Efficient Signature Generation for Classifying Cross-Architecture IoT Malware

With the proliferation of Internet of Things (IoT) devices, cybersecurity has become an increasingly pressing concern. Due to their inherent vulnerabilities and the severity of the threats posed by malware, robust malware detection strategies for IoT devices are in high demand. However, the constraints imposed by the limited memory and processing power of IoT devices, alongside with the varied nature of these devices, have limited the development of effective malware detection strategies. Existing solutions primarily use either local computation or cloud-based services, each with its own set of challenges. In this paper, we propose a hybrid malware detection method that leverages both local and cloud-based computation to address these challenges. This method, based on similarity computations, optimizes the trade-off between computational resources and latency, offering an effective approach for malware detection in IoT devices. Through experimental evaluation using a substantial IoT malware dataset, we demonstrate that our proposed approach achieves an optimal balance between local and cloud-based computations, providing a promising solution for malware detection in IoT context.

IoT malware classification based on reinterpreted function-call graphs

Internet of Things (IoT) devices are largely embedded devices which lack a sophisticated user interface, e.g., touch screen, keyboard, etc. As a consequence, traditional Pre-Shared Key (PSK) based authentication for mobile devices becomes difficult to apply. For example, according to our study on home automation devices which leverage smartphone for PSK input, the current process does not protect against active impersonating attack and also leaks the Wi-Fi password to eavesdroppers, i.e., currently these IoT devices can be exploited to enter into critical infrastructures, e.g., home networks. Motivated by this real-world security vulnerability, in this paper we propose a novel proximity-based mechanism for IoT device authentication, called Move2Auth, for the purpose of enhancing IoT device security. In Move2Auth, we require user to hold smartphone and perform one of two hand-gestures (moving towards and away, and rotating) in front of IoT device. By combining (1) large RSS-variation and (2) matching between RSS-trace and smartphone sensor-trace, Move2Auth can reliably detect proximity and authenticate IoT device accordingly. Based on our implementation on Samsung Galaxy smartphone and commodity Wi-Fi adapter, we prove Move2Auth can protect against powerful active attack, i.e., the false-positive rate is consistently lower than 0.5%.

The Internet of Things (IoT) is a vast network of real, tangible objects or "things" that can communicate and share data with other systems and gadgets over the Internet. A vital component of assuring the secure and dependable operation of IoT systems and devices is IoT security. Attackers may use IoT devices to get unauthorized access, change functionality, or compromise the data that the device collects and transmits. The risks of IoT security breaches grow as more devices connect and exchange sensitive data. To check the vulnerability in Iot devices, a novel Blockchain enabled Iot based Security Assessment for intrusion (Block-ISAI) technique has been proposed. Bag of Words (BoW) technique is used for feature extraction of API documents which helps to make the document simpler. Blockchain technology is utilized for secure data storage and IoT device registration. In order to detect intrusion, a deep learning architecture is designed using the verified data The attack is either detected or not detected when the vulnerability is found using the GloVe-CNN-BiLSTM Model. If the vulnerability is detected then alerts will be given. Utilizing evaluation measures like accuracy, time efficiency, precision, F1 score, detection rate, recall, false alarm rate, usability and reliability the efficacy of the suggested ISAI technique has been assessed. By the comparison analysis, the proposed ISAI technique’s detection rate is 18.22%, 19.43%, and 3.13% higher than the existing HIDS, NIDS, and ML-DDoS techniques respectively. The accuracy of the proposed system is increased by 0.69%, 6.04%, and 36.15% as compared to the HIDS, NIDS, and ML-DDoS method using UNSW-NB 15 dataset and increases by 2.37%, 18.32%, and 5.95% using KDDCUP 19 dataset respectively.

Internet of Things (IoT) devices are increasingly deployed for different purposes such as data sensing, collecting and controlling. IoT improves user experiences by allowing a large number of smart devices to connect and share information. Many existing malware attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. Therefore, efficient protection at IoT devices could save millions of internet users from malicious activities. However, existing malware detection approaches suffer from high computational complexity. In this study, we propose a more accurate and fast model for detecting malware in the IoT environment. We introduce a Malware Threat Hunting System (MTHS) in the proposed model. MTHS first converts malware binary into a color image and then conducts the machine or deep learning analysis for efficient malware detection. We finally prepare a baseline to compare the performance of MTHS with traditional state-of-the-art malware detection approaches. We conduct experiments on two public datasets of Windows and Android software. The experimental results indicate that the response time and the detection accuracy of MTHS are better than those of previous machine learning and deep learning approaches.

