Lightweight ELF header analysis model for IoT malwares detection based on machine learning

The Internet of Things (IoT) devices is able to communicate with another IoT devices in heterogeneous environments. They are also able to create a network by their own using wireless capabilities without a centralized approach. This network is called wireless mobile ad hoc network (MANET). The MANET facilitate IoT devices to communicate with each other in an infrastructure less network of the Internet of Things environment. The IoT devices can dynamically join, create connection and exchange information among them. The role of cloud in this framework is to store and process the data by IoT devices. The communication Security has been raised as one of the most critical issues of cloud computing where resolving such an issue would result in a constant growth in the use and popularity of cloud. Our purpose of this study is to create a framework for providing the communication in an integrated framework of Cloud and MANET among IoT devices. Our main contribution links a new study that integrates cloud computing to the MANET and provides communication to the internet of things. This study can be used in the framework of the Internet of Things in future.

The proliferation of Internet of Things (IoT) devices has introduced unprecedented connectivity and convenience but also heightened the vulnerability to botnet attacks. There are an increasing number of Internet of Things (IoT) devices connected to the network these days, and due to the advancement in technology, the security threads and cyberattacks, such as botnets, are emerging and evolving rapidly with high-risk attacks. These attacks disrupt IoT transition by disrupting networks and services for IoT devices. Many recent studies have proposed ML and DL techniques for detecting and classifying botnet attacks in the IoT environment. This project presents a straightforward approach to detect botnet activity within IoT networks through the utilization of machine learning techniques. By analyzing network traffic patterns and employing unsupervised learning algorithms, we demonstrate an effective method to identify and mitigate botnet threats in IoT environments. By this project we intend to offer a valuable contribution in enhancing the security of IoT ecosystem. Key Word: Internet of Things(IoT),cybersecurity, botnet attacks, machine learning(ML),UNSW-NB15 dataset, exploratory data analysis, XgBoost

In the Internet of Things (IoT) technology, there are several issues to overcome, including network security. New attacks have been developed to target vulnerabilities in IoT devices, and the Internet of Things on a huge scale will exacerbate present network threats. Machine learning is becoming increasingly used in applications such as traffic classification and intrusion detection. This paper offers a technique for detecting network fault severity and identifying Internet of Things (IoT) devices based on several attributes. By pushing information to the network area, the proposed framework captures different features from each network flow in order to identify the source of traffic and the type of traffic generated is used to detect different network attacks. Different machine learning algorithms are tested to find the better suited algorithm that deliver best results. The following are some of the examples: Random Forest (RF) algorithm, decision tree, SVM, etc. After completing the experimentation, it was found that the random forest classifier and decision tree are the best performing ML algorithms to classify the network severity with an accuracy of about 96.98% and GNB is found as the least performing machine learning model with an accuracy of about 54.41%.

The rapid proliferation of Internet of Things (IoT) devices has ushered in a new era of connectivity and data exchange, revolutionizing various industries. However, the inherent vulnerabilities in traditional centralized transaction systems pose significant security challenges, particularly when dealing with sensitive data generated by IoT devices. This paper introduces an ICAA (Integrity Consensus Authorization Algorithm) for securing transaction records over the IoT network by leveraging Decentralized Distributed Ledger Technology (DDL), integrating the PICA (Proof-of-Integrity Consensus Algorithm) and CTAP (Context-Aware Transaction Authorization Protocol). The proposed system addresses the limitations of centralized architectures by employing a decentralized ledger, ensuring transparency, immutability, and tamper-resistant transaction records. The Proof-of-Integrity Consensus Algorithm enhances the security of the network by validating and confirming transactions based on the integrity of the data stored in the distributed ledger. This consensus mechanism minimizes the risk of fraudulent activities and unauthorized modifications, making it well-suited for the dynamic and distributed nature of IoT environments. Furthermore, the integration of the Context-Aware Transaction Authorization Protocol enhances the adaptability of the system to the diverse contexts in which IoT devices operate. The synergy between the Proof-of-Integrity Consensus Algorithm and the Context-Aware Transaction Authorization Protocol creates a comprehensive and secure framework for managing transaction records in IoT networks. . The proposed HGGC is 5.026% better than the ECMQV-MAC, 0.4215% better than QKD, and 0.0843% better than OTP in the nodes 200. The proposed model contributes to the establishment of a trustworthy and resilient infrastructure for the IoT, laying the foundation for secure and transparent transactions in the connected world.

