Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices

Malicious Code Detection on Smart Meters -A Side-Channel Based Approach

Power IoT System Security Monitoring Based on Power Consumption Side Channel Information.

ADDP: Anomaly Detection for DTU Based on Power Consumption Side-Channel

Current Events: Identifying Webpages by Tapping the Electrical Outlet.

Malicious Code Detection Scheme Based on CWRNN for Microgrid Controllers

OutletSpy

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

Malware Detection on General-Purpose Computers Using Power Consumption Monitoring: A Proof of Concept and Case Study

TPE-Det: A Tamper-Proof External Detector via Hardware Traces Analysis Against IoT Malware

Using Power-Anomalies to Counter Evasive Micro-Architectural Attacks in Embedded Systems

Using Side Channel Information and Artificial Intelligence for Malware Detection

Smart Devices Security Enhancement via Power Supply Monitoring

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Power-Based Non-Intrusive Condition Monitoring for Terminal Device in Smart Grid

Towards Obfuscated Malware Detection for Low Powered IoT Devices

Intelligent Electromagnetic Sensors for Non-Invasive Trojan Detection

MPSD: A Robust Defense Mechanism against Malicious PowerShell Scripts in Windows Systems

POW-HOW: An enduring timing side-channel to evade online malware sandboxes

XMD: An Expansive Hardware-telemetry based Mobile Malware Detector to enhance Endpoint Detection

A Survey on Hardware-Based Malware Detection Approaches