Multichannel Based IoT Malware Detection System Using System Calls and Opcode Sequences

Abstract

The rapid development in the field of the Internet of things gives rise to many malicious attacks, since it holds many smart objects whose lack of an efficient security framework. These kinds of security issues bring the entire halt-down situation to all smart objects that are connected to the network. In this work, multichannel Convolutional Neural Network (CNN) is proposed whereas each channel’s CNN works on each type of input parameter. This model has two channels connected in a parallel manner, with one CNN taking an opcode sequence as input and the other CNN running with system calls. These extracted system calls and opcode sequences of elf files were discriminated against using two more deep learning algorithms along with multichannel CNN, namely Recurrent Neural Network (RNN) and CNN, and a few recent existing solutions. The performance analysis of the aforementioned algorithms has been carried out and evaluated using accuracy, precision, recall, F1-measure, and time. The experimental results show that multichannel CNN outperforms the remaining considered techniques by achieving a high accuracy of 99.8% for classifying malicious samples from benign ones. The real-time Internet of Things (IoT) malware samples were collected from the IoT honeyPot (IOTPOT), which emulates different CPU architectures of IoT devices.

Securing IoT Devices Running PureOS from Ransomware Attacks: Leveraging Hybrid Machine Learning Techniques

“…(a) Unusual or high-volume network traffic [10], as well as traffic from unknown sources, ports, or protocols, are just some of the indicators that were uncovered by ML models monitoring network activity. (b) System calls are used by malware to communicate with the operating system and were a telltale sign of malicious software [11]. Models trained with ML were very vigilant on system calls for signs of malicious activity.…”

Kernel rootkit prevention model using multiclass

“…These drawbacks are caused by the emulation, which adds a significant performance penalty. In this work, employing the SHA-256 algorithm aids efficiently and effectively in rootkit detection in a virtual system [4]. Analysing each hashing algorithm's unique characteristics and the needs of the use case is essential when choosing one, such as message diggest 5 (MD5) and SHA-256.…”