IoT Malware Classification Based on Lightweight Convolutional Neural Networks

Yuan, Baoguo; Wang, Junfeng; Wu, Peng; Qing, Xianguo

doi:10.1109/jiot.2021.3100063

Cited by 32 publications

(8 citation statements)

References 51 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An alternative solution is employing a static detection method [ 21 , 22 ] that uses control flow graphs as features, which affords high accuracy but is time-consuming to compute. Image-based static analysis [ 23 , 24 , 25 , 26 ] often requires complex models with tens of thousands of training parameters. Nevertheless, such approaches may lose accuracy when using obfuscation and encryption techniques to process samples.…”

Section: Related Workmentioning

confidence: 99%

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

Zhao

Kuerban

2023

Sensors

View full text Add to dashboard Cite

With the development of internet technology, the Internet of Things (IoT) has been widely used in several aspects of human life. However, IoT devices are becoming more vulnerable to malware attacks due to their limited computational resources and the manufacturers’ inability to update the firmware on time. As IoT devices are increasing rapidly, their security must classify malicious software accurately; however, current IoT malware classification methods cannot detect cross-architecture IoT malware using system calls in a particular operating system as the only class of dynamic features. To address these issues, this paper proposes an IoT malware detection approach based on PaaS (Platform as a Service), which detects cross-architecture IoT malware by intercepting system calls generated by virtual machines in the host operating system acting as dynamic features and using the K Nearest Neighbors (KNN) classification model. A comprehensive evaluation using a 1719 sample dataset containing ARM and X86-32 architectures demonstrated that MDABP achieves 97.18% average accuracy and a 99.01% recall rate in detecting samples in an Executable and Linkable Format (ELF). Compared with the best cross-architecture detection method that uses network traffic as a unique type of dynamic feature with an accuracy of 94.5%, practical results reveal that our method uses fewer features and has higher accuracy.

show abstract

Section: Related Workmentioning

confidence: 99%

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

Zhao

Kuerban

2023

Sensors

View full text Add to dashboard Cite

show abstract

“…Accuracy: In mask detection, it can be described as Whether or not wearing a mask is a false detection that does not match the real situation. However, using performance measurement metrics, the accuracy can be defined mathematically as (5) And we only used the above given equation for the proposed technique performance evaluation.…”

Section: Performance Measurementsmentioning

confidence: 99%

Application of YOLOv5 for mask detection on IoT

Huang,

Liu,

et al. 2023

ACE

View full text Add to dashboard Cite

The combination of the Internet of Things and deep learning technology is usually accompanied by many problems, such as limited bandwidth and computing resources. IoT combined with deep learning often causes system freezes or delays due to limited computing resources. Upgrading the hardware equipment of the IoT system requires a large economic cost, but using a lightweight deep learning model can reduce the consumption of hardware resources to adapt to the actual scene. In this paper, we combine IoT technology and improve a lightweight deep learning model, YOLOv5, to assist people in mask detection, vehicle counting, and target tracking, which does not take up too many computing resources. We deployed the improved YOLOv5 on the server side, and completed the training in the container. The weight file after training was deployed in Docker, and then combined with Kubernates to get the final experimental results. The resulting graph can be displayed by opening a browser at the edge node and entering the relevant IP address. Users can also perform certain operations on the results in the front end of the browser, such as drawing a horizontal line in the road to complete the local vehicle count. These operations are also fed back to the server for interaction with developers. For improved YOLOv5, the recognition speed and accuracy are faster than before. At the same time, compared with the previous version, the model itself requires less storage space and is easier to deploy, making the model easier to implement in the operation of edge nodes. Theoretical analysis and experimental results verify the feasibility and superiority of the proposed method.

show abstract

“…Kalash et al 27 proposed a malware sample classification architecture based on CNN, which converts malware binaries into gray‐scale images, and then trains the CNN model for classification. In 2021, Yuan et al 28 proposed a lightweight malware classification method for the IoT based on CNN. Dib et al 29 proposed a multidimensional classification method based on deep learning architecture by using the features extracted from strings and the image‐based representation of executable binary files.…”

Section: Related Workmentioning

confidence: 99%

CNN‐ and GAN‐based classification of malicious code families: A code visualization approach

Wang

Yang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Malicious code attacks have severely hindered the current development of the Internet technologies. Once the devices are infected with virus, the damages to companies and users are unpredictable. Although researchers have developed malware detection methods, the analysis result still cannot achieve the desired accuracy due to complicated malicious code families and fast‐growing variants. In this paper, to solve this problem, we combine Convolutional Neural Networks (CNNs) with Generative Adversarial Networks (GANs) to design an efficient and accurate malware detection method. First, we implement a code visualization method and utilize GAN to generate more samples of malicious code variants in the role of data augmentation. Then, the lightweight AlexNet originated from CNN to classify malware families. Finally, simulation experiments are conducted to evaluate that our CNN plus GAN model can achieve a higher classification accuracy (i.e., 97.78%) compared with some related work.

show abstract

IoT Malware Classification Based on Lightweight Convolutional Neural Networks

Cited by 32 publications

References 51 publications

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

Application of YOLOv5 for mask detection on IoT

CNN‐ and GAN‐based classification of malicious code families: A code visualization approach

Contact Info

Product

Resources

About