IoT Malware Research Articles

IoT malware detection and Mitigation in AMQP simulated Environment

IoT malware detection and Mitigation in AMQP simulated Environment

Implementation of White-Hat Worms Using Mirai Source Code and Its Optimization through Parameter Tuning

Mirai, an IoT malware that emerged in 2016, has been used for large-scale DDoS attacks. The Mirai source code is publicly available and continues to be a threat with a variety of variants still in existence. In this paper, we propose an implementation system for malicious and white-hat worms created using the Mirai source code, as well as a general and detailed implementation method for white-hat worms that is not limited to the Mirai source code. The white-hat worms have the function of a secondary infection, in which the white-hat worm disinfects the malicious worm by infecting devices already infected by the malicious worm, and two parameters, the values of which can be changed to modify the rate at which the white-hat worms can spread their infection. The values of the parameters of the best white-hat worm for disinfection of the malicious botnet and the impact of the value of each parameter on the disinfection of the malicious botnet were analyzed in detail. The analysis revealed that for a white-hat worm to disinfect a malicious botnet, it must be able to infect at least 80% of all devices and maintain that situation for at least 300 s. Then, by tuning and optimizing the values of the white-hat worm’s parameters, we were able to successfully eliminate the malicious botnet, demonstrating the effectiveness of the white-hat botnet’s function of eliminating the malicious botnet.

Exploring Shifting Patterns in Recent IoT Malware

The rise of malware targeting interconnected infrastructures has surged in recent years, driven largely by the widespread presence of vulnerable legacy IoT devices and inadequately secured networks. Despite the strong interest attackers have in targeting this infrastructure, a significant gap remains in understanding how the landscape has recently evolved. Addressing this knowledge gap is essential to thwarting the proliferation of massive botnets, thereby safeguarding end-users and preventing disruptions in critical infrastructures. This work offers a contemporary analysis of Linux-based malware, specifically tailored to IoT malware operating in 2021-2023. Using automated techniques involving both static and dynamic analysis, we classify malware into related threats. By scrutinizing the most recent dataset of Linux-based malware and comparing it to previous studies, we unveil distinctive insights into emerging trends, offering an unparalleled understanding of the evolving landscape. Although Mirai and Gafgyt remain the most prominent families and present a large number of variants, our results show that (i) there is an increase in the sophistication of malware, (ii) malware authors are adding new exploits to their arsenal, and (iii) malware families that originally attacked Windows systems have been adapted to attack Linux-based devices.

Linux IoT Malware Variant Classification Using Binary Lifting and Opcode Entropy

Binary function analysis is fundamental in understanding the behavior and genealogy of malware. The detection, classification, and analysis of Linux IoT malware and its variants present significant challenges due to the wide range of architectures supported by the Linux IoT platform. This study concentrates on static analysis using binary lifting techniques to extract and analyze Intermediate Representation (IR) opcode sequences. We introduce a set of statistical entropy-based features derived from these IR opcode sequences, establishing a practical and straightforward methodology for machine learning classification models. By exclusively analyzing function metadata and opcode entropy, our architecture-agnostic approach not only efficiently detects malware but also classifies its variants with a high degree of accuracy, achieving an F1 score of 97%. The proposed approach offers a robust alternative for enhancing malware detection and variant identification frameworks for IoT devices.

Antimalware applied to IoT malware detection based on softcore processor endowed with authorial sandbox

Antimalware applied to IoT malware detection based on softcore processor endowed with authorial sandbox

CAIMP: Cross-Architecture IoT Malware Detection and Prediction Based On Static Feature

Abstract IoT malware and cross-platform malware are currently the top threats to information systems. This paper proposes a robust cross-architecture IoT malware detection and prediction model based on machine learning and opcode features using a novel approach. In our method, a feature opcode transformation model between chip architecture platforms is proposed to facilitate the process of building a detection model for cross-architecture malware on IoT devices. The feature transformation model is capable of converting opcodes between different architecture platforms using an unsupervised machine learning approach. In our approach, a machine learning model is used for the detection of cross-platform malware based on the proposed opcode features. Experiments have demonstrated that our method is effective in detecting and predicting cross-platform malware with an accuracy of up to 99.4% and an F1-score of 99.3%. The method is capable of learning on one architecture platform and detecting malware on a different architecture platform. Therefore, the method can be used to develop cross-architecture detection and zero-day malware prediction solutions on IoT devices.