<abstract> <p>With the widespread use of Internet, Internet of Things (IoT) devices have exponentially increased. These devices become vulnerable to malware attacks with the enormous amount of data on IoT devices; as a result, malware detection becomes a major problem in IoT devices. A reliable and effective mechanism is essential for malware detection. In recent years, research workers have developed various techniques for the complex detection of malware, but accurate detection continues to be a problem. Ransomware attacks pose major security risks to corporate and personal information and data. The owners of computer-based resources can be influenced by monetary losses, reputational damage, and privacy and verification violations due to successful assaults of ransomware. Therefore, there is a need to swiftly and accurately detect the ransomware. With this motivation, the study designs an Ebola optimization search algorithm for enhanced deep learning-based ransomware detection (EBSAEDL-RD) technique in IoT security. The purpose of the EBSAEDL-RD method is to recognize and classify the ransomware to achieve security in the IoT platform. To accomplish this, the EBSAEDL-RD technique employs min-max normalization to scale the input data into a useful format. Also, the EBSAEDL-RD technique makes use of the EBSA technique to select an optimum set of features. Meanwhile, the classification of ransomware takes place using the bidirectional gated recurrent unit (BiGRU) model. Then, the sparrow search algorithm (SSA) can be applied for optimum hyperparameter selection of the BiGRU model. The wide-ranging experiments of the EBSAEDL-RD approach are performed on benchmark data. The obtained results highlighted that the EBSAEDL-RD algorithm reaches better performance over other models on IoT security.</p> </abstract>

Seeing is not always believing: Insights on IoT manufacturing from firmware composition analysis and vendor survey

Maternal serum markers for trisomy 21 screening (MSS) can be assayed in women > or =35 years in an attempt to reduce the need for invasive procedures and thereby avoid their side effects. Our objective was to compare, in women > or =35, eight different software packages dedicated to second trimester MSS, thus providing reliable data for patient counselling. A simulation study was carried out on 189 sera from women with Down syndrome fetuses and 11 962 sera from mothers of unaffected babies. The first step was to estimate the joint distribution of alpha-fetoprotein (AFP) and free beta-human chorionic gonadotrophin (beta-hCG). The second step was to calculate trisomy 21 detection and false-positive rates for each software according to maternal age (35-45 years), using the usual 1:250 risk threshold. Agreement between software packages was measured using 2 x 2 kappa coefficients. Detection rates and false-positive rates increased with maternal age. Depending on the software, 57-71% detection rates were achieved at 35 years with 12-18% false-positive rates. At 45 years, 61-100% detection rates were achieved with 66-95% false-positive rates. Up to 39 years, all softwares were concordant (kappa coefficients >0.75). In the range 35-45 years, false-positive and detection rates increased substantially with maternal age and differences between software packages are observed.

IoT devices have been widely deployed in many applications to facilitate smart technology, increased portability, and seamless connectivity. Despite being widely adopted, security in IoT devices is often considered an afterthought due to resource and cost constraints. Among multiple security threats, malware attacks are observed to be a pivotal threat to IoT devices. Considering the spread of IoT devices and the threats they experience over time, deploying a static malware detector trained offline seems ineffective. On the other hand, on-device learning is an expensive or infeasible option due to the limited available resources on IoT devices. To overcome these challenges, this work employs 'Federated Learning' (FL) which enables timely updates to the malware detection models for increased security while mitigating the high communication or data storage overhead of centralized cloud approaches. Federated learning allows training machine learning models with decentralized data while preserving its privacy by design. However, one of the challenges with the FL is that the on-device models are required to be homogeneous, which may not be true in the case of networked IoT systems. As a panacea, we introduce a methodology to unify the models in the cloud with minimal overheads and an impact on on-device malware detection. We evaluate the proposed technique against homogeneous models in networked IoT systems encompassing Raspberry Pi devices. The experimental results and system efficiency analysis indicate that end-to-end training time is just 1.12× higher than traditional FL, testing latency is 1.63× faster, and malware detection performance is improved by 7% to 13% for resource-constrained IoT devices.

