Mirai Malware Research Articles

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

As IoT devices are being widely used, malicious code is increasingly appearing in Linux environments. Sophisticated Linux malware employs various evasive techniques to deter analysis. The embedded trace microcell (ETM) supported by modern Arm CPUs is a suitable hardware tracer for analyzing evasive malware because it is almost artifact-free and has negligible overhead. In this paper, we present an efficient method to automatically find debugger-detection routines using the ETM hardware tracer. The proposed scheme reconstructs the execution flow of the compiled binary code from ETM trace data. In addition, it automatically identifies and patches the debugger-detection routine by comparing two traces (with and without the debugger). The proposed method was implemented using the Ghidra plug-in program, which is one of the most widely used disassemblers. To verify its effectiveness, 15 debugger-detection techniques were investigated in the Arm-Linux environment to determine whether they could be detected. We also confirmed that our implementation works successfully for the popular malicious Mirai malware in Linux. Experiments were further conducted on 423 malware samples collected from the Internet, demonstrating that our implementation works well for real malware samples.

IoTSecSim: A framework for modelling and simulation of security in Internet of things

The proliferation of the Internet of Things (IoT) devices has provided attackers with tremendous opportunities to launch various cyber-attacks. It has been challenging to analyse the impact of cyber-attacks and evaluate the effectiveness of defences in real IoT environments due to the scale and heterogeneity of IoT networks. In this work, we propose a novel simulation framework and a software tool, IoT Security Simulator (IoTSecSim). IoTSecSim is operated based on a framework we propose for modelling and simulating cyber-attacks and various defences in IoT networks. IoTSecSim is not only able to support the creation of an IoT network with flexible settings of IoT devices and topology information but also models the attack behaviours, node-level, and network-level defences. Moreover, a systematic security evaluation can be performed by comparing the results based on the calculation of security metrics. We perform simulations with case studies on Mirai malware and its variants to model cyber-attack behaviours on IoT networks and evaluate the impact of these attacks and the effectiveness of defence techniques via IoTSecSim. Then, we carry out a sensitivity analysis to justify that the simulation results produced by IoTSecSim are accurate and feasible when compared with related works. We also perform a comparative performance analysis with four combinations of cyber-attack behaviours and show that these behaviours can influence IoT malware propagation in different situations. We consider multiple attacker models and deploy conventional defence techniques (including firewall, intrusion detection, and vulnerability patching) to investigate the effectiveness of defence techniques. IoTSecSim provides a generalised and extensible simulation framework that enables users to model emerging cyber-attacks against IoT networks and evaluate the effectiveness of defences against these attacks. This helps users focus on the design and performance evaluation of new defences before the actual implementation and deployment of the defences are required.

Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks

There is a growing trend of cyberattacks against Internet of Things (IoT) devices; moreover, the sophistication and motivation of those attacks is increasing. The vast scale of IoT, diverse hardware and software, and being typically placed in uncontrolled environments make traditional IT security mechanisms such as signature-based intrusion detection and prevention systems challenging to integrate. They also struggle to cope with the rapidly evolving IoT threat landscape due to long delays between the analysis and publication of the detection rules. Machine learning methods have shown faster response to emerging threats; however, model training architectures like cloud or edge computing face multiple drawbacks in IoT settings, including network overhead and data isolation arising from the large scale and heterogeneity that characterizes these networks.This work presents an architecture for training unsupervised models for network intrusion detection in large, distributed IoT and Industrial IoT (IIoT) deployments. We leverage Federated Learning (FL) to collaboratively train between peers and reduce isolation and network overhead problems. We build upon it to include an unsupervised device clustering algorithm fully integrated into the FL pipeline to address the heterogeneity issues that arise in FL settings. The architecture is implemented and evaluated using a testbed that includes various emulated IoT/IIoT devices and attackers interacting in a complex network topology comprising 100 emulated devices, 30 switches and 10 routers. The anomaly detection models are evaluated on real attacks performed by the testbed’s threat actors, including the entire Mirai malware lifecycle, an additional botnet based on the Merlin command and control server and other red-teaming tools performing scanning activities and multiple attacks targeting the emulated devices.

