [File Format MTD] and [IP Address
MTD] and [Libraries MTD]

##  V MTD Framework Efficiency and Effectiveness

It describes the implementation and the experimental results achieved by the
MTD framework when deployed on a real IoT spectrum sensor affected by multi-
purpose malware.

###  V-A IoT Spectrum Sensors Affected by Multi-purpose Malware

The IoT evolution has brought Radio Frequency crowdsensing platforms to
reality, offering the optimization of spectrum usage. However, sensors used by
these platforms are resource-constrained devices with well-known
vulnerabilities and limitations to deploy complex cybersecurity mechanisms.
Attackers are aware of this fact, and the increment of multi-malware affecting
IoT devices proves it.

In the context of malware affecting IoT devices, this work has considered
ElectroSense [11], a real-world, open-source, and crowdsensing solution that
uses Raspberry Pis to continuously send RF spectrum data gathered from
connected software-defined radio kits. In particular, this work has deployed
an ElectroSense sensor in a Raspberry Pi 4 with 1.5 GHz CPU and 3.7 GB RAM.
The Raspberry Pi 4 executes the official and publicly available ElectroSense
software, and is connected to a local area network with access to the
Internet. Then, the device has been infected with multi-purpose malware such
as Bashlite (botnet); Ransomware_PoC (ransomware); Beurk and Bdvil (rootkit);
and TheTick, PythonBackdoor and httpBackdoor (backdoor). All these malware
samples and some others can be found and downloaded through [12]. Furthermore,
since the main contribution of this work focuses on MTD techniques and not
malware detection, other malware samples detectable by the proposed solution
can be found in the previous work. These malware samples can be executed by
exploiting weak passwords or well-known vulnerabilities of IoT devices network
services such as SSH or Telnet. Furthermore, their functionality is to control
sensors remotely, encrypt data, hide malicious actions, leak sensitive data,
or execute malicious code. Finally, the impact of these behaviors on spectrum
sensors is to i) disrupt crowdsensing platforms services, ii) execute
Distributed-Denial of Service (DDoS) attacks, or iii) perform lateral movement
attacks.

###  V-B MTD Decision Module: ML-based Reactive

For optimal deployment of MTD mechanisms, detecting the malicious behavior of
IoT spectrum sensors is needed. In this sense, the Data Acquisition component
uses kernel software events, present in any Linux system due to their
flexibility and variety. To monitor this dimension, perf Linux tool is
selected, monitoring $\approx$80 values from different event families such as
network, memory, file system, CPU, process scheduler, or device drivers. Every
5 s, The monitoring collects the data of the previous metrics, considering all
processes running in the sensor. Then an extra processing time is required for
perf to calculate and return the values. TABLE II shows the resource usage of
the Data Acquisition component. As it can be appreciated, it implies a low
resource consumption, with only a maximum 4% of usage in one CPU core.
Besides, the complete perf monitoring and data processing loop is performed in
$\approx$10 s, which is an acceptable monitoring time for early malware
detection.

TABLE II: Behavior Monitoring Resource Consumption. Monitoring Time |  Processing Time |  CPU Usage |  Memory Usage |  Storage Usage
---|---|---|---|---
5 secs |  $\approx$5.21 secs |  1-4 % |  6.14 MB |  6.98 kB

After that, since the framework uses supervised ML/DL algorithms, it is
necessary to monitor each behavior to allow the algorithms to be trained and
generate models capable of differentiating malicious activities. Therefore,
normal (uninfected) behavior and the different malware samples (Beurk, Bdvl,
Bashlite, Ransomware_PoC, HttpBackdoor, PythonBackdoor, and TheTick) are
monitored for a minimum of six hours. In total, $\approx$2160 vectors are
available per behavior, making up a dataset of $\approx$21600 vectors and
$\approx$6.78 MB.

For attack identification, k-NearestNeighbors (k-NN), Support Vector Machine
(SVM), XGBoost (XGB), Decision Tree (DT), Random Forest (RF), and Multi-Layer
Perceptron (MLP) are tested. Then, the available dataset is divided into 80%
for training (including cross-validation) and 20% for testing. Besides, data
standardization has been applied using min-max for the algorithms that require
normalization. TABLE III shows the classification results per model in terms
of average F1-Score. RF and XGB are the models providing the best performance
with a 0.98 average F1-Score. For deployment, RF is selected due to its
shorter training time and lower memory and storage usage. In this sense, the
training in the RPi4 takes $\approx$39.46 secs (using one CPU core at 100%),
while the preprocessing and evaluation of a single vector takes
$\approx$0.0427 s. Besides, the model needs 89.55 MB in memory and storage,
since pickle library is used to serialize the binary object from memory to a
file.

