Cognitive and Scalable Technique for Securing IoT Networks Against Malware Epidemics

Abstract

The sheer volume of IoT networks being deployed today presents a major "attack surface" and poses significant security risks at a scale never encountered before. In other words, a single IoT device/node that gets infected with malware has the potential to spread the malicious activities across the network, eventually ceasing the network functionality or compromising the network. Simply detecting and quarantining the malware in IoT networks does not guarantee preventing malware propagation. On the other hand, use of traditional control theory for malware confinement is not effective, as most of the existing works do not consider real-time malware control strategies that can be implemented using uncertain infection information from the nodes in the network or have the containment problem decoupled from network performance. In response, in this work, we propose a two-pronged approach with malware detection at nodelevel, and confinement of malware at network-level. We deploy a recently proposed lightweight runtime malware detector at the node-level that employs Hardware Performance Counter (HPC) values for malware detection. This node-level malware information is combined with the malware propagation information and then fed during runtime to a stochastic predictive controller to confine the malware propagation without hampering the network performance. Synthesizing the node-level malware information with the model predictive containment strategy leads to achieving an average network throughput of nearly 200% of that of IoT network without any defense, and up to 160% of that of network with commonly employed state-ofthe-art heuristic approaches for malware confinement. Furthermore, to scale with ever-increasing network topology sizes, we introduce a novel multi-attribute graph translation that can predict the network topology and node state information when provided with a snapshot of topology and node-level malware infection. The proposed multi-attribute graph translation has <5.88 Root Mean Square Error (RMSE) compared to the model predictive containment strategy and has shown nearly constant graph translation time and limited resource utilization independent of the network size.

Dynamic Malware Mitigation Strategies for IoT Networks: A Mathematical Epidemiology Approach

“…Furthermore, a quarantine-oriented mitigation plan has been researched for time-varying graphs [25], whereby the layout of a graph is employed to represent the necessary measures to overcome a resource allocation dilemma [26]. Control theory and game theory are two main approaches to containing malware in networks [27]. Solutions based on control theory are often based on heuristics and simplifications, which can lead to sub-optimal results [28].…”

CPS Attacks Mitigation Approaches on Power Electronic Systems With Security Challenges for Smart Grid Applications: A Review

“…FDI attacks can affect the LMP by confusing the state estimation, which then unsympathetically involves the contingency analysis processes [45]. • Insertion of worms or malware can range from malicious software that operates in backgrounds to decelerate the smart grid computers' operations via employing Trojan software for stealing the certificates of practical security [46]. To detect cyber-attacks on the Internet-of-Things (IoT) applications, the sensors available in the system is utilized along with monitoring the physical system possible models.…”

Towards Accurate Run-Time Hardware-Assisted Stealthy Malware Detection: A Lightweight, yet Effective Time Series CNN-Based Approach

“…Attackers are increasingly motivated and enabled to compromise software and computing hardware infrastructure. The increasing complexity of modern computing systems in different application domains has resulted in the emergence of new security vulnerabilities [1][2][3][4]. Cyber attackers make use of these vulnerabilities to compromise systems using sophisticated malicious activities.…”

“…The emergence of new malware threats requires patching or updating the software-based malware detection solutions (such as off-the-shelf anti-virus) that needs a vast amount of memory and hardware resources, which is not feasible for emerging computing systems especially in embedded mobile and IoT devices [3,14,15]. In addition, most of these advanced analysis techniques are architecture-dependent i.e., dependent on the underlying hardware, which makes the existing traditional malware detection techniques hard to import onto emerging embedded computing devices [4,14].…”

“…HMD methods reduce the latency of the detection process by order of magnitude with a small hardware overhead. In particular, recent studies have shown that malware can be differentiated from normal programs by classifying anomalies using Machine Learning (ML) techniques in low-level microarchitectural feature spaces captured by Hardware Performance Counters (HPCs) [4,[14][15][16][17][18][19][20][21][22] to appropriately represent the application behavior. The HPCs are special-purpose registers implemented into modern microprocessors to capture the trace of hardware-related events such as executed instructions, suffered cache-misses, or mispredicted branches for a running program [16,18,23].…”