Cross-Architecture Intemet-of-Things Malware Detection Based on Graph Neural Network

Li, Chuangfeng; Shen, Guangming; Sun, Wei

doi:10.1109/ijcnn52387.2021.9533500

Cited by 10 publications

(13 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The work [ 54 ], similar to the current research, is devoted to the protection of IoT devices from malware. For this, static analysis of the binary code is used.…”

Section: Discussionmentioning

confidence: 99%

Analytical Modeling for Identification of the Machine Code Architecture of Cyberphysical Devices in Smart Homes

Kotenko

Izrailov

Buinevich

2022

Sensors

View full text Add to dashboard Cite

Ensuring the security of modern cyberphysical devices is the most important task of the modern world. The reason for this is that such devices can cause not only informational, but also physical damage. One of the approaches to solving the problem is the static analysis of the machine code of the firmware of such devices. The situation becomes more complicated in the case of a Smart Home, since its devices can have different processor architectures (means instruction sets). In the case of cyberphysical devices of the Smart Home, the destruction of machine code due to physical influences is also possible. Therefore, the first step is to correctly identify the processor architecture. In the interests of this, a machine code model is proposed that has a formal notation and takes into account the possibility of code destruction. The article describes the full cycle of research (including experiment) in order to obtain this model. The model is based on byte-frequency machine code signatures. The experiment resulted in obtaining template signatures for the Top-16 processor architectures: Alpha, X32, Amd64, Arm64, Hppa64, I486, I686, Ia64, Mips, Mips64, Ppc, Ppc64, RiscV64, S390, S390x and Sparc64.

show abstract

“…The work [ 54 ], similar to the current research, is devoted to the protection of IoT devices from malware. For this, static analysis of the binary code is used.…”

Section: Discussionmentioning

confidence: 99%

Analytical Modeling for Identification of the Machine Code Architecture of Cyberphysical Devices in Smart Homes

Kotenko

Izrailov

Buinevich

2022

Sensors

View full text Add to dashboard Cite

show abstract

“…Application Primary Focus Secondary Focus [38] malicious actor IDS - [39] malicious actor IDS - [40] malicious actor DDoS - [41] malicious actor SYN attack - [11] malicious actor botnet - [42] malicious actor -- [14] malicious actor -time series data [43] malicious actor malware detection - [46] malicious actor feature selection - [12] malicious actor -- [44] malicious actor IDS - [10] malicious actor IDS - [45] malicious actor IDS - [47] sensor performance water systems time series data [48] sensor performance charging system - [49] sensor performance nuclear power plant - [51] sensor performance edge connection fault detection - [15] sensor performance emergency detection - [54] time series data IIoT sensor drift - [7] time series data -- [13] time series data multivariate time series data - [55] time series data -- [57] general AD time series data multi-class detection [56] general AD automated vehicles - [58] general AD time series data energy efficiency [52] distributed AD -- [53] distributed AD time series data -…”

Section: Referencementioning

confidence: 99%

“…Table A4 lists all the data-sets used in the works surveyed here. IEEE Xplore 2020 [3] IEEE Xplore 2020 [44] IEEE Xplore 2021 NN and logistic regression (ensemble) 5 [2] IEEE Xplore 2021 STGNN, GCN 3+N (max) [14] IEEE Xplore 2021 GTA l5 [43] IEEE Xplore 2021 GraphSAGE, MLP K+1 [23] Journal of Physics 2021 [24] Nature 2021 GCN (encoder) [10] Science Direct 2019 MLP [45] Wiley 2021 MLP 6 (max) [52] Wiley 2021 CNN, MLP Table A2. Breakdown of hyperparameters in surveyed works.…”

Section: Appendix a Dataset And Breakdown Of Approachesmentioning

confidence: 99%

“…Training Epochs [39] 24 h of data [12] 128 Leaky ReLU 50 [48] 5 threshold [54] 40 sigmoid and tanh [40] 14 ReLU 100 [49] 256 [7] sigmoid, ReLU, softplus GRU [11] 12 SeLU [42] 60 ReLU LSTM, sigmoid, softmax [41] 50 [57] 8 softmax/regression 8 [58] 50-100 leaky ReLU (AE), ReLU+Lin (VAE enc), ReLU+Sig (VAE dec) Regression 100 [13] 128 leaky ReLU, max, ReLU max, softmax, sigmoid 150 (trn), 50 (f-t) [15] 15 logarithmic 7 [51] 10 tanh, sigmoid 5-80 [28] 500 [56] 64 ReLU, tanh 200 [55] varies sigmoid, tanh [44] 40 ReLU sigmoid 100 [2] ReLU softmax [14] 128 50 (5x mean) [43] varies avg pooling, ReLU, max pooling Softmax [23] [24] sigmoid, ReLU [10] sigmoid, ReLU, Leaky ReLU, tanh softmax [45] 35 ReLU softmax 300 [52] ReLU linear 1-class Table A2. Cont.…”

Section: Reference Largest Layer Activation Function Classifier/regre...mentioning

confidence: 99%

“…Learning Rate Batch Size Regularization Loss Function Optimizer [12] 0.001 MSE Adam [48] 0.005 [54] 0.0005 0.02 dropout min avg pred err [40] keras default 32 MSE Adam [49] 0.0001 0.35, 0.3 dropout cross-entropy Adam [7] Kullback-Leibler loss negative reconstruction err + reg [42] grid search opt dropout (grid search opt) MAE, cross-entropy (binary, categorical) Adam [41] MSE Adam [57] 0.005 modified log (TCN), reconstruction loss with KLD (VAE) Adam [58] mini batch reconstruction loss using MSE and KLD Adam [13] 0.0005, 0.0001 64, 32(trn), 32(f-t) 0.2 dropout cross-entropy, squared error SGD, Adam [15] 0.1 MSE MATLAB trainlm [28] KL-divergence+ MSE [56] 0.025 200 L2 w/ 0.2 dropout Adam [55] varies varies dropout, varies MSE GD [44] log log GD [2] batch GD [14] 0.0001 window size = 6 0.05 dropout MSE Adam [43] 0.001 cross-entropy Adam [24] D-value (anomaly score) [10] cross-entropy coordinate descent, GD [45] 0.4 dropout negative log likelihood Adam [52] batch norm w/ rand dropout Table A3. Breakdown of data-sets and metrics used by surveyed works.…”

Section: Referencementioning

confidence: 99%

See 2 more Smart Citations

A Survey of AI-Based Anomaly Detection in IoT and Sensor Networks

DeMedeiros

Hendawi

Álvarez

2023

Sensors

View full text Add to dashboard Cite

Machine learning (ML) and deep learning (DL), in particular, are common tools for anomaly detection (AD). With the rapid increase in the number of Internet-connected devices, the growing desire for Internet of Things (IoT) devices in the home, on our person, and in our vehicles, and the transition to smart infrastructure and the Industrial IoT (IIoT), anomaly detection in these devices is critical. This paper is a survey of anomaly detection in sensor networks/the IoT. This paper defines what an anomaly is and surveys multiple sources based on those definitions. The goal of this survey was to highlight how anomaly detection is being performed on the Internet of Things and sensor networks, identify anomaly detection approaches, and outlines gaps in the research in this domain.

show abstract