TABLE III: F1-Score per Classification Algorithm. Algorithm |  k-NN |  SVM |  XGB |  DT |  RF |  MLP
---|---|---|---|---|---|---
Avg. F1-Score |  0.88 |  0.94 |  0.98 |  0.97 |  0.98 |  0.95

Finally, Figure 3 shows the confusion matrix for the classification of each
behavior and malware. It can be seen that almost all behaviors are correctly
classified, only having trouble detecting the 25% of the times the Data Leak
attack when using TheTick backdoor.

Figure 3: RF Confusion Matrix

In conclusion, the ML-based Reactive component takes $\approx$10 s to
accurately detect normal and malicious behaviors when deployed as part of the
MTD framework (only a few false positives for Data Leak are present). In
addition, the consumption of CPU, RAM, and storage during monitoring and model
training/evaluation is acceptable for IoT spectrum sensors implemented in
Raspberry Pis.

###  V-C MTD Enforcement Module: Deploying MTD Mechanisms

A set of experiments has been conducted to analyze the efficiency and
effectiveness of the framework and the four MTD mechanisms. On the one hand,
to evaluate the reactive deployment of MTD mechanisms, each experiment: i)
infects the IoT spectrum sensor with the appropriate malware, ii) detects the
malware and malicious behavior, and iii) deploys the MTD mechanism. On the
other hand, the MTD deployment relies on time intervals for proactive
evaluation.

TABLE IV shows the duration of each phase (highlighting the runtime of the
respective malicious behavior or MTD technique), the CPU, RAM, time, and I/O
blocks/s used in the sensor. In addition, it shows the KB/s sent by the
spectrum scanning process. Finally, these metrics are measured for i) the
spectrum sensor (with and without MTD framework), and ii) the MTDs deployed
reactively and proactively.

TABLE IV: Effectiveness and Efficiency of MTD Enforcement Scenario |  Duration |  CPU |  RAM |  I/O |  Spectrum
---|---|---|---|---|---
|  [s] |  [%] |  [%] |  [Blocks/s] |  [KB/s]
Sensor |  1035 |  23.37 |  15.53 |  0/0 |  16.34
MTD Framework |  1035 |  23.94 |  15.99 |  0/0.3 |  15.86
Reactive MTD |  |  |  |  |
Botnet |  42 |  22.75 |  8.44 |  0/1.5 |  16.31
C&C MTD |  12 |  19 |  8.43 |  0/6 |  15.10
Data Leak |  112 |  29.33 |  14.27 |  2/1 |  15.28
File Format MTD |  56 |  35.20 |  14.29 |  3.60/1.50 |  15.14
Backdoor |  112 |  22 |  17.27 |  0/0.25 |  15.85
C&C MTD |  14 |  21.5 |  17.46 |  0/1 |  9.37
Ransomware |  84 |  83.86 |  9.85 |  79/572 |  15.50
Encryption MTD |  70 |  90.66 |  9.89 |  93/667 |  15.64
Rootkit |  42 |  27.50 |  13.43 |  0/0.5 |  15.40
Libraries MTD |  12 |  34.00 |  13.45 |  0/2 |  15.30
Proactive MTD |  |  |  |  |
Rootkit |  29 |  40 |  11.71 |  0/25 |  16.51
Libraries MTD |  1035 |  25.82 |  11.63 |  0/5.49 |  16.26

As can be seen, the MTD framework resource consumption in the background is
minimum. For proactive and reactive deployment, the MTD mechanisms differ in
mitigation time. For example, data leakage behavior impacts the device during
112 s. Upon deploying the File Format MTD which operated for 56 s, critical
files are protected so that only 11 MB of data were leaked out of 300 MB of
PDF files. Furthermore, the CPU, RAM, I/O, and data collected by the sensor of
the phase where the malware is running can be compared to the row underneath
showing the impact of malware and MTD operation. From that, it can be
concluded that for all MTD techniques, the resource impact is minimal when
deployed reactively. From the proactive deployment perspective, the Libraries
MTD does not impact the sensing service. Thus, the MTD is deployed every
minute, leading to successful disinfection of rootkits and backdoors after 29
s with negligible impact on resources.

In terms of CPU consumption, Ransomware, and the File Encryption MTD have the
strongest impact as presented in Figure 4. Here, the three stages consisting
of (1) encryption, (2) MTD operation, and (3) termination of the encryption
process, are presented. Although the creation of files adds to the resource
consumption, the execution of the ransomware is limited to 84 s. Furthermore,
due to the creation of dummy files, only 7.1 MB of data are encrypted until
the malware is detected.

