Malware Detection Using System Logs

The proliferation of Internet of Things (IoT) devices in personal and household environments has led to a significant increase in security vulnerabilities. These devices, due to their limited computational resources, often struggle to support conventional security solutions, making them prime targets for cyberattacks. This paper explores the potential of lightweight machine learning (ML) models to enhance the security of personal IoT devices. By leveraging the power of AI, lightweight models can offer real-time threat detection and anomaly identification without compromising the device's performance or requiring extensive computational resources. The paper investigates various ML techniques that are well-suited for IoT environments, such as decision trees, k-nearest neighbours (KNN), and support vector machines (SVM), focusing on their ability to detect intrusions, unauthorized access, and other malicious activities while maintaining efficiency. Additionally, the study highlights the trade-offs between model complexity, accuracy, and resource consumption, offering practical insights for deploying ML solutions in resource-constrained IoT systems. Key challenges, including data privacy, model generalization, and the adaptability of models to diverse IoT ecosystems, are addressed. Finally, the paper discusses future directions for the integration of more advanced lightweight models, such as federated learning and edge computing, which could further enhance security capabilities while ensuring minimal impact on IoT device performance. Through this review, the paper advocates for the adoption of lightweight ML models as a feasible and scalable solution to securing personal IoT devices in an increasingly connected world.

With the proliferation of Internet of Things (IoT) devices, cybersecurity has become an increasingly pressing concern. Due to their inherent vulnerabilities and the severity of the threats posed by malware, robust malware detection strategies for IoT devices are in high demand. However, the constraints imposed by the limited memory and processing power of IoT devices, alongside with the varied nature of these devices, have limited the development of effective malware detection strategies. Existing solutions primarily use either local computation or cloud-based services, each with its own set of challenges. In this paper, we propose a hybrid malware detection method that leverages both local and cloud-based computation to address these challenges. This method, based on similarity computations, optimizes the trade-off between computational resources and latency, offering an effective approach for malware detection in IoT devices. Through experimental evaluation using a substantial IoT malware dataset, we demonstrate that our proposed approach achieves an optimal balance between local and cloud-based computations, providing a promising solution for malware detection in IoT context.

Recent advances in Internet of Things (IoT) technologies require a new type of IoT security environment. Various heterogeneous smart devices have easy access to IoT environment, and as the number of users increases, they are exposed to various threats such as malicious attacks on IoT devices and IoT infrastructure, and data tampering by malicious code. Malware detection in IoT requires data and models for continuous and changing learning of smart devices. Methods/Statistical analysis: To minimize these security threats, various malware detection techniques in the field of IoT security have been studied. Malware detection in IoT environment is important for data derivation and learning model required for continuous and changing learning of smart devices. The metadata of malware detection can be normalized by the value of device id, time, behavior, location and state. This paper proposes behavior-based malware detection using deep learning (BMD-DL). Findings: BMD-DL was able to collect metadata about behavior-based malicious behavior and learn and detect malicious codes through deep learning. In addition, through the learned model, IoT Security is provided by disconnecting malicious devices that cause malicious behavior in the IoT environment. Improvements/Applications: BMD-DL collects behavioral data generated from multiple devices in the IoT and applies the results learned through deep learning to detect persistent malware.

<abstract> <p>With the widespread use of Internet, Internet of Things (IoT) devices have exponentially increased. These devices become vulnerable to malware attacks with the enormous amount of data on IoT devices; as a result, malware detection becomes a major problem in IoT devices. A reliable and effective mechanism is essential for malware detection. In recent years, research workers have developed various techniques for the complex detection of malware, but accurate detection continues to be a problem. Ransomware attacks pose major security risks to corporate and personal information and data. The owners of computer-based resources can be influenced by monetary losses, reputational damage, and privacy and verification violations due to successful assaults of ransomware. Therefore, there is a need to swiftly and accurately detect the ransomware. With this motivation, the study designs an Ebola optimization search algorithm for enhanced deep learning-based ransomware detection (EBSAEDL-RD) technique in IoT security. The purpose of the EBSAEDL-RD method is to recognize and classify the ransomware to achieve security in the IoT platform. To accomplish this, the EBSAEDL-RD technique employs min-max normalization to scale the input data into a useful format. Also, the EBSAEDL-RD technique makes use of the EBSA technique to select an optimum set of features. Meanwhile, the classification of ransomware takes place using the bidirectional gated recurrent unit (BiGRU) model. Then, the sparrow search algorithm (SSA) can be applied for optimum hyperparameter selection of the BiGRU model. The wide-ranging experiments of the EBSAEDL-RD approach are performed on benchmark data. The obtained results highlighted that the EBSAEDL-RD algorithm reaches better performance over other models on IoT security.</p> </abstract>