CMD: Co-Analyzed IoT Malware Detection and Forensics via Network and Hardware Domains

CMD: Co-Analyzed IoT Malware Detection and Forensics via Network and Hardware Domains

SIM-FED: Secure IoT malware detection model with federated learning

Many IoT devices are presently in use without sufficient security measures. The vulnerability of these devices to malware highlights the necessity for effective methods to identify malicious activity while protecting data privacy. Federated Learning is a collaborative learning technique that can create a fair model while keeping the local data private. To this end, this paper presents the SIM-FED, a novel model for detecting malware in IoT devices. This model utilizes both deep learning and federated learning algorithms. The SIM-FED offers a privacy-preserving solution for IoT malware detection, without sharing data, enhancing security in distributed environments. The model utilizes a lightweight one-dimensional CNN with optimized hyperparameters, reducing preprocessing, and computational overhead. Various federated aggregation strategies are evaluated, and the FedAvg strategy is selected to integrate the results of local models in the proposed model. Moreover, the model's resilience against white-box and black box cyber-attacks is assessed, revealing minimal performance degradation and highlighting its robustness, which is often overlooked in previous studies. The performance of the SIM-FED is assessed by conducting a series of experiments using the IoT-23 dataset. The results show that the SIM-FED outperforms other deep learning and federated learning models in terms of all evaluation metrics, achieving a remarkable 99.52 % accuracy.

IoT Malware: A Comprehensive Survey of Threats, Vulnerabilities, and Mitigation Strategies

IoT Malware: A Comprehensive Survey of Threats, Vulnerabilities, and Mitigation Strategies

A Lightweight IoT Malware Detection and Family Classification Method

A Lightweight IoT Malware Detection and Family Classification Method

IoT malware Detection and Dynamic Analysis of MQTT Simulated Network

IoT malware Detection and Dynamic Analysis of MQTT Simulated Network

Malware Detection in IoT Systems using Machine Learning Techniques

Malware detection in IoT environments necessitates robust methodologies. This study introduces a CNN-LSTM hybrid model for IoT malware identification and evaluates its performance against established methods. Leveraging K-fold cross-validation, the proposed approach achieved 95.5% accuracy, surpassing existing methods. The CNN algorithm enabled superior learning model construction, and the LSTM classifier exhibited heightened accuracy in classification. Comparative analysis against prevalent techniques demonstrated the efficacy of the proposed model, highlighting its potential for enhancing IoT security. The study advocates for future exploration of SVMs as alternatives, emphasizes the need for distributed detection strategies, and underscores the importance of predictive analyses for a more powerful IOT security. This research serves as a platform for developing more resilient security measures in IoT ecosystems.

An empirical study of problems and evaluation of IoT malware classification label sources

With the proliferation of malware on IoT devices, research on IoT malicious code has also become more mature. Most studies use learning models to detect or classify malware. Therefore, ensuring high-quality labels for malware samples is crucial to maintaining research accuracy. Researchers typically submit malware samples to Anti-Virus (AV) engines to obtain labels, but different engines have varying rules for detecting maliciousness and variants. This study aims to improve future IoT malware research accuracy by investigating label quality. We address three label-related issues, including Anti-Virus detection technology, naming rules, and label expiration. Additionally, we examine multiple sources of malware labels, including 63 studies on IoT, Windows, and Android malware, as well as commonly used tools such as AVClass and Anti-Virus engines. To evaluate and recommend label sources, we construct classification models using an IoT malware dataset obtained from VirusShare, which is labeled with common tools and Anti-Virus engines and classified based on ELF features. For family classification, we investigate four methods and tools, and for variant hierarchy classification, we compare label overlaps with sample clustering from 12 Anti-Virus engines. Based on our findings, we recommend AVClass for obtaining labels for IoT family classification. For small-scale malware families at the variant level, we recommend using the labels from Ad-Aware, BitDefender, and Emsisoft engines. For large-scale malware families, we advise employing labels from Jiangmin, NANO-Antivirus, and Avira engines, serving as a valuable guide for future IoT malware research.

