A Novel Detection and Multi-Classification Approach for IoT-Malware Using Random Forest Voting of Fine-Tuning Convolutional Neural Networks

Abstract

The Internet of Things (IoT) is prone to malware assaults due to its simple installation and autonomous operating qualities. IoT devices have become the most tempting targets of malware due to well-known vulnerabilities such as weak, guessable, or hard-coded passwords, a lack of secure update procedures, and unsecured network connections. Traditional static IoT malware detection and analysis methods have been shown to be unsatisfactory solutions to understanding IoT malware behavior for mitigation and prevention. Deep learning models have made huge strides in the realm of cybersecurity in recent years, thanks to their tremendous data mining, learning, and expression capabilities, thus easing the burden on malware analysts. In this context, a novel detection and multi-classification vision-based approach for IoT-malware is proposed. This approach makes use of the benefits of deep transfer learning methodology and incorporates the fine-tuning method and various ensembling strategies to increase detection and classification performance without having to develop the training models from scratch. It adopts the fusion of 3 CNNs, ResNet18, MobileNetV2, and DenseNet161, by using the random forest voting strategy. Experiments are carried out using a publicly available dataset, MaleVis, to assess and validate the suggested approach. MaleVis contains 14,226 RGB converted images representing 25 malware classes and one benign class. The obtained findings show that our suggested approach outperforms the existing state-of-the-art solutions in terms of detection and classification performance; it achieves a precision of 98.74%, recall of 98.67%, a specificity of 98.79%, F1-score of 98.70%, MCC of 98.65%, an accuracy of 98.68%, and an average processing time per malware classification of 672 ms.

VMCTE: Visualization-Based Malware Classification Using Transfer and Ensemble Learning

“…It attained a classification accuracy of 91.32% on a dataset that had a significant amount of zero-day malware. Atitallah et al [36] proposed a malware multi-classification approach based on transfer learning combining DenseNet161, MobilenetV2, and ResNet18, which achieved 98.74% accuracy and 672 ms classification overhead on the MaleVis dataset. Due to the excellent classification abilities of MobilenetV1 and MobilenetV2, they have been used widely by researchers in the field of malware classification.…”

Machine Learning-Based Malware Detection for IoT Devices: Understanding the Evolving Threat Landscape and Strategies for Protection

“…Botnet attacks [11,12] are another example of malicious attacks on IoT devices. Botnets are networks of infected devices controlled by a centralized command and control server, often employed by cybercriminals [13,14]. These devices can conduct distributed denial-of-service (DDoS) attacks, steal sensitive information, or spread malware to other devices [15,16].…”

“…These devices can conduct distributed denial-of-service (DDoS) attacks, steal sensitive information, or spread malware to other devices [15,16]. The most famous example of a botnet attack targeting IoT devices is the 2016 Mirai botnet attack [13,17]. According to reports by LexisNexis Risk Solutions and FortiGuard Labs, botnet attacks experienced a 41% increase during the first half of 2021, with the proportion of companies detecting botnet activity rising from 35% to 51% [18].…”

Artificial intelligence-driven malware detection framework for internet of things environment

“…The Internet of Things (IoT) connects the real and virtual worlds ( Mu et al, 2021 ; Ben Atitallah, Driss & Almomani, 2022 ). New business models and global interactions emerge as people, products, technologies, and the internet become more interconnected ( Kumar, Janet & Neelakantan, 2022 ).…”