The proliferation of Internet of Things (IoT) devices has brought unprecedented convenience to our lives, but it has also opened the door to new security challenges. One of the most pressing threats in the IoT landscape is the proliferation of BotNets, which can compromise and control a multitude of devices for malicious purposes. In this paper, we propose a novel approach to address this issue: a Federated Machine Learning Solution for BotNet detection in IoT environments. Our method leverages the collective intelligence of distributed IoT devices while respecting privacy constraints, ensuring that sensitive data never leaves the device. We present a detailed methodology for federated model construction, including data collection, local model training, and secure aggregation. The resulting federated model offers improved accuracy and robustness in BotNet detection, as demonstrated through rigorous evaluation on the N-BaIoT dataset. Our findings underscore the effectiveness of this approach in enhancing IoT device security by detecting and mitigating BotNet threats while safeguarding data privacy. This paper contributes to the advancement of IoT security strategies and provides a framework for protecting IoT devices against evolving threats in a federated and privacy-preserving manner.

The proliferation of Internet of Things (IoT) devices has introduced significant challenges in cybersecurity, particularly in the realm of intrusion detection. While effective, traditional centralized machine learning approaches often compromise data privacy and scalability due to the need for data aggregation. In this study, we propose a federated learning framework for near-real-time intrusion detection in IoT environments. Federated learning enables decentralized model training across multiple devices without exchanging raw data, thereby preserving privacy and reducing communication overhead. Our approach builds upon a previously proposed hybrid model, which combines a machine learning model deployed on IoT devices with a second-level cloud-based analysis. This previous work required all data to be passed to the cloud in aggregate form, limiting security. We extend this model to incorporate federated learning, allowing for distributed training while maintaining high accuracy and privacy. We evaluate the performance of our federated-learning-based model against a traditional centralized model, focusing on accuracy retention, training efficiency, and privacy preservation. Our experiments utilize actual attack data partitioned across multiple nodes. The results demonstrate that this hybrid federated learning not only offers significant advantages in terms of data privacy and scalability but also retains the previous competitive accuracy. This paper also explores the integration of federated learning with cloud-based infrastructure, leveraging platforms such as Databricks and Google Cloud Storage. We discuss the challenges and benefits of implementing federated learning in a distributed environment, including the use of Apache Spark and MLlib for scalable model training. The results show that all the algorithms used maintain an excellent identification accuracy (98% for logistic R=regression, 97% for SVM, and 100% for Random Forest). We also report a very short training time (less than 11 s on a single machine). The previous very low application time is also confirmed (0.16 s for over 1,697,851 packets). Our findings highlight the potential of federated learning as a viable solution for enhancing cybersecurity in IoT ecosystems, paving the way for further research in privacy-preserving machine learning techniques.

The Internet of Things (IoT) has transformed various sectors by enabling connectivity and automation through smart devices. However, the expansion of IoT networks has introduced new security challenges, particularly concerning the detection and prevention of cyber threats. This study explores the application of machine learning (ML) models for enhancing network security in IoT-enabled smart systems. The primary objective was to evaluate the performance of different ML algorithms, including Convolutional Neural Networks (CNN), Random Forest (RF), Support Vector Machine (SVM), Decision Tree (DT), K-Means, and Autoencoder, in detecting and mitigating security threats in IoT environments. The study also aimed to identify the most effective model in terms of accuracy, precision, recall, and F1-score. The research methodology involved training and testing these models on publicly available IoT security datasets, followed by performance evaluation based on the key metrics. Statistical analysis, including One-Way ANOVA and post-hoc testing, was used to assess the significance of the performance differences across the models. The results revealed that CNN outperformed all other models, achieving the highest accuracy (96.7%), precision (95.8%), recall (97.2%), and F1-score (96.5%). Random Forest also demonstrated strong performance with an accuracy of 95.6% and a balanced evaluation across all metrics. In contrast, traditional models like SVM and DT showed comparatively lower performance, while Autoencoder struggled with classification tasks, particularly in real-time threat detection. Statistical analysis confirmed the significant differences in model performance. In conclusion, the study demonstrates the effectiveness of deep learning and ensemble models, particularly CNN and Random Forest, in enhancing IoT network security. The research highlights the importance of selecting the appropriate ML model based on the specific requirements of the IoT environment and computational constraints, and suggests that hybrid models and model optimization strategies may offer promising solutions for resource-constrained IoT systems.

