Abstract:The number of Cyber-Physical Systems (CPS) available in industrial environments is growing mainly due to the evolution of the Internet-of-Things (IoT) paradigm. In such a context, radio frequency spectrum sensing in industrial scenarios is one of the most interesting applications of CPS due to the scarcity of the spectrum. Despite the benefits of operational platforms, IoT spectrum sensors are vulnerable to heterogeneous malware. The usage of behavioral fingerprinting and machine learning has shown merit in detecting cyberattacks. Still, there exist challenges in terms of (i) designing, deploying, and evaluating ML-based fingerprinting solutions able to detect malware attacks affecting real IoT spectrum sensors, (ii) analyzing the suitability of kernel events to create stable and precise fingerprints of spectrum sensors, and (iii) detecting recent malware samples affecting real IoT spectrum sensors of crowdsensing platforms. Thus, this work presents a detection framework that applies device behavioral fingerprinting and machine learning to detect anomalies and classify different botnets, rootkits, backdoors, ransomware and cryptojackers affecting real IoT spectrum sensors. Kernel events from CPU, memory, network, file system, scheduler, drivers, and random number generation have been analyzed, selected, and monitored to create device behavioral fingerprints. During testing, an IoT spectrum sensor of the ElectroSense platform has been infected with ten recent malware samples (two botnets, three rootkits, three backdoors, one ransomware, and one cryptojacker) to measure the detection performance of the framework in two different network configurations. Both supervised and semi-supervised approaches provided promising results when detecting and classifying malicious behaviors from the eight previous malware and seven normal behaviors. In particular, the framework obtained 0.88–0.90 true positive rate when detecting the previous malicious behaviors as unseen or zero-day attacks and 0.94–0.96 F 1-score when classifying them.

Automatic Analysis Architecture of IoT Malware Samples

Automatic Detection and Analysis Towards Malicious Behavior in IoT Malware

Malton: Towards On-Device Non-Invasive Mobile Malware Analysis for ART.

A Survey on Cross-Architectural IoT Malware Threat Hunting

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

Cross-Architecture Intemet-of-Things Malware Detection Based on Graph Neural Network

MTHAEL: Cross-Architecture IoT Malware Detection Based on Neural Network Advanced Ensemble Learning.

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

Understanding Internet of Things malware by analyzing endpoints in their static artifacts

Exploit Internal Structural Information for IoT Malware Detection Based on Hierarchical Transformer Model

Malware Analysis in IoT & Android Systems with Defensive Mechanism

Adversarial Samples on Android Malware Detection Systems for IoT Systems.

Improving Robustness in IoT Malware Detection through Execution Order Analysis

Machine learning-based malware detection for IoT devices using control-flow data

IoTCMal: Towards A Hybrid IoT Honeypot for Capturing and Analyzing Malware

Artificial intelligence-driven malware detection framework for internet of things environment

Automatic Investigation Framework for Android Malware Cyber-Infrastructures

A Light-Weight Malware Static Visual Analysis For Iot Infrastructure

MalIoT: Scalable and Real-time Malware Traffic Detection for IoT Networks

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Intelligent and behavioral-based detection of malware in IoT spectrum sensors