HADES-IoT: A Practical and Effective Host-Based Anomaly Detection System for IoT Devices (Extended Version)

Internet of Things (IoT) devices have become ubiquitous, with applications in many domains, including industry, transportation, and healthcare; these devices also have many household applications. The proliferation of IoT devices has raised security and privacy concerns, however many manufacturers neglect these aspects, focusing solely on the core functionality of their products due to the short time to market and the need to reduce product costs. Consequently, vulnerable IoT devices are left unpatched, allowing attackers to exploit them for various purposes, which include compromising the device users’ privacy or recruiting the devices to an IoT botnet. We present a practical and effective host-based anomaly detection system for IoT devices (HADES-IoT) as a novel last line of defense. HADES-IoT has proactive detection capabilities that enable the execution of any malicious process to be stopped before it even starts. HADES-IoT provides tamper-proof protection and can be deployed on a wide range of Linux-based IoT devices. HADES-IoT’s main advantage is its low overhead, making it suitable for Linux-based IoT devices where state-of-the-art security solutions are infeasible due to their high-performance demands. We deployed HADES-IoT on seven IoT devices, where it demonstrated 100% effectiveness in the detection of IoT malware, including VPNFilter, IoT Reaper, and Mirai malware, while requiring only 5.5% (on average) of the available memory and consuming just negligible CPU resources.

Security provision for protecting intelligent sensors and zero touch devices by using blockchain method for the smart cities

Internet of Things (IoT) networks has gained popularity due to their amazing and cost-effective services and one of the main areas in smart cities. The stability of these networks is based on stable and secure data transmission without any vulnerabilities present used devices. Distributed Denial of Services (DDoS) attacks have brought critical interruptions in IoT services and significantly damage the network. In DDoS attacks, attackers utilize botnets, with the capability of frequently exploiting the millions of IoT devices around the globe. After the source code of Mirai malware is loaded on GitHub, the threats are significantly increased. Manufacturer Usage Description (MUD) is an embedded software standard for IoT device makers to advertise device specifications, including the intended communication patterns when it connects to the network. Even though the MUD mechanism is promising exertion, still there is a need for evaluating its viability, recognize its limits, and upgrade its architecture to reduce shortcomings in its architecture as well as to increase its effectiveness. This standard neither identifies the vulnerability path before the creation of the MUD profile. Thus, it is possible to exploit an IoT device even after the MUD profile is issued to the device by manipulating the vulnerabilities in the device. By keeping in mind this situation, this paper discusses the limitations of MUD in detail and proposed a framework to identify the patch and default vulnerabilities by using blockchain method before the generation/creation of MUD profiles. The proposed framework can also mitigate open ports, DDoS attacks, and Brute force attacks. The experiment results show the identification, elimination, and sharing of vulnerability report with vendors and significantly minimized the risk of IoT device exploitation.

A Malware Distribution Simulator for the Verification of Network Threat Prevention Tools.

With the expansion of the Internet of Things (IoT), security incidents about exploiting vulnerabilities in IoT devices have become prominent. However, due to the characteristics of IoT devices such as low power and low performance, it is difficult to apply existing security solutions to IoT devices. As a result, IoT devices have easily become targets for cyber attackers, and malware attacks on IoT devices are increasing every year. The most representative is the Mirai malware that caused distributed denial of service (DDoS) attacks by creating a massive IoT botnet. Moreover, Mirai malware has been released on the Internet, resulting in increasing variants and new malicious codes. One of the ways to mitigate distributed denial of service attacks is to render the creation of massive IoT botnets difficult by preventing the spread of malicious code. For IoT infrastructure security, security solutions are being studied to analyze network packets going in and out of IoT infrastructure to detect threats, and to prevent the spread of threats within IoT infrastructure by dynamically controlling network access to maliciously used IoT devices, network equipment, and IoT services. However, there is a great risk to apply unverified security solutions to real-world environments. In this paper, we propose a malware simulation tool that scans vulnerable IoT devices assigned a private IP address, and spreads malicious code within IoT infrastructure by injecting malicious code download command into vulnerable devices. The malware simulation tool proposed in this paper can be used to verify the functionality of network threat detection and prevention solutions.

Detection of Mirai Malware Attacks in IoT Environments Using Random Forest Algorithms

The potential for Cyber-attacks against Internet of Thing (IoT) Infrastructure is enormous as devices run on pre-existing network infrastructure, for example Mirai Malware Attack. Network Forensics investigations require the Random Forest Algorithm which is used to perform classification and detection techniques for the Mirai Malware attack. The trials have been carried out using 5 attack scenarios and device types. The experimental results show that the RF algorithm achieves optimal performance with an average accuracy value of 95.01%, recall 90.82%, F1 Score 93.85% and the best precision value 99.23%. Besides, the Random Forest algorithm is suitable for very large data processing. The contribution of this research is to provide a recommendation that the RF Algorithm can be used to classify and identify Mirai malware attacks on the Internet of Things infrastructure.

Intelligent Mirai Malware Detection for IoT Nodes

The advancement in recent IoT devices has led to catastrophic attacks on the devices resulting in breaches in user privacy and exhausting resources of various organizations, so that users and organizations expend increased time and money. One such harmful malware is Mirai, which has created worldwide recognition by impacting the digital world. There are several ways to detect Mirai, but the Machine Learning approach has proved to be accurate and reliable in detecting malware. In this research, a novel-based approach of detecting Mirai using Machine Learning Algorithm is proposed and implemented in Matlab and Python. To evaluate the proposed approaches, Mirai and Benign datasets are considered and training is performed on the dataset comprised of a Training set, Cross-Validation set and Test set using Artificial Neural Network (ANN) consisting of neurons in the hidden layer, which provides consistent accuracy, precision, recall and F-1 score. In this research, an accurate number of hidden layers and neurons are chosen to avoid the problem of Overfitting. This research provides a comparative analysis between ANN and Random Forest models of the dataset formed by merging Mirai and benign datasets of the Mirai malware detection pertaining to seven IoT devices. The dataset used in this research is “N-BaIoT” dataset, which represents data in the features infected by Mirai Malware. The results are found to be accurate and reliable as the best performance was achieved with an accuracy of 92.8% and False Negative rate of 0.3% and F-1 score of 0.99. The expected outcomes of this project, include major findings towards cost-effective Learning solutions in detecting Mirai Malware strains.

WITHDRAWN: Detection of software intrusion based on machine learning techniques for IOT systems

The essence of the Internet of Things (IoT) is simple in the globe. Dyn's 2016 cyber-attack showed vital fault lines between smart networks. The security of the Internet of Things (IoT) was a major concern. Apart from the threat to IoT protection, internet-related infestations often impact the entire internet environment, which can access insecure (smart gadgets. Mirai malware has disabled video surveillance systems and crippled the Internet with a DDoS (Distributed Denial of Service) target. Security threat mechanisms have developed both in terms of sophistication and variety in recent years. It is thus important to investigate strategies in the sense of IoT in order to detect and monitor emerging risks. By analysing current defensive strategies, the report classifies IoT security risks and issues for IoT networks. This paper discusses current NIDS methods, data sets and sniffing applications for the open and free-source network. Our priority is on intrusion device network detection (NIDS). The study then examines measures and evaluates state of the art IoT-based NIDS technologies for architectures, methodologies for detection and evaluation, risk analysis, and the implementation of algorithms. This study explores conventional ML approaches and NIDS and looks at future pathways. Our analysis concentrates on IoT NIDS for Machine Learning, as learning algorithms are secretly secure and performing. In addition to other leading surveys dealing with typical frames, it provides a thorough study of NIDSs that use different facets of learning methods on the internet of topics. We assume that the paper will aid in studies and the engineering to recognise risks and difficulties of IoT first, then to introduce their own IoT NIDS and ultimately create modern, knowledgeable approaches, taking into account IoT vulnerabilities. The survey also defends people from regular IoT NIDS.

Cyberinsights: Talking about the Software Supply Chain.

Cyberinsights: Talking about the Software Supply Chain.

Scenario-based cyber attack·defense education system on virtual machines integrated by web technologies for protection of multimedia contents in a network

Security issues have been raised with the tremendous growth of social multimedia content evolving content distribution and social interaction. To protect the social multimedia contents in a network, information security education has been actively studied, and various educational systems are being provided. Even when trainees have completed the training that they can practice, such as DDoS(Distributed Denial of Services) response and database outbreak attack, most of the education methods are based on the theory or advance notification method designed as part of the scenario beforehand and it is difficult to apply these to actual situations. In addition, building new systems and learning to use them for each scenario lowers the training effectiveness. In this paper, we investigate various cases of cyber incident in the content distribution networks. Based on research, we develop Meltdown, Mirai malware, Carbanak APT(Advanced Persistent Threats), and Ransomware scenarios that assume a real multimedia contents distribution situation. We also build and store individual virtual environments for each scenario, integrating them into VMWare ESXI, so that attack and defense practices can be conducted similar to real world networks. The deployed environment is integrated with the Web through the VM API(Virtual Machine Application Programming Interfaces). When the trainee finishes the training, one utilizes the snapshot function of the virtual machine to return the virtual environment to the pre-training state. Trainees do not need to build a virtual environment for each scenario, but they are able to conduct training in an environment similar to a real network by calling a virtual environment with a simple operation from a web browser. Therefore, it is expected that the convenience of trainees and the efficiency of the education will be increased.

Feature dynamic deep learning approach for DDoS mitigation within the ISP domain

The emergence of the Mirai malware facilitated a DDoS attack vector to surge to almost 1 Tbps in 2016, instigated by less than 150,000 infected IoT devices. With the infection of five new IoT devices per minute, the size of Mirai botnet was enlarged to 2.5 millions devices by the end of 2016. The continuous adaptation of the Mirai malware enables the modern variant to dynamically update its malware scripts on the fly to launch even more advanced and malevolent DDoS attacks, which dramatically escalates the level of difficulty with mitigating DDoS attacks. Many researchers endeavour to develop mitigation systems to keep up with the increasing security threats. Nonetheless, most presented models provide inefficient solutions either by utilising auxiliary servers at the host site, on the cloud or at dedicated data scrubbing centres. Since internet service providers (ISPs) connect the internet with users, the mitigation system should be deployed within the ISP domain to deliver a more efficient solution. Accordingly, we propose a stacked self-organising map, which is a feature dynamic deep learning approach that utilises netflow data collected by the ISP to combat the dynamic nature of novel DDoS attacks.

Network Intrusion Detection for IoT Security Based on Learning Techniques

Pervasive growth of Internet of Things (IoT) is visible across the globe. The 2016 Dyn cyberattack exposed the critical fault-lines among smart networks. Security of IoT has become a critical concern. The danger exposed by infested Internet-connected Things not only affects the security of IoT but also threatens the complete Internet eco-system which can possibly exploit the vulnerable Things (smart devices) deployed as botnets. Mirai malware compromised the video surveillance devices and paralyzed Internet via distributed denial of service attacks. In the recent past, security attack vectors have evolved bothways, in terms of complexity and diversity. Hence, to identify and prevent or detect novel attacks, it is important to analyze techniques in IoT context. This survey classifies the IoT security threats and challenges for IoT networks by evaluating existing defense techniques. Our main focus is on network intrusion detection systems (NIDSs); hence, this paper reviews existing NIDS implementation tools and datasets as well as free and open-source network sniffing software. Then, it surveys, analyzes, and compares state-of-the-art NIDS proposals in the IoT context in terms of architecture, detection methodologies, validation strategies, treated threats, and algorithm deployments. The review deals with both traditional and machine learning (ML) NIDS techniques and discusses future directions. In this survey, our focus is on IoT NIDS deployed via ML since learning algorithms have a good success rate in security and privacy. The survey provides a comprehensive review of NIDSs deploying different aspects of learning techniques for IoT, unlike other top surveys targeting the traditional systems. We believe that, this paper will be useful for academia and industry research, first, to identify IoT threats and challenges, second, to implement their own NIDS and finally to propose new smart techniques in IoT context considering IoT limitations. Moreover, the survey will enable security individuals differentiate IoT NIDS from traditional ones.