This repository is a curated list of resources for embedded systems vulnerability research, not a software application or data pipeline. It aggregates books, blog posts, conference talks, papers, tools, and other references organized by category (e.g., Books, YouTube channels, Blogs, Papers, Tools). The primary content is a single README.md file containing over 200 links and brief descriptions. Additionally, the papers/ directory holds a few PDF files of research papers and a secondary README listing paper titles with links. The repo serves as a knowledge base for anyone interested in IoT/embedded security, providing a starting point for learning and staying current. There is no executable code, no data transformation logic, and no analytical models. The value lies in the curation and organization of external resources, not in any original software or data processing.
SpyGuard is a network traffic analysis tool designed for detecting signs of compromise, particularly stalkerware and spyware, by monitoring WiFi traffic from connected devices. It consists of a frontend Vue.js 3 application for user interaction and capture initiation, and a backend Flask API for managing configuration, threat intelligence, and analysis. The core analysis engine processes PCAP files using Suricata, checks traffic against IOC databases and whitelists, performs heuristic and active checks (passive DNS, WHOIS, SSL validation), and generates JSON/PDF reports. External watchers periodically update threat intelligence feeds from sources like Cisco Umbrella and IP-to-ASN mappings. The architecture separates concerns: frontend handles capture UI and device management, backend provides authenticated APIs for system administration, and the analysis engine performs the detection logic. Key entry points include server/frontend/main.py (frontend service), server/backend/main.py (backend API), server/backend/watchers.py (threat intelligence updater), and analysis/analysis.py (analysis trigger).