Internet of Things (IoT) devices are increasingly deployed for different purposes such as data sensing, collecting and controlling. IoT improves user experiences by allowing a large number of smart devices to connect and share information. Many existing malware attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. Therefore, efficient protection at IoT devices could save millions of internet users from malicious activities. However, existing malware detection approaches suffer from high computational complexity. In this study, we propose a more accurate and fast model for detecting malware in the IoT environment. We introduce a Malware Threat Hunting System (MTHS) in the proposed model. MTHS first converts malware binary into a color image and then conducts the machine or deep learning analysis for efficient malware detection. We finally prepare a baseline to compare the performance of MTHS with traditional state-of-the-art malware detection approaches. We conduct experiments on two public datasets of Windows and Android software. The experimental results indicate that the response time and the detection accuracy of MTHS are better than those of previous machine learning and deep learning approaches.

This study focuses on using various machine learning (ML) models to evaluate the shear behaviors of ultra-high-performance concrete (UHPC) beams reinforced with glass fiber-reinforced polymer (GFRP) bars. The main objective of the study is to predict the shear strength of UHPC beams reinforced with GFRP bars using ML models. We use four different ML models: support vector machine (SVM), artificial neural network (ANN), random forest (R.F.), and extreme gradient boosting (XGBoost). The experimental database used in the study is acquired from various literature sources and comprises 54 test observations with 11 input features. These input features are likely parameters related to the composition, geometry, and properties of the UHPC beams and GFRP bars. To ensure the ML models' generalizability and scalability, random search methods are utilized to tune the hyperparameters of the algorithms. This tuning process helps improve the performance of the models when predicting the shear strength. The study uses the ACI318M-14 and Eurocode 2 standard building codes to predict the shear capacity behavior of GFRP bars-reinforced UHPC I-shaped beams. The ML models' predictions are compared to the results obtained from these building code standards. According to the findings, the XGBoost model demonstrates the highest predictive test performance among the investigated ML models. The study employs the SHAP (SHapley Additive exPlanations) analysis to assess the significance of each input parameter in the ML models' predictive capabilities. A Taylor diagram is used to statistically compare the accuracy of the ML models. This study concludes that ML models, particularly XGBoost, can effectively predict the shear capacity behavior of GFRP bars-reinforced UHPC I-shaped beams.

The Internet of Things (IoT) devices is able to communicate with another IoT devices in heterogeneous environments. They are also able to create a network by their own using wireless capabilities without a centralized approach. This network is called wireless mobile ad hoc network (MANET). The MANET facilitate IoT devices to communicate with each other in an infrastructure less network of the Internet of Things environment. The IoT devices can dynamically join, create connection and exchange information among them. The role of cloud in this framework is to store and process the data by IoT devices. The communication Security has been raised as one of the most critical issues of cloud computing where resolving such an issue would result in a constant growth in the use and popularity of cloud. Our purpose of this study is to create a framework for providing the communication in an integrated framework of Cloud and MANET among IoT devices. Our main contribution links a new study that integrates cloud computing to the MANET and provides communication to the internet of things. This study can be used in the framework of the Internet of Things in future.

