Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

Key-area Cyberspace Mimic Defense Against Data-Oriented Attacks

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Mimic Defense: a Designed-in Cybersecurity Defense Framework.

Optimal Strategy for Cyberspace Mimic Defense Based on Game Theory

A Novel Framework for Zero-Day Attacks Detection and Response with Cyberspace Mimic Defense Architecture

An Input-Aware Mimic Defense Theory and its Practice

An Optimal Seed Scheduling Strategy Algorithm Applied to Cyberspace Mimic Defense

A Framework for Mimic Defense System in Cyberspace

A Decentralized Multi-ruling Arbiter for Cyberspace Mimicry Defense

A function-aware mimic defense theory and its practice

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Mimic Defense Technology

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Anti-Attacking Modeling and Analysis of Cyberspace Mimic DNS

Research on Cyberspace Mimic Defense Based on Dynamic Heterogeneous Redundancy Mechanism

Active Security Control Approach Against DoS Attacks in Cyber-Physical Systems

Taming the War in Memory: A Resilient Mitigation Strategy Against Memory Safety Attacks in CPS

Scheduling Sequence Control Method Based on Sliding Window in Cyberspace Mimic Defense

MDFS: A Mimic Defense Theory Based Architecture for Distributed File System

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack