A deep Recurrent Neural Network based approach for Internet of Things malware threat hunting

HaddadPajouh, Hamed; Dehghantanha, Ali; Khayami, Raouf; Choo, Kim‐Kwang Raymond

doi:10.1016/j.future.2018.03.007

Cited by 322 publications

(133 citation statements)

References 17 publications

Supporting

Mentioning

128

Contrasting

Unclassified

Order By: Relevance

“…Various types of neural networks have been proposed in the literature, e.g. Multi-Layer Perceptron (MLP), Convolutional Neural Networks (CNNs), and Recurrent Neural Networks (RNNs) [81], [82], [83].…”

Section: Recurrent Neural Network (Rnn)mentioning

confidence: 99%

See 1 more Smart Citation

Machine Learning in IoT Security: Current Solutions and Future Challenges

Hussain

Hassan

et al. 2020

IEEE Commun. Surv. Tutorials

490

238

View full text Add to dashboard Cite

The future Internet of Things (IoT) will have a deep economical, commercial and social impact on our lives. The participating nodes in IoT networks are usually resourceconstrained, which makes them luring targets for cyber attacks. In this regard, extensive efforts have been made to address the security and privacy issues in IoT networks primarily through traditional cryptographic approaches. However, the unique characteristics of IoT nodes render the existing solutions insufficient to encompass the entire security spectrum of the IoT networks. This is, at least in part, because of the resource constraints, heterogeneity, massive real-time data generated by the IoT devices, and the extensively dynamic behavior of the networks. Therefore, Machine Learning (ML) and Deep Learning (DL) techniques, which are able to provide embedded intelligence in the IoT devices and networks, are leveraged to cope with different security problems. In this paper, we systematically review the security requirements, attack vectors, and the current security solutions for the IoT networks. We then shed light on the gaps in these security solutions that call for ML and DL approaches. We also discuss in detail the existing ML and DL solutions for addressing different security problems in IoT networks. At last, based on the detailed investigation of the existing solutions in the literature, we discuss the future research directions for ML-and DL-based IoT security.

show abstract

Section: Recurrent Neural Network (Rnn)mentioning

confidence: 99%

“…3) DL-based malware analysis in IoT: Pajouh et al [81] proposed an RNN-based DL approach for malware analysis technique in IoT. The authors considered Advanced RISC Machines (ARM)-based applications in IoT.…”

Section: E Malware Analysis In Iotmentioning

confidence: 99%

Machine Learning in IoT Security: Current Solutions and Future Challenges

Hussain

Hassan

et al. 2020

IEEE Commun. Surv. Tutorials

490

238

View full text Add to dashboard Cite

show abstract

“…Previous literature have suggested the potential of leveraging machine learning to enhance security threat hunting, but it is not practical to simply integrate machine learning in static and dynamic cyber security analysis due to the wide variety and distribution of IoT devices, particularly for (inexpensive) IoT devices with limited processing power [12]. On the other hand, the success of deep learning (DL) in various big data fields has attracted noticeable interest in cybersecurity fields.…”

Section: B Deep Learning For Attack Detectionmentioning

confidence: 99%

“…This type of structure is theoretically well suited and has been proven a powerful model for tagging tasks with applications in natural language processing, machine translation, Image recognition, and the like [17]. A bidirectional LSTM (BLSTM), furthermore, introduces two independent layers to accumulate contextual information both from the past and the future [12]. The main contribution of this paper is the application of the variants of LSTM networks for implementing deep learning in network traffic analysis aimed at detecting botnet attacks.…”