With the growth of wireless network technology-based devices, identifying the communication behaviour of wireless connectivity enabled devices, e.g. Internet of Things (IoT) devices, is one of the vital aspects, in managing and securing IoT networks. Initially, devices use frames to connect to the access point on the local area network and then, use packets of typical communication protocols through the access point to communicate over the Internet. Toward this goal, network packet and IEEE 802.11 media access control (MAC) frame analysis may assist in managing IoT networks efficiently, and allow investigation of inclusive behaviour of IoT devices. This paper presents network traffic traces data of D-Link IoT devices from packet and frame levels. Data collection experiment has been conducted in the Network Systems and Signal Processing (NSSP) laboratory at Universiti Brunei Darussalam (UBD). All the required devices, such as IoT devices, workstation, smartphone, laptop, USB Ethernet adapter, and USB WiFi adapter, have been configured accordingly, to capture and store network traffic traces of the 14 IoT devices in the laboratory. These IoT devices were from the same manufacture (D-Link) with different types, such as camera, home-hub, door-window sensor, and smart-plug.

A paradigm that combines cloud computing and the Internet of Things (IoT) allows for more impressive services to be provided to users while addressing storage and computational resource issues in the IoT environments. This cloud-based IoT environment has been used in various industries, including public services, for quite some time, and has been researched in academia. However, various security issues can arise during the communication between IoT devices and cloud servers, because communication between devices occurs in open channels. Moreover, issues such as theft of a user's IoT device or extraction of key parameters from the user's device in a remote location can arise. Researchers interested in these issues have proposed lightweight mutual authentication key agreement protocols that are safe and suitable for IoT environments. Recently, a lightweight authentication scheme between IoT devices and cloud servers has been presented. However, we found out their scheme had various security vulnerabilities, vulnerable to insider, impersonation, verification table leakage, and privileged insider attacks, and did not provide users with untraceability. To address these flaws, we propose a provably secure lightweight authentication scheme. The proposed scheme uses the user's biometric information and the cloud server's secret key to prevent the exposure of key parameters. Additionally, it ensures low computational costs for providing users with real-time and fast services using only exclusive OR operations and hash functions in the IoT environments. To analyze the safety of the proposed scheme, we use informal security analysis, Burrows-Abadi-Needham (BAN) logic and a Real-or-Random (RoR) model. The analysis results confirm that our scheme is secure against insider attacks, impersonation attacks, stolen verifier attacks, and so on; furthermore, it provides additional security elements. Simultaneously, it has been verified to possess enhanced communication costs, and total bit size has been shortened to 3776 bits, which is improved by almost 6% compared to Wu et al.'s scheme. Therefore, we demonstrate that the proposed scheme is suitable for cloud-based IoT environments.

The rapid growth of Internet of Things (IoT) devices, including smartwatches, home assistants, and connected appliances, has brought significant convenience to daily life, but it has also introduced serious security challenges. These devices often transmit sensitive data, making them vulnerable to theft, misuse, and unauthorized access. Current security measures are insufficient to address the complex and evolving nature of IoT systems, leaving many of them exposed to potential breaches and cyberattacks. This review explores recent developments in IoT security, focusing on how advanced technologies, such as machine learning, can be utilized to enhance the protection of IoT systems. The main objective of this paper is to examine potential solutions to the security problems that arise in IoT environments. It includes a thorough analysis of recent research and technological innovations in the field, with a particular emphasis on how different security methods are applied across IoT systems. By identifying the most common security vulnerabilities and outlining their impact on IoT networks, the review suggests improved methods to safeguard IoT data and ensure privacy. The findings aim to support researchers, developers, and businesses in designing more secure IoT solutions, and contribute to the establishment of stronger data protection policies. Ultimately, the review serves as a resource for those seeking to enhance the security of IoT devices and systems in an increasingly interconnected world.

Internet of Things (IoT) devices are increasingly deployed for different purposes such as data sensing, collecting and controlling. IoT improves user experiences by allowing a large number of smart devices to connect and share information. Many existing malware attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. Therefore, efficient protection at IoT devices could save millions of internet users from malicious activities. However, existing malware detection approaches suffer from high computational complexity. In this study, we propose a more accurate and fast model for detecting malware in the IoT environment. We introduce a Malware Threat Hunting System (MTHS) in the proposed model. MTHS first converts malware binary into a color image and then conducts the machine or deep learning analysis for efficient malware detection. We finally prepare a baseline to compare the performance of MTHS with traditional state-of-the-art malware detection approaches. We conduct experiments on two public datasets of Windows and Android software. The experimental results indicate that the response time and the detection accuracy of MTHS are better than those of previous machine learning and deep learning approaches.

