Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

ShellCore: Automating Malicious IoT Software Detection by Using Shell Commands Representation

ShellCore: Automating Malicious IoT Software Detection Using Shell Commands Representation

Understanding and Detecting Remote Infection on Linux-based IoT Devices

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Deep Neural Networks for Enhanced Security: Detecting Metamorphic Malware in IoT Devices

Webshell Detection Technology Based on Deep Learning

Performance Evaluation of Deep Learning Techniques in The Detection of IOT Malware

Understanding Internet of Things malware by analyzing endpoints in their static artifacts

Machine learning-based malware detection for IoT devices using control-flow data

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

Cyber Security Threats Detection in Internet of Things Using Deep Learning Approach

Malware Squid: A Novel IoT Malware Traffic Analysis Framework using Convolutional Neural Network and Binary Visualisation

Artificial intelligence-driven malware detection framework for internet of things environment

Malware Detection in Internet of Things (IoT) Devices Using Deep Learning

Deep Learning Based XIoT Malware Analysis: A Comprehensive Survey, Taxonomy, and Research Challenges

Enhancing Smart IoT Malware Detection: A GhostNet-based Hybrid Approach

Understanding Linux Malware

Linux IoT Malware Variant Classification Using Binary Lifting and Opcode Entropy

Improving Robustness in IoT Malware Detection through Execution Order Analysis

Deep learning hybridization for improved malware detection in smart Internet of Things

Harnessing the Power of Decision Trees to Detect IoT Malware