The Internet of Things (IoT) has had a considerable influence on our daily lives by enabling enhanced connection of devices, systems, and services that extends beyond machine-to-machine interactions and encompasses a wide range of protocols, domains, and applications. However, despite privacy concerns shown by IoT users, little has been done to reduce and protect individual information exposure. It is extremely difficult to mitigate IoT devices from reidentification threats which is why it is still a major challenge for IoT users to securely protect their information. The trust controls how we regulate privacy in our IoT platforms in the same way that it governs personal relationships. As IoT devices become increasingly linked, more data is shared across individuals, businesses, governments, and ecosystems. Technologies, sensors, machines, data, and cloud connections all rely largely on trust relationships that have been formed. With the rapid growth of additional types of IoT devices that are being introduced, it, therefore, expands privacy concerns and is difficult to develop trust with an IoT system or device without the option to regulate information privacy settings. Privacy has always been a barrier for many devices as they race for the early adoption of IoT technologies. Several Internet of Things devices or systems will continue to pose privacy threats. As a result, the main objective of this study was to examine the individual understanding of privacy and to promote information privacy protection awareness not only to IoT users but also to organizations that use IoT devices or platforms to run their day-to-day business operations. Furthermore, the objective extends to compare user knowledge and concerns about IoT privacy, as well as to identify any common attitudes and variances. However, in terms of enhancing individuals’ knowledge, an artifact was developed to educate and enhance information privacy awareness among IoT users. A pre- and postquestionnaire was generated to test and validate user knowledge regarding information privacy protection in IoT. The study was conducted using a quantitative research method. Findings indicate that IoT users’ awareness of information privacy protection turned out to be average, suggesting a need for education and awareness. Several participants stated that information privacy protection awareness is required within the community to educate, raise awareness, eliminate human error, and enable individuals to be conscious of their privacy when surfing the Internet.

Road crash prediction has proven to be an effective means of improving highway safety. In recent years, machine learning (ML) models have been embraced as efficient for the prediction of road accident frequency. This study applied two machine learning models for the prediction of road accident occurrence on selected South-West highway in Nigeria. Accident data were obtained for the period of 10 years from 2013 to 2022 from the Federal Road Safety Commission (FRSC) of Nigeria on the road under study and the traffic operations were determined on site using manual counting and stopwatch approach. Machine Learning (ML) models including Support Vector Machine (SVM) and Extreme Gradient Boosting (XGBoost) were also used as the statistical model for safety prediction of the highway with consideration to identified contributing factors. The performance of the models was compared for both training and testing dataset using coefficient of determination (R2), Mean Absolute Error (MAE) and Root Mean Square Error (RMSE). The study showed consistency and effective performance in both ML models with R2 of 0.99 in SVM, 0.97 and XGBoost for training data, also 0.93 in SVM and 0.76 in XGBoost testing data. ML models are also easy and fast to implement. The result of this study supports the use of ML as a predictive tool for road safety evaluation. The knowledge attained from this study will benefit transportation planners, engineers, and policymakers to implement effective measures aimed at reducing the crash occurrence, thereby enhancing overall transportation safety and efficiency.

The Internet of Things (IoT) has become a technological innovation that brings many benefits in various sectors, but also presents challenges, especially in terms of cybersecurity. One of the main threats is malware, which can damage devices, steal data, and disrupt system performance. With the increasing use of IoT, malware attacks on IoT devices are a serious concern. Previous research shows that malware detection models in IoT devices still have shortcomings, especially in terms of accuracy. One of the algorithms used in malware detection, Naïve Bayes, has been shown to provide low accuracy results. This study aims to improve the accuracy of malware detection on IoT networks by applying Ensemble learning techniques using traffic data from the IoT-23 dataset. The methodology used refers to the CRISP-DM (Cross Industry Standard Process for Data Mining) framework, which includes the stages of domain understanding, data understanding, data preparation, modelling, evaluation, and deployment. The results show that Ensemble learning improved the performance of individual models. Naïve Bayes as a single model produces an accuracy of 0.24, increasing to 0.35 when combined with AdaBoost, and 0.99 when combined with XGBoost. The combination of the three models also produced an accuracy of 0.99. These results demonstrate the effectiveness of ensemble learning in improving malware detection accuracy in IoT environments.