Section: B Deep Learning For Attack Detectionmentioning

confidence: 99%

Botnet Detection in the Internet of Things using Deep Learning Approaches

McDermott

Majdani

Petrovski

2018

2018 International Joint Conference on Neural Networks (IJCNN)

226

100

View full text Add to dashboard Cite

The recent growth of the Internet of Things (IoT) has resulted in a rise in IoT based DDoS attacks. This paper presents a solution to the detection of botnet activity within consumer IoT devices and networks. A novel application of Deep Learning is used to develop a detection model based on a Bidirectional Long Short Term Memory based Recurrent Neural Network (BLSTM-RNN). Word Embedding is used for text recognition and conversion of attack packets into tokenised integer format. The developed BLSTM-RNN detection model is compared to a LSTM-RNN for detecting four attack vectors used by the mirai botnet, and evaluated for accuracy and loss. The paper demonstrates that although the bidirectional approach adds overhead to each epoch and increases processing time, it proves to be a better progressive model over time. A labelled dataset was generated as part of this research, and is available upon request.

show abstract

“…The volume, complexity and variety of Cyber attacks are continually increasing. This trend is currently being driven by cyber warfare and the emergence of the Internet of Things [1][2][3]. The annual cost of cyber attacks was $3 trillion in 2015 and it is expected to increase to more than $6 trillion per annum by 5 2021 [4].…”

Section: Introductionmentioning

confidence: 99%

Detection of advanced persistent threat using machine-learning correlation analysis

Ghafir

Hammoudeh

Přenosil

et al. 2018

Future Generation Computer Systems

201

View full text Add to dashboard Cite

Item Type Article Authors Ghafir, Ibrahim; Hammoudeh, M.; Prenosil, V.; Han, L.; Hegarty, R.; Rabie, K.; Aparicio-Navarro, F.J. Citation Ghafir I, Hammoudeh M, Prenosil V (et al) Detection of advanced persistent threat using machine-learning correlation analysis. Future Generation Computer Systems. 89: 349-359. Rights Citation: Ghafir I, Hammoudeh M, Prenosil V (et al) Detection of advanced persistent threat using machine-learning correlation analysis. Future Generation Computer Systems. 89: 349-359. AbstractAs one of the most serious types of cyber attack, Advanced Persistent Threats (APT) have caused major concerns on a global scale. APT refers to a persistent, multi-stage attack with the intention to compromise the system and gain information from the targeted system, which has the potential to cause significant damage and substantial financial loss. The accurate detection and prediction of APT is an ongoing challenge. This work proposes a novel machine learning-based system entitled MLAPT, which can accurately and rapidly detect and predict APT attacks in a systematic way. The MLAPT runs through three main phases: (1) Threat detection, in which eight methods have been developed to detect different techniques used during the various APT steps. The implementation and validation of these methods with real traffic is a significant contribution to the current body of research; (2) Alert correlation, in which a correlation framework is designed to link the outputs of the detection methods, aims to identify alerts that could be related and belong to a single APT scenario; and (3) Attack prediction, in which a machine learning-based prediction module is proposed based on the correlation framework output, to be used by the network security team to determine the probability of the early alerts to develop a complete APT attack. MLAPT is experimentally evaluated and the presented system is able to predict APT in its early steps with a prediction accuracy of 84.8%.to a technical report by Trend Micro [11], this assumption is no longer valid with the rise of targeted attacks, Advanced Persistent Threats (APTs), in which both cyber-criminals and hackers are targeting selected organizations and persisting until they achieve their goals.The APT attack is a persistent, targeted attack on a specific organisation 20 and is performed through several steps [12]. The main aim of APT is espionage and then data exfiltration. Therefore, APT is considered as a new and more complex version of multi-step attack. These APTs present a challenge for current detection methods as they use advanced techniques and make use of unknown vulnerabilities. Moreover, the economic damage due to a successful 25 APT attack significant. The potential cost of attacks is the major motivation for the investments in intrusion detection and prevention systems [13]. APTs are currently one of the most serious threats to companies and governments [14].Most of the research in the area of APT detection, has focused on analysing already identified APTs [15][16][17][...

show abstract

A deep Recurrent Neural Network based approach for Internet of Things malware threat hunting

Cited by 322 publications

References 17 publications

Machine Learning in IoT Security: Current Solutions and Future Challenges

Machine Learning in IoT Security: Current Solutions and Future Challenges

Botnet Detection in the Internet of Things using Deep Learning Approaches

Detection of advanced persistent threat using machine-learning correlation analysis

Contact Info

Product

Resources

About