Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

MDIplier: Protocol Format Recovery Via Hierarchical Inference

Automatic Protocol Reverse Engineering for Industrial Control Systems with Dynamic Taint Analysis

ABInfer: A Novel Field Boundaries Inference Approach for Protocol Reverse Engineering

DIFORMER: an Attention-Based IoT Device Identification Method

DM-CIFA: Detection and Mitigation of Collusion Interesting Flooding Attacks in NDNs

DynPRE: Protocol Reverse Engineering Via Dynamic Inference

Towards Automatically Reverse Engineering Vehicle Diagnostic Protocols

NetPlier: Probabilistic Network Protocol Reverse Engineering from Message Traces.

PREIUD: An Industrial Control Protocols Reverse Engineering Tool Based on Unsupervised Learning and Deep Neural Network Methods

Reverse Engineering Industrial Protocols Driven by Control Fields

A Semantics Aware Approach to Automated Reverse Engineering Unknown Protocols

BinPRE: Enhancing Field Inference in Binary Analysis Based Protocol Reverse Engineering

Protocol Specification Inference Based on Keywords Identification

Exploiting Intra-Packet Dependency for Fine-Grained Protocol Format Inference

Lifting Network Protocol Implementation to Precise Format Specification with Security Applications

Rethinking robust and accurate application protocol identification.

Sub-messages extraction for industrial control protocol reverse engineering

Rethinking Robust and Accurate Application Protocol Identification: A Nonparametric Approach

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Network Message Field Type Classification and Recognition for Unknown Binary Protocols

DeepMDR: A Deep-Learning-Assisted Control Plane System for Scalable, Protocol-Independent, and Multi-Domain Network Automation