$250$$350$$450$$0$$25$$50$$75$$100$(1)(2)(3)Time [s]System Resource Usage
[%]CPURAMDisk ReadDisk Write Figure 4: Device Resource Impact When Mitigating
Ransomware

##  VI Summary and Findings

This work presents four IoT MTD mechanisms focused on i) generating dummy
files to trap encrypting processes, ii) manipulating file extensions to reduce
data leakages, iii) sanitizing libraries to inhibit actions hiding, and iv)
shuffling IP addresses to avoid remote control. These four MTD mechanisms are
selected and deployed by a proposed hybrid IoT-oriented framework. The
framework presents a modular architecture that uses i) ML-based behavior
classification or predefined rules to decide WHEN MTD mechanisms should be
applied, and ii) a rule-based module to decide HOW and WHAT MTD mechanisms are
deployed. The framework has been deployed on a real IoT spectrum sensor, where
its effectiveness and efficiency were evaluated with different multi-purpose
malware showing behaviors of botnets, ransomware, backdoors, and rootkits. The
ML-based Reactive process achieved an average of 0.98 F1-Score using Random
Forest and took about 10 s to classify normal and malicious behaviors.
Finally, the performance of the implemented MTD techniques has been verified
in terms of attack mitigation and resource consumption, stopping all the
attacks satisfactorily and with low impact on CPU, RAM, disk, and sensing
spectrum services. Thus, the framework and experiments conducted therewith
address key challenges of MTD, such as the evaluation of MTD in real IoT
platforms and the deployment of MTD in an intelligent and resource efficient
way.

As future work, the optimization of the implemented MTD techniques is planned
together with the development of new MTD mechanisms against other malware
behaviors. Besides, it is planned to add Reinforcement Learning to the MTD
Enforcement module, making it fully automated and adaptive.

## Acknowledgments

This work has been partially supported by (a) the Swiss Federal Office for
Defense Procurement (armasuisse) with the CyberTracer and RESERVE
(CYD-C-2020003) projects and (b) the University of Zürich UZH.

## References

  * [1] P. M. Sánchez, J. M. Jorquera, A. Huertas, G. Bovet, M. Gil, and G. Martínez, “A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets,” _IEEE Communications Surveys & Tutorials_, 2021.
  * [2] M. Alsheikh, L. Konieczny, M. Prater, G. Smith, and S. Uludag, “State and Trends of IoT Security: Unequivocal Appeal to Cybercriminals, Onerous to Defenders,” _IEEE Consumer Electronics Magazine_ , 2021.
  * [3] G.-l. Cai, B.-s. Wang, W. Hu, and T.-z. Wang, “Moving Target Defense: State of the Art and Characteristics,” _Frontiers of Information Technology & Electronic Engineering_, vol. 17, no. 11, pp. 1122–1153, 2016.
  * [4] R. E. Navas, F. Cuppens, N. Boulahia Cuppens, L. Toutain, and G. Z. Papadopoulos, “MTD, Where Art Thou? A Systematic Review of Moving Target Defense Techniques for IoT,” _IEEE Internet of Things Journal_ , vol. 8, no. 10, pp. 7818–7832, 2021.
  * [5] J. Cedeno, “MTD Framework and Mechanisms,” https://github.com/CortexVacua/MTDFramework, 2022, last accessed: Sept, 2022\.
  * [6] K. Zeitz, M. Cantrell, R. Marchany, and J. Tront, “Changing the Game: A Micro Moving Target IPv6 Defense for the Internet of Things,” _IEEE Wireless Communications Letters_ , vol. 7, no. 4, pp. 578–581, 2018.
  * [7] F. Nizzi, T. Pecorella, F. Esposito, L. Pierucci, and R. Fantacci, “IoT Security via Address Shuffling: The Easy Way,” _IEEE Internet of Things Journal_ , vol. 6, no. 2, pp. 3764–3774, 2019.
  * [8] J. Habibi, A. Gupta, S. Carlsony, A. Panicker, and E. Bertino, “MAVR: Code Reuse Stealthy Attacks and Mitigation on Unmanned Aerial Vehicles,” in _2015 IEEE 35th International Conference on Distributed Computing Systems_ , 2015, pp. 642–652.
  * [9] S. Vuppala, A. E.-D. Mady, and A. Kuenzi, “Moving Target Defense Mechanism for Side-Channel Attacks,” _IEEE Systems Journal_ , vol. 14, no. 2, pp. 1810–1819, 2020.
  * [10] D. Puthal, S. Nepal, R. Ranjan, and J. Chen, “DLSeF: A Dynamic Key-Length-Based Efficient Real-Time Security Verification Model for Big Data Stream,” _ACM Transactions on Embedded Computing Systems_ , vol. 16, no. 2, 2016.
  * [11] ElectroSense, “Collaborative Spectrum Monitoring,” https://electrosense.org, 2021, last accessed: Sept, 2022.
  * [12] A. Huertas, P. M. Sánchez, M. Azorín, G. Bovet, G. Martínez, and B. Stiller, “Intelligent and behavioral-based detection of malware in iot spectrum sensors,” _International Journal of Information Security_ , pp. 1–21, 2022.