Intelligent Mirai Malware Detection for IoT Nodes

Abstract

The advancement in recent IoT devices has led to catastrophic attacks on the devices resulting in breaches in user privacy and exhausting resources of various organizations, so that users and organizations expend increased time and money. One such harmful malware is Mirai, which has created worldwide recognition by impacting the digital world. There are several ways to detect Mirai, but the Machine Learning approach has proved to be accurate and reliable in detecting malware. In this research, a novel-based approach of detecting Mirai using Machine Learning Algorithm is proposed and implemented in Matlab and Python. To evaluate the proposed approaches, Mirai and Benign datasets are considered and training is performed on the dataset comprised of a Training set, Cross-Validation set and Test set using Artificial Neural Network (ANN) consisting of neurons in the hidden layer, which provides consistent accuracy, precision, recall and F-1 score. In this research, an accurate number of hidden layers and neurons are chosen to avoid the problem of Overfitting. This research provides a comparative analysis between ANN and Random Forest models of the dataset formed by merging Mirai and benign datasets of the Mirai malware detection pertaining to seven IoT devices. The dataset used in this research is “N-BaIoT” dataset, which represents data in the features infected by Mirai Malware. The results are found to be accurate and reliable as the best performance was achieved with an accuracy of 92.8% and False Negative rate of 0.3% and F-1 score of 0.99. The expected outcomes of this project, include major findings towards cost-effective Learning solutions in detecting Mirai Malware strains.

Identification of Immune-Related Genes in Patients with Acute Myocardial Infarction Using Machine Learning Methods

“…Furthermore, the AUC, accuracy, precision, recall, specificity, and F1-score were calculated from Confusion Matrices to evaluate the classification capability of each model. 26 Finally, the two models with the highest average AUC in validation sets were chosen without affecting the accuracy of classification efficiency. We selected the random forest and the XGBoost models and mapped the most important top 20 genes in both models, respectively, for further validation.…”

Prediction Models to Effectively Detect Malware Patterns in the IoT Systems

“…96.7. The authors [18] have presented a new method based on ML for detecting Mirai malware "NBaIoT" dataset, which data consist of features infected by the Mirai Malware, is used in that study. The Cross-Validation technique has been used for data splitting to overcome overfitting, and the experiment was conducted using ANN.…”

iDRP Framework: An Intelligent Malware Exploration Framework for Big Data and Internet of Things (IoT) Ecosystem

“…The technological advancements in present-day cyberattacks has made the activities of advanced attackers more complex to detect as a result of emerging obfuscation techniques [27], [38], [39] and interactions [40] with stealth variations carried out on IoT ecosystems.…”

“…In modern times, the emerging polymorphic malware attacks in the IoT ecosystems have been a major concern [1] due to complex obfuscation code structures that are mostly time based [41], [42]. These IoT malware signatures attacks that are predominantly multivariate [39], [40], [42]- [44] are updated sequentially on a minute-by-minute or hour-by-hour basis et al by the attackers, thereby inundating and silencing any potential alert system, which may cause massive vulnerabilities for exploitations in an IoT ecosystem. The current widespread detection and mitigation mechanisms for these emerging polymorphic IoT malware attacks that are largely obfuscated intricately can be problematic and resource intensive to both the traditional and automated malware detection solutions such as the signature based (e.g., large database), and automated based techniques (insufficient information) etc., adopted by major cybersecurity vendors, practitioners, and researchers in the cross-discipline cybersecurity industries.…”

“…Evidently, the aforementioned complex IoT malware detection approaches are no longer suitable for current growing subtle and complex obfuscated cybersecurity paradigm for five (5) major reasons: (1) the distinct fragments (sections) of converted IoT malware image file can be visualized [27], [38]; (2) the distinct textural patterns of the converted IoT malware image files can be classified (and reclassified), and analyzed using image processing [27], [45] classification techniques commonly applied in computer vision [30], [31]; (3) the advanced attackers typically modify or reuse codes to generate new variants of complex obfuscated IoT malware scripts [38]- [40]; (4) the vector structures of converted IoT malwares image files of the same family are similar [27], which means vectorized representation (i.e., faster speed) of the IoT malware image files will be sufficient to be fed directly as input into the similar ML-DL algorithms [30], [31] built for image and pattern recognitions [27], [45]- [47]; (5) the captured IoT malware dataset once converted to image files will be immutable (nondestructive and tamper proof), so there is no workaround its state by the attackers. Therefore, an amalgamation and syntheses of the modern ML-DL techniques and methods designed utilizing converted immutable IoT malware binaries to image files is both a logical and pragmatic solution to the current rapidly growing complex IoT malware problems that would scale adaptively.…”