Attribution Classification Method of APT Malware in IoT Using Machine Learning Techniques

Abstract

In recent years, the popularity of IoT (Internet of Things) applications and services has brought great convenience to people's lives, but ubiquitous IoT has also brought many security problems. Among them, advanced persistent threat (APT) is one of the most representative attacks, and its continuous outbreak has brought unprecedented security challenges for the large-scale deployment of the IoT. However, important research on analyzing the attribution of APT malware samples is still relatively few. Therefore, we propose a classification method for attribution organizations with APT malware in IoT using machine learning. It aims to mark the real attacking organization entities to better identify APT attack activity and protect the security of IoT. This method performs feature representation and feature selection based on APT behavior data obtained from devices in the Internet of Things and selects the features with a high degree of differentiation among organizations. Then, it trains a multiclass model named SMOTE-RF that can better deal with imbalance and multiclassification problems. Our experiments on real dynamic behavior data are combined to verify the effectiveness of the method proposed in this paper for attribution analysis of APT malware samples and achieve good performance. Our method could identify the organization behind complex APT attacks in IoT devices and services.

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

“…Next, we will present the findings and analysis of the research questions. Watering hole [3,28,79,84,88,99,101,102] Malware [1,3,88,89,[102][103][104][105] Application repackaging [106] Attacks on an Internet-facing server [3,83,89,101] Removable device [3,89,107] Drive-by download [96] Spoofing attack [7,82,108] SQL injection Execution [3,5,82,84,[86][87][88]90,94,97,101,[109][110][111][112][113][114] Zero day, known vulnerability [79,101,115] Remote code execution/Code injection ...…”

“…Zero-day exploit-This attack takes advantage of an undiscovered software vulnerability for which no updates or fixes are available [3,5,82,84,[86][87][88]90,94,97,101,[109][110][111][112][113][114]; 2.…”

“…One of the most common AI detection solutions used in the literature is AI techniques. Many AI techniques involving machine learning (ML) and deep learning (DL) that have been proposed by various researchers are either network-centric [1,3,6,7,79,[82][83][84][90][91][92][93]103,107,[111][112][113]116,118,121,125,130,131,[133][134][135][136][137][139][140][141][142][143][144][145][146][147][148][149][150][151][152], device behavior-centric [105,109,138], application-centric [5,86,110,…”

“…Malware spreads via custom encrypted partitions on removable media (e.g., ProjectSauron APT) and exploits weak points in authentication mechanisms [117]. Furthermore, with the application-centric detection systems [5,86,110,124], the malware characteristics are generally categorized into static features (such as binary file characteristics and disassembly features) and dynamic features such as execution behavior features [179]. Static features may be difficult to extract because of APT attacks' polymorphism, distortion, and shelling.…”

Fast Popularity Value Calculation of Virtual Cryptocurrency Trading Stage Based on Machine Learning

“…It provides a new idea for the study of abnormal warning of virtual cryptocurrency.Virtual cryptocurrency anomaly detection and early-warning star-moon value model is shown in Figure2. Based on current research results at home and abroad[27][28][29], this model organically combines the definition, research, and early warning of virtual cryptocurrency anomalies into an overall model.…”