Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

Hardware Performance Counter-Based Malware Identification and Detection with Adaptive Compressive Sensing

A Survey on Hardware-Based Malware Detection Approaches

CSMC: A Secure and Efficient Visualized Malware Classification Method Inspired by Compressed Sensing

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

A malware detection framework based on kolmogorov complexity

A Survey of Cyber Security Countermeasures Using Hardware Performance Counters

Anomaly Detection for malware identification using Hardware Performance Counters

Enabling Micro AI for Securing Edge Devices at Hardware Level

Comprehensive Efficiency Analysis of Machine Learning Algorithms for Developing Hardware-Based Cybersecurity Countermeasures

XMD: An Expansive Hardware-telemetry based Mobile Malware Detector to enhance Endpoint Detection

Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters

Hyperspectral Image Recovery via Reliability-Weighted Compressed Sensing for Hardware Trojan Detection

Transparency and Semantics Coexist: When Malware Analysis Meets the Hardware Assisted Virtualization

Malware Analysis Using Machine Learning and Deep Learning Techniques

Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

Optimizing Malware Detection in IoT Networks: Leveraging Resource-Aware Distributed Computing for Enhanced Security

Malware Profiler Based on Innovative Behavior-Awareness Technique

EMMA: A New Platform to Evaluate Hardware-based Mobile Malware Analyses

Acceleration of Statistical Detection of Zero-day Malware in the Memory Dump Using CUDA-enabled GPU Hardware