The Internet of Things (IoT) has become a technological innovation that brings many benefits in various sectors, but also presents challenges, especially in terms of cybersecurity. One of the main threats is malware, which can damage devices, steal data, and disrupt system performance. With the increasing use of IoT, malware attacks on IoT devices are a serious concern. Previous research shows that malware detection models in IoT devices still have shortcomings, especially in terms of accuracy. One of the algorithms used in malware detection, Naïve Bayes, has been shown to provide low accuracy results. This study aims to improve the accuracy of malware detection on IoT networks by applying Ensemble learning techniques using traffic data from the IoT-23 dataset. The methodology used refers to the CRISP-DM (Cross Industry Standard Process for Data Mining) framework, which includes the stages of domain understanding, data understanding, data preparation, modelling, evaluation, and deployment. The results show that Ensemble learning improved the performance of individual models. Naïve Bayes as a single model produces an accuracy of 0.24, increasing to 0.35 when combined with AdaBoost, and 0.99 when combined with XGBoost. The combination of the three models also produced an accuracy of 0.99. These results demonstrate the effectiveness of ensemble learning in improving malware detection accuracy in IoT environments.

Cognitive radio (CR) is considered as a key enabling communication technology that offers efficient wireless connectivity to Internet of Things (IoT) devices. Its integration with the future 5G architecture is expected to advance the IoT paradigm. Security attacks can severely degrade the performance of such CR‐based IoT (CRIoT) networks. The effect of security attacks can be reduced by implementing defensive approaches. However, such solutions come at the expense of degrading spectrum efficiency and consuming more network resources. In this paper, we investigate the spectrum sharing and access problem in a multidevice single‐transceiver CRIoT network with time‐critical applications under jamming attacks. Our main goal is to maximize the number of simultaneously served IoT devices over all available idle channels while ensuring delay requirement, hardware, link quality, security attacks, and spectrum utilization constraints. This problem is formulated as a total unimodular binary linear programming, which is shown to be solvable in polynomial time. Unlike most of previous security‐aware channel assignment solutions that conduct the channel assignment sequentially, our solution simultaneously provides secured distributed channel‐assignment decisions for multiple CRIoT links (batching method). Batching can be realized through an admission control stage for CR IoT devices to announce their control packets. Simulation results reveal that our solution significantly improves network performance compared to previous security‐aware schemes.

The rapid proliferation of Internet of Things (IoT) devices, coupled with their inherent security vulnerabilities, has significantly expanded the attack surface, intensifying threats such as man-in-the-middle attacks, traffic hijacking, and distributed denial-of-service (DDoS) attacks, thereby posing serious risks to the security and reliability of the entire ecosystem. The network traffic associated with IoT devices is diverse and dynamic, often exhibiting complex structural features such as periodic fluctuations, varying packet sizes, and time-varying patterns that make detection challenging. Although deep learning has demonstrated strong capabilities in efficiently identifying complex and dynamic malicious traffic through powerful feature extraction and adaptive learning abilities, its high model complexity, substantial computational demands, and large parameter sizes hinder direct deployment on resource-constrained IoT devices. In order to tackle this issue, this paper proposes a malicious traffic detection framework for the Internet of Things (IoT) based on multi-teacher knowledge distillation. The proposed model, termed the Lightweight Multi-Teacher Spatiotemporal Distillation Neural Network (LMT-SDNN), employs two high-performance teacher models: Residual Inception and a One-Dimension Convolution Netural Network (1D-CNN) integrated with idirectional Long Short-Term Memory (BiLSTM), to effectively capture the complex structural features of network traffic. Furthermore, a novel Time-Related Window Loss (TRW) function is design to enhance the student’s ability to capture temporal features, thereby improving its overall performance. The effectiveness of LMT-SDNN is validated through comparisons with five baseline models on two publicly available datasets, ToN_IoT and BoT_IoT. Experimental results show that LMT-SDNN achieves a compression rate of over 99% in both model complexity and parameter count, while maintaining an accuracy exceeding 99%, indicating its strong potential for multiclass malicious traffic detection in IoT environments.

The Internet of Things (IoT) is a fast-expanding network of smart heterogeneous objects. It refers to the physical devices that are capable of communicating with other physical devices. Unlike the wireless sensor networks (WSNs), IoT is connected to worldwide Internet that exposes it to global intrusion in addition to wireless attacks inside an IoT network. It is protected by cryptographic and network security techniques, but they are vulnerable to internal and external attacks. The IoT devices are resource constrained in terms of limited storage, battery, limited transmission range and processing. To protect these tiny devices from the inside and outside cyberattacks, we need a lightweight security system that can run efficiently and effectively on these IoT devices. We also need a system, which can identify the type of intrusion and trigger an alarm in intrusion scenario to take appropriate preventive measure. Hence, an Intrusion Detection System (IDS) plays an important role to prevent such cyberattacks in IoT. These devices can be static or mobile in an IoT environment; this must be considered while designing IDS for IoT system. This book chapter presents various IDSs for an IoT system and their comparisons in terms of detection rate, false positive and accuracy in both static and mobility of devices.