Abstract:With the widespread use of Internet of Things (IoT) devices, malware detection has become a hot spot for both academic and industrial communities. Existing approaches can be roughly categorized into network-side and host-side. However, existing network-side methods are difficult to capture contextual semantics from cross-source traffic, and previous host-side methods could be adversary-perceived and expose risks for tampering. More importantly, a single perspective cannot comprehensively track the multi-stage lifecycle of IoT malware. In this paper, we present ${\sf CMD}$ , a co-analyzed IoT malware detection and forensics system by combining hardware and network domains. For the network part, ${\sf CMD}$ proposes a tailored capsule neural network to capture the contextual semantics from cross-source traffic. For the hardware part, ${\sf CMD}$ designs an entire file operation recovery process in a side-channel manner by leveraging the Serial Peripheral Interface (SPI) signals from on-chip traces. These traffic provenance and operating logs information could benefit the anti-virus countermeasures for security practitioners. By practical evaluation, we demonstrate that ${\sf CMD}$ realizes outstanding detection effects ( e.g., $\sim$ 99.88% F1-score) compared with seven state-of-the-art methods, and recovers 96.88% $\sim$ 99.75% operation commands even if against adaptive adversaries (that could kill processes or tamper with operation log files). A by-product benefit of such an external monitor is ${\sf CMD}$ introduces zero latency on the IoT device, and incurs negligible IoT CPU utilization. Also, since SPI focuses on file operations, the proposed hardware trace forensics does not have the data explosion problem like previous work, e.g., recovered logs of ${\sf CMD}$ only take up limited extra space overhead ( e.g., $\sim$ 0.2 MB per malware). Furthermore, we provide the model interpretability for the capsule network and develop a case study (Hajime) of the operation logs recovery.

Enabling Micro AI for Securing Edge Devices at Hardware Level

Comprehensive Efficiency Analysis of Machine Learning Algorithms for Developing Hardware-Based Cybersecurity Countermeasures

MacLeR: Machine Learning-based Run-Time Hardware Trojan Detection in Resource-Constrained IoT Edge Devices

A survey on hardware-based malware detection approaches

An AI-Enabled Side Channel Power Analysis Based Hardware Trojan Detection Method for Securing the Integrated Circuits in Cyber-Physical Systems

CMD: Co-analyzed IoT Malware Detection and Forensics Via Network and Hardware Domains

Edge-based IIoT Malware Detection for Mobile Devices with Offloading

Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters

Defense against ML-based Power Side-channel Attacks on DNN Accelerators with Adversarial Attacks

A Survey of Cyber Security Countermeasures Using Hardware Performance Counters

Lightweight Hardware-Based Cache Side-Channel Attack Detection for Edge Devices (Edge-CaSCADe)

Hardware Performance Counter-Based Malware Identification and Detection with Adaptive Compressive Sensing

Guarding Machine Learning Hardware Against Physical Side-channel Attacks

EdgeShield: A Universal and Efficient Edge Computing Framework for Robust AI

Edge enhanced deep learning system for IoT edge device security analytics

Hardware Trojan Detection Combine with Machine Learning: an SVM-based Detection Approach

Anomaly Detection for malware identification using Hardware Performance Counters

A PCA Based SVM Hardware Trojan Detection Approach

Hardware-Assisted Monitoring For Instruction Security In Embedded System

A Novel Hybrid Reconfigurable Architecture for Prediction of Side Channel Attacks with Its Countermeasure Mechanism