CloudEyes: Cloud‐based malware detection with reversible sketch for resource‐constrained internet of things (IoT) devices

Sun, Hao; Wang, Xiaofeng; Buyya, Rajkumar; Su, Jinshu

doi:10.1002/spe.2420

Cited by 86 publications

(47 citation statements)

References 23 publications

(36 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The database sources include huge number of the various signatures that classify malicious objects. In the signature-based malware detection, there are some various qualities including fast identification, easy to run, and broadly accessible [27].…”

Section: Signature-based Malware Detectionmentioning

confidence: 99%

A state-of-the-art survey of malware detection approaches using data mining techniques

Souri

Hosseini

2018

Hum. Cent. Comput. Inf. Sci.

303

166

View full text Add to dashboard Cite

Data mining techniques have been concentrated for malware detection in the recent decade. The battle between security analyzers and malware scholars is everlasting as innovation grows. The proposed methodologies are not adequate while evolutionary and complex nature of malware is changing quickly and therefore turn out to be harder to recognize. This paper presents a systematic and detailed survey of the malware detection mechanisms using data mining techniques. In addition, it classifies the malware detection approaches in two main categories including signature-based methods and behavior-based detection. The main contributions of this paper are: (1) providing a summary of the current challenges related to the malware detection approaches in data mining, (2) presenting a systematic and categorized overview of the current approaches to machine learning mechanisms, (3) exploring the structure of the significant methods in the malware detection approach and (4) discussing the important factors of classification malware approaches in the data mining. The detection approaches have been compared with each other according to their importance factors. The advantages and disadvantages of them were discussed in terms of data mining models, their evaluation method and their proficiency. This survey helps researchers to have a general comprehension of the malware detection field and for specialists to do consequent examinations.

show abstract

Section: Signature-based Malware Detectionmentioning

confidence: 99%

A state-of-the-art survey of malware detection approaches using data mining techniques

Souri

Hosseini

2018

Hum. Cent. Comput. Inf. Sci.

303

166

View full text Add to dashboard Cite

show abstract

“…In [21], the authors demonstrated the feasibility of implementing existing device management protocols on resource-constrained devices. A cloud-based algorithm was proposed in [22] to provide privacy service for resource-constrained IoTDs. Finally, the work in [23] investigated how cloud computing can be securely integrated in large-scale IoT systems.…”

Section: Introductionmentioning

confidence: 99%

Deep Learning for Signal Authentication and Security in Massive Internet-of-Things Systems

Ferdowsi

Saad

2019

IEEE Trans. Commun.

134

View full text Add to dashboard Cite

Secure signal authentication is arguably one of the most challenging problems in the Internet of Things (IoT), due to the large-scale nature of the system and its susceptibility to man-in-the-middle and data injection attacks. In this paper, a novel watermarking algorithm is proposed for dynamic authentication of IoT signals to detect cyber attacks. The proposed watermarking algorithm, based on a deep learning long shortterm memory (LSTM) structure, enables the IoT devices (IoTDs) to extract a set of stochastic features from their generated signal and dynamically watermark these features into the signal. This method enables the IoT gateway, which collects signals from the IoTDs, to effectively authenticate the reliability of the signals. Moreover, in massive IoT scenarios, since the gateway cannot authenticate all of the IoTDs simultaneously due to computational limitations, a game-theoretic framework is proposed to improve the gateway's decision making process by predicting vulnerable IoTDs. The mixed-strategy Nash equilibrium (MSNE) for this game is derived and the uniqueness of the expected utility at the equilibrium is proven. In the massive IoT system, due to the large set of available actions for the gateway, the MSNE is shown to be analytically challenging to derive, and, thus, a learning algorithm that converges to the MSNE is proposed. Moreover, in order to handle incomplete information scenarios in which the gateway cannot access the state of the unauthenticated IoTDs, a deep reinforcement learning algorithm is proposed to dynamically predict the state of unauthenticated IoTDs and allow the gateway to decide on which IoTDs to authenticate. Simulation results show that, with an attack detection delay of under 1 second, the messages can be transmitted from IoTDs with an almost 100% reliability. The results also show that, by optimally predicting the set of vulnerable IoTDs, the proposed deep reinforcement learning algorithm reduces the number of compromised IoTDs by up to 30%, compared to an equal probability baseline.

show abstract

“…However, such a solution cannot examine the details of activities that are executed in IoT devices, which are important to enable fine-grained detection of IoT malware. Another possible solution is to detect these activities by host-based security mechanisms [2,51]. Unfortunately, IoT devices are usually resource-constrained and always hard to support full-fledged detection solution.…”

Section: Introductionmentioning

confidence: 99%

DeepPower: Non-intrusive and Deep Learning-based Detection of IoT Malware Using Power Side Channels

Ding

Luo

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

The vulnerability of Internet of Things (IoT) devices to malware attacks poses huge challenges to current Internet security. The IoT malware attacks are usually composed of three stages: intrusion, infection and monetization. Existing approaches for IoT malware detection cannot effectively identify the executed malicious activities at intrusion and infection stages, and thus cannot help stop potential attacks timely. In this paper, we present DeepPower, a non-intrusive approach to infer malicious activities of IoT malware via analyzing power side-channel signals using deep learning. DeepPower first filters raw power signals of IoT devices to obtain suspicious signals, and then performs a fine-grained analysis on these signals to infer corresponding executed activities inside the devices. DeepPower determines whether there exists an ongoing malware infection by conducting a correlation analysis on these identified activities. We implement a prototype of DeepPower leveraging low-cost sensors and devices and evaluate the effectiveness of DeepPower against real-world IoT malware using commodity IoT devices. Our experimental results demonstrate that DeepPower is able to detect infection activities of different IoT malware with a high accuracy without any changes to the monitored devices. CCS CONCEPTS • Security and privacy → Malware and its mitigation; • Computer systems organization → Embedded hardware; • Computing methodologies → Neural networks.

show abstract

CloudEyes: Cloud‐based malware detection with reversible sketch for resource‐constrained internet of things (IoT) devices

Cited by 86 publications

References 23 publications

A state-of-the-art survey of malware detection approaches using data mining techniques

A state-of-the-art survey of malware detection approaches using data mining techniques

Deep Learning for Signal Authentication and Security in Massive Internet-of-Things Systems

DeepPower: Non-intrusive and Deep Learning-based Detection of IoT Malware Using Power Side Channels

Contact Info

Product

Resources

About