Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

RATScope: Recording and Reconstructing Missing RAT Semantic Behaviors for Forensic Analysis on Windows

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

A Posture Recognition System for Rat Cyborg Automated Navigation

Remote access trojan traffic early detection method based on Markov matrices and deep learning

MBTree: Detecting Encryption RATs Communication Using Malicious Behavior Tree

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Enabling the Remote Acquisition of Digital Forensic Evidence through Secure Data Transmission and Verification

ProPatrol: Attack Investigation via Extracted High-Level Tasks

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

RAT: Reinforcement-Learning-Driven and Adaptive Testing for Vulnerability Discovery in Web Application Firewalls

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System

Forensic analysis of the Windows telemetry for diagnostics

A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence

High Fidelity Data Reduction for Big Data Security Dependency Analyses.

reAnalyst: Scalable Analysis of Reverse Engineering Activities

Zebra: Deeply Integrating System-Level Provenance Search and Tracking for Efficient Attack Investigation

TAICHI: Transform Your Secret Exploits into Mine from a Victim's Perspective

EthScope: A Transaction-centric Security Analytics Framework to Detect Malicious Smart Contracts on Ethereum.

Enabling Efficient Cyber Threat Hunting with Cyber Threat Intelligence