Mitigate: Toward Comprehensive Research and Development for Analyzing and Combating IoT Malware

Mitigate: Toward Comprehensive Research and Development for Analyzing and Combating IoT Malware

MobileNet-Based IoT Malware Detection with Opcode Features

MobileNet-Based IoT Malware Detection with Opcode Features

TUNING HYPERPARAMETERS OF SELF-ORGANIZING MAPS IN COMBINATION WITH K-NEAREST NEIGHBORS FOR IOT MALWARE DETECTION

In the Internet of Things, sensor devices often generate massive sensory data across multiple domains and applications. Identifying IoT malware from a huge amount of such IoT data is often a challenging task. In our previous studies, analytic techniques were applied to reduce dimensionality and discover valuable information from the original data. Particularly, the Self-organizing Maps (SOM)-based classifier with an AutoEncoder is used to create an end-to-end IoT malware detection model. However, the SOM-based classifier has a constraint that new instances may be incorrectly classified if they are mapped into unlabelled neurons in the SOM map. To address this issue, in this study, a novel hybrid between SOM-based classifier and well-known classification algorithms like K-Nearest Neighbors, Support Vector Machine, Softmax, Random Forest. In this hybrid, classification methods will help to correctly assign labels for instances mapped into the unlabeled neurons. In addition, this article investigates hyperparameter optimization methods for optimizing SOM hyperparameters. Our proposed methods were tested on the NBaIoT dataset with various experimental settings. Experimental results illustrate that SOMKNN often performs better than stand-alone techniques, including the SOM classifier.

A hybrid method for analysis and detection of malicious executables in IoT network

In 2020, 639 million IoT devices were breached, but the number has almost doubled to 1.51 billion breached devices in just the first half of 2021. The limited computing capacity of IoT devices makes them highly vulnerable, and large-scale malware attacks have been conducted using them, as evidenced by the Mirai 2016 botnet, which infected 15 million IoT devices. This stresses the need for enhancements in IoT security, especially in the domain of IoT malware detection. The majority of the research on IoT malware detection is focused on static analysis methods which do not take packers and obfuscation techniques into account. A moderate amount of research is done on the dynamic analysis methods, but such methods fail when the sample’s architecture is not supported. Hybrid analysis methods are also not widely explored even though they are capable of learning more meaningful features than just static or dynamic analysis methods alone. To this end, we have proposed a new sandbox and a novel hybrid detection model that is cross-architectural and capable of dealing with obfuscated and packed samples. Our proposed hybrid model works well even when one of the analysis methods, static or dynamic analysis, fails. We have trained our hybrid model on a dataset of 3145 samples with 2210 malware samples and 935 benign samples. Our model achieves an accuracy of 99.18% with an MCC score of 0.98.

Enimanal: Augmented cross-architecture IoT malware analysis using graph neural networks

IoT malware analysis is crucial for understanding the behavior and purpose of malware samples. While deep learning methods have been applied to IoT malware analysis using sequences or graphs to represent system calls, these approaches have limitations in their semantic representation of system call names. This paper presents Enimanal, a novel cross-architecture IoT malware analysis method based on graph neural networks. Enimanal leverages information from the Linux Programmer Manual to improve the semantic representation of dynamic system call information. By fusing semantic and structural information, Enimanal constructs a unique feature representation called an attributed system call graph (ASCG). We evaluated Enimanal on a dataset of 63k IoT malware samples with 9 CPU architectures and find that it outperforms comparison methods by up to 46% in macro precision and 38% in macro recall, achieving macro precision, macro recall and macro f1-score of over 98%. Furthermore, we verify the robustness of Enimanal against “zero-day” IoT malware.

BOTA: Explainable IoT Malware Detection in Large Networks

BOTA: Explainable IoT Malware Detection in Large Networks

Design and implementation of a sandbox for facilitating and automating IoT malware analysis with techniques to elicit malicious behavior: case studies of functionalities for dissecting IoT malware

Design and implementation of a sandbox for facilitating and automating IoT malware analysis with techniques to elicit malicious behavior: case studies of functionalities for dissecting IoT malware