A Multikernel and Metaheuristic Feature Selection Approach for IoT Malware Threat Hunting in the Edge Layer

Abstract

Internet-of-Things (IoT) devices are increasingly targeted, partly due to their presence in a broad range of applications (including home and corporate environments). In this article, we propose a multikernel support vector machine (SVM) for IoT cloud-edge gateway malware hunting, using the gray wolves optimization (GWO) technique. This metaheuristic approach is used for optimum selection of features distinguishing between malicious and benign applications at the IoT cloud-edge gateway. The model is trained with the Opcode and Bytecode of IoT malware samples (i.e., the training data set comprises 271 benign and 281 malicious Cortex A9 samples) and evaluated using the K-fold cross-validation technique. We validate the robustness of the proposed model, in terms of its ability to detect previously unseen IoT malware samples. We achieve an accuracy of 99.72% on the combination of the radial basis function (RBF) and polynomial kernels. Moreover, our proposed model only requires 20 s for training in comparison to the previous deep neural network (DNN) model that requires over 80 s to be trained on the same data. Overall, the proposed multikernel SVM approach outperforms DNNs and fuzzy-based IoT malware hunting techniques, in terms of accuracy, while significantly reducing the computational cost and the training time.