The Internet of Things (IoT) has become a technological innovation that brings many benefits in various sectors, but also presents challenges, especially in terms of cybersecurity. One of the main threats is malware, which can damage devices, steal data, and disrupt system performance. With the increasing use of IoT, malware attacks on IoT devices are a serious concern. Previous research shows that malware detection models in IoT devices still have shortcomings, especially in terms of accuracy. One of the algorithms used in malware detection, Naïve Bayes, has been shown to provide low accuracy results. This study aims to improve the accuracy of malware detection on IoT networks by applying Ensemble learning techniques using traffic data from the IoT-23 dataset. The methodology used refers to the CRISP-DM (Cross Industry Standard Process for Data Mining) framework, which includes the stages of domain understanding, data understanding, data preparation, modelling, evaluation, and deployment. The results show that Ensemble learning improved the performance of individual models. Naïve Bayes as a single model produces an accuracy of 0.24, increasing to 0.35 when combined with AdaBoost, and 0.99 when combined with XGBoost. The combination of the three models also produced an accuracy of 0.99. These results demonstrate the effectiveness of ensemble learning in improving malware detection accuracy in IoT environments.

The Internet of Things (IoT) is a new paradigm that enables the convergence of smart objects and the internet. This convergence has led to the creation of an intelligent network that connects all things to the internet for the purpose of exchanging information. The direct connection of IoT devices to the internet makes them susceptible to several security threats. Researchers have developed techniques aimed at enhancing security of IoT devices at both network and application layers. In this paper, we present a real-time and lightweight algorithm, based on information theoretic approach, that enables rogue access point detection for embedded IoT devices. This is to ensure that WiFi-enabled IoT devices can intelligently distinguish between legitimate and rogue access points. We evaluated the performance of the algorithm with respect to the detection rate and also CPU utilization efficiency.

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

Age related detection and false positive rates when screening for Down's Syndrome in the first trimester using fetal nuchal translucency and maternal serum free βhCG and PAPP-A

This paper explores the integration of Internet of Things (IoT) devices into modern cybersecurity frameworks, and it is intended to be a binder for the incorporation of these devices into emerging cybersecurity paradigms. Most IoT devices rely on WPA2-personal protocol, a wireless protocol with known security flaws, being effortless to penetrate by using various specific tools. Through this paper, we proposed the use of two Raspberry Pi platforms, with the help of which we created a secure wireless connection by implementing the 802.1X protocol and using digital certificates. Implementing this type of architecture and the devices used, we obtained huge benefits from the point of view of security and energy consumption. We tested multiple authentication methods, including EAP-TLS and EAP-MSCHAPv2, with the Raspberry Pi acting as an authentication server and certificate manager. Performance metrics such as power consumption, latency, and network throughput were analysed, confirming the architecture’s effectiveness and scalability for larger IoT deployments.

To determine the value and impact over a seven year period of a second trimester screening programme for trisomy 21 and trisomy 18, using the two maternal serum markers alpha-fetoprotein and free beta human chorionic gonadotrophin. Retrospective review. A biochemical screening laboratory serving three health districts with three antenatal clinics in both teaching and nonteaching hospitals. 67,904 pregnancies in women of all ages screened between 14 and 22 weeks of gestation between 1 April 1991 and 31 March 1998. All women booked into three major antenatal clinics were offered biochemical screening. Women at increased risk of trisomy 21 or trisomy 18 (> or =1 in 250 at term) were offered an invasive diagnostic procedure. Follow up of the outcome of all pregnancies was performed. Detection rate for trisomy 21 and trisomy 18, false positive rates, uptake of screening, uptake of amniocentesis in women identified at increased risk, prevalence of trisomy 21 at birth, detection and false positive rates by maternal age, fetal loss rate after amniocentesis, report turn around time, and identification of other anomalies. Overall, 87% (67,904/78,501) of women underwent screening. The rate of detection of trisomy 21 was 75% (80/107; 95% CI 66 to 83) with a 5.1% false positive rate (3466/67,904; CI 4.9 to 5.3%). In women under 30 years of age the detection rate was 60% (18/30; CI 41 to 77) with a 2.6% false positive rate (956/36,371; CI 2.5 to 2.8). The rate of detection of trisomy 18 was 57% (8/14; CI 29 to 82) with a 0.7% false positive rate (475/67,904; CI 0.64 to 0.76). Uptake of amniocentesis was 83% (2912/3508). Women were 3.3 times more likely to refuse amniocentesis if the risk was close to the cutoff (1 in 250) than if the risk was > or =1 in 50. Fetal loss within 28 days of amniocentesis was 0.9% (25/2912). Prenatal screening identified 84 other anomalies in addition to 41 cases of impending fetal death. Second trimester prenatal screening for trisomy 21 and trisomy 18 using a simple two marker approach incorporating free beta hCG can achieve high detection rates over a long period of time. Health authorities who still have not introduced trisomy 21 screening should be encouraged by what can be achieved and should consider making such screening available to all women. Established second trimester detection rates of 75% for a 5% false positive rate will be the benchmark by which first trimester screening using nuchal translucency, PAPP-A and free beta hCG will be judged.