A novel graph-based approach for IoT botnet detection

Nguyen, Huy-Trung; Ngo, Quoc-Dung; Le, Van-Hoang

doi:10.1007/s10207-019-00475-6

Cited by 90 publications

(47 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[9] NB, BN, & DT 98.00 [10] Not ML method 99.00 [11] ANN, SVM, k-NN, NB, & GBM 97.00 [12] k-NN, DT, & RF 70.00 [13] ANN, SVM, NB, DT, RF, LR. & BNet 99.47 [14] NB & DT 97.00 [15] DT 99.00 [16] K-means 82.10 [17] DT 97.00 [18] RF 86.41 [19] ANN, SVM, & NB 93.90 [44] Not ML method 99.82 [20] k-NN & RF 91.10 [21] ANN 97.87 [22] DT 90.40 [23] DT 99.46 [24] ANN, SVM, & k-NN 99.00 [45] Not ML method 95.50 [46] Not ML method 99.68 [25] SVM & ANN 94.00 [47] Not ML method 99.70 [26] DT & ANN 99.20 [48] Not ML method 99.00 [27] KNN, SVM, DT, RF, & ANN 99.00 [28] SVM 99.15 [29] k-NN 94.00 [49] Not ML method 96.20 [50] Not ML method 99.35 [51] Not ML method 92.92 [52] Not ML method 98.70 [53] Not ML method 97.00 [54] Not ML method 98.70 [55] Not ML method *100 [56] Not ML method 99.94 [57] Not ML method 99.60 [58] Not ML method 98.60 [59] Not ML method 97.20 [30] k-NN, NB, DT, RF, & SVM 91.80 [31] ANN 99.60 This research LR, LR, DT, NB, k-NN, RF, GBM, SVM, K-means, K-medians, mini batch, HC, ANN, DBSCAN, GMM, LAC, AP, and ensemble learning…”

Section: Resultsmentioning

confidence: 99%

Using Ensemble Learning Technique for Detecting Botnet on IoT

Rezaei

2021

SN COMPUT. SCI.

View full text Add to dashboard Cite

Despite the growing reputation and the ubiquitous nature of the IoT, it poses significant challenges as it is also considered a convenient platform for cyberattacks. The connection of various devices without fixed security help attackers in allowing botnet to run high crash DDoS attacks against a range of internet services. The botnet is one of the main security challenges that have the most impact on IoT for several reasons. It allows the private network devices to be infected by malicious software and controlled as a group without the owners' awareness. Botnets are often utilized for sending spam, stealing data, and performing DDoS attacks. As there are many areas of security that utilize machine learning (ML) technology, utilizing ML to detect botnet appears to be realistic and workable. While several studies have been conducted using ML for detecting botnet, they are either not highly accurate or only compatible with specific types of botnet or devices. This study aims to create an ensemble learning model using the best ML methods among supervised learning, unsupervised learning, and regression learning to optimize the accuracy of botnet detection on IoT and minimize the number of features requested. After several examinations in different combinations of ML algorithms, this study managed to achieve 100% accuracy of botnet detection as well as minimizing the number of features to only 20.

show abstract

Section: Resultsmentioning

confidence: 99%

Using Ensemble Learning Technique for Detecting Botnet on IoT

Rezaei

2021

SN COMPUT. SCI.

View full text Add to dashboard Cite

show abstract

“…By focusing on analyzing 16 families of IoT Botnet, discovered from 2008 to 2018, Vignau [42] identified IoT Botnet as a significant threat to the IoT ecosystem, and malicious behaviors focused on launching a DDoS attack, characterized by Botnet. Nguyen [19], Angrishi [8], and Kolias [1] also presented behavioral features of the IoT Botnet, including:…”

Section: A Overview Of Iot Botnetmentioning

confidence: 99%

“…Addressing the risks above, malicious researchers have developed new methods and frameworks to effectively analyze and detect malware samples on IoT devices [14]- [25]. These studies can be divided into two main groups, which are static analysis [14]- [19] and dynamic analysis [20]- [25].…”

Section: Introductionmentioning

confidence: 99%

“…As in [19], [25], authors have presented the static analysis method, which allows full control of the control flow (CFG) and data flow (DFG) to detect malicious code by specific analytical techniques such as byte code, system calls API or Printable Strings Information (PSI) [19], [26]. This method allows a detailed analysis of files and gives the activation capabilities of malicious code [27].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

V-Sandbox for Dynamic Analysis IoT Botnet

Ngo

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

With the increasing use of resource-constrained IoT devices, the number of IoT Botnets has exploded with many variations and ways of penetration. Nowadays, studies based on machine learning and deep learning have focused on dealing with IoT Botnet with many successes, and these studies have required relevant data during malware execution. For this, the sandbox environment and behavior collection tools play an essential role. However, the existing sandboxes do not provide adequate behavior data of IoT botnet such as the C&C server communication, shared libraries requirements. Moreover, these sandboxes do not support a wide range of CPU architectures, data is not exhaustively collected during executable file runtime. In this paper, we present a new practical sandbox, named V-Sandbox, for dynamic analysis of the IoT Botnet. This sandbox is an ideal environment for IoT Botnet samples that exhibit all of their malicious behavior. It supports the C&C servers connection, shared libraries for dynamic files, and a wide range of CPU architectures. Experimental results on the 6141 IoT Botnet samples in our dataset have demonstrated the effectiveness of the proposed sandbox, compared to existing ones. The contribution of this paper is specific to the development of a usable, efficient sandbox for dynamic analysis of resource-constrained IoT devices.

show abstract

“…Static analysis examines the codes of malware samples without executing them. In static analysis, content-based features such as instruction opcodes [3], API sequences [4], [5] and function call graphs (FCGs) [6], [7] are typically extracted from disassembled malicious PE files as the original features for analysis. Static analysis can easily capture syntax and semantic information for in-depth analysis, but it is susceptible to code obfuscation techniques, e.g., compression and polymorphic/metamorphic transformation [8].…”

Section: Introductionmentioning

confidence: 99%

Exploring Function Call Graph Vectorization and File Statistical Features in Malicious PE File Classification

et al. 2020

View full text Add to dashboard Cite

Over the last few years, the malware propagation on PC platforms, especially on Windows OS has been even severe. For the purpose of resisting a large scale of malware variants, machine learning (ML) classifiers for malicious Portable Executable (PE) files have been proposed to achieve automated classification. Recently, function call graph (FCG) vectorization (FCGV) representation was explored as the input feature to achieve higher ML classification accuracy, but FCGV representation loses some critical features of PE files due to the hash technique. This paper aims to further improve the classification accuracy of FCGV-based ML model by applying both graph and non-graph features. We propose an FCGV-SF based Random Forest classification model, which applies both FCGV features (graph features) and statistical features (SF, non-graph features) extracted from disassembled PE files. Six types of effective non-graph features are chosen for our integrated vector, namely, metadata, symbol, operation code, register, section and data definition. We evaluate our model on a dataset provided by Microsoft hosted at Kaggle, and the experimental results indicate that the classification accuracy increases from 0.9851 to 0.9957 compared with the existing model based on FCGV only.

show abstract

A novel graph-based approach for IoT botnet detection

Cited by 90 publications

References 25 publications

Using Ensemble Learning Technique for Detecting Botnet on IoT

Using Ensemble Learning Technique for Detecting Botnet on IoT

V-Sandbox for Dynamic Analysis IoT Botnet

Exploring Function Call Graph Vectorization and File Statistical Features in Malicious PE File Classification

Contact Info

Product

Resources

About