## 1 Introduction  
The next-generation Internet drives a fundamental shift in the underlying networking architecture to enable dynamic deployment of applications in heterogeneous networks. Network virtualization, which is one of the key technologies, allows multiple logical networks to coexist on a shared hardware platform [1; 2; 3; 4]. Virtualized network infrastructure introduces the idea of programability in data plane of routers, which facilitates the dynamic deployment of applications and services [5; 6]. In accordance with such technology trends, many networking hardware vendors provide virtual routers, such as Cisco CSR1000v Series and Huawei AR1000V routers, which can be deployed on a virtual machine (VM) on x86 commodity servers.  
Implementing all layers of networking functions in virtual routers as software leads to the increase of vulnerabilities, which raises potential to compromise the network via a wide range of attack surfaces [7; 8; 9]. Sitting on layer 3, routers play a vital role in networking by connecting distinct networks and forwarding IP traffic across networks. Hence, once a router has been compromised, attackers may not only gain control over the entire network, but also obtain sensitive information by eavesdropping forwarded packets. As observed from the exposure by former NSA contractor [PERSON] and the recently discovered Cisco IOS software attack dubbed SYnful Knock [10], the great potential of subverting network devices propels many criminals and state-sponsored hackers to pursue security vulnerabilities in routers for benefits.  
Remote code execution attacks, caused by memory manipulation errors in software such as stack (or heap) overflow, comprise most infection vectors to compromise network devices [10; 11]. Such kind of attacks affect control flow of the infected software, thus inherently leave footprints in the target's memory [12]. Host-based intrusion detection techniques can mitigate such memory corruption attacks by using the clues that influence the integrity of the memory.  
To prevent network devices from being compromised by remote code execution attacks, intrusion detection system should be deployed to monitor the integrity of memory in network devices [9; 13; 14]. However, a key problem in network devices is that it is difficult or even infeasible to implement host-based detection techniques, which have been proven to be a successful solution in general purpose operating systems for a long time. That comes from the fact that a network device has a closed, special purpose operating system in which any third-party applications is not allowed to be installed and executed.  
In this paper, we propose a novel intrusion detection technique for network devices. Our solution uses virtualization technology, and deploys a VM instance that emulates a target network device by running the same firmware image as the target. By configuring the network so that all traffic designated to the target are mirrored to the VM instance, all remote code executions triggered by malicious packets would be captured in memory of the virtual machine. This way, our solution provides a framework for successful detection of any intrusions leaving memory footprints.  
The rest of this paper is organized as follows. Related work is summarized in Section 2, and design goals and challenges are presented in Section 3. Details of the system construction and the experiment as well as evaluation are given in Sections 4 and 5, respectively. Finally, we conclude the paper in Section 6.