Seeing is not always believing: Insights on IoT manufacturing from firmware composition analysis and vendor survey

With the advancement in science and technology, the demand for electronic Internet of Things (IoT) devices has increased to store and process digital data. With the advancement in IoT technology, we are more reliant on IoT devices to perform our regular tasks. IoT Forensics deals with the investigation of IoT devices such as smartphones, tablets, smart watches, or any device which is connected to the Internet. The data on these devices can still be retrieved via IoT forensics even if they are destroyed, resold, or misplaced. Before discarding any IoT device, we must consider how to secure the data stored on them. We are then going to discuss the several types of personal data that could be retrieved from discarded IoT devices. Finally, we are going to discuss the protection measures for the safe disposal of IoT devices.

ABSTRACTIn recent years, the emerging development of Internet of things (IoT) has created new opportunities for IoT service provider, device manufacturer and customer (end user). In agriculture, employing IoT can help reducing manpower as well as standardizing agricultural processes, thus increasing the benefit for customer who does agricultural business. Beside the opportunities, there are also issues while doing maintenance for an agricultural IoT system. One of them is how to automate the process to detect faults of IoT devices in a large deployment area. While previous studies focus on investigating algorithms as well as theoretical model to detect faults for specific IoT devices, automatically expanding of IoT management process for detecting faults of sensor/actuator has not been investigated yet. To achieve this, we should be able to deal with the relationship between IoT device manufacturer, service provider and customer. In this study, we conceptualize the knowledge of IoT devices, management process and fault detection requirement. To realize this model, we introduce a runtime system to expand the IoT management process for detecting sensor/actuator faults which is able to provide the above features. We do several experiments to show the effectiveness and usefulness of the proposed solution.

With the advancement of 5G mobile telecommunication, various IoT (Internet of Things) devices communicate massive amounts of data by being connected to wireless networks. Since this wireless communication is vulnerable to hackers via data leakage during communication, the transmitted data should be encrypted through block ciphers to protect the data during communication. In addition, in order to encrypt the massive amounts of data securely, it is essential to apply one of secure mode of operation. Among them, CTR (CounTeR) mode is the most widely used in industrial applications. However, these IoT devices have limited resources of computing and memory compared to typical computers, so that it is challenging to process cryptographic algorithms that have computation-intensive tasks in IoT devices at high speed. Thus, it is required that cryptographic algorithms are optimized in IoT devices. In other words, optimizing cryptographic operations on these IoT devices is not only basic but also an essential effort in order to build secure IoT-based service systems. For efficient encryption on IoT devices, even though several ARX (Add-Rotate-XOR)-based ciphers have been proposed, it still necessary to improve the performance of encryption for smooth and secure IoT services. In this article, we propose the first parallel implementations of CTR mode of ARX-based ciphers: LEA (Lightweight Encryption Algorithm), HIGHT (high security and light weight), and revised CHAM on the ARMv8 platform, a popular microcontroller in various IoT applications. For the parallel implementation, we propose an efficient data parallelism technique and register scheduling, which maximizes the usage of vector registers. Through proposed techniques, we process the maximum amount of encryption simultaneously by utilizing all vector registers. Namely, in the case of HIGHT and revised CHAM-64/128 (resp. LEA, revised CHAM-128/128, and CHAM-128/256), we can execute 48 (resp. 24) encryptions simultaneously. In addition, we optimize the process of CTR mode by pre-computing and using the intermediate value of some initial rounds by utilizing the property that the nonce part of CTR mode input is fixed during encryptions. Through the pre-computation table, CTR mode is optimized up until round 4 in LEA, round 5 in HIGHT, and round 7 in revised CHAM. With the proposed parallel processing technique, our software provides 3.09%, 5.26%, and 9.52% of improved performance in LEA, HIGHT, and revised CHAM-64/128, respectively, compared to the existing parallel works in ARM-based MCU. Furthermore, with the proposed CTR mode optimization technique, our software provides the most improved performance with 8.76%, 8.62%, and 15.87% in LEA-CTR, HIGHT-CTR, and revised CHAM-CTR, respectively. This work is the fastest implementation of CTR mode on ARMv8 architecture to the best of our knowledge.

The number of Internet of Things (IoT) devices has increased recently and will increase further in the future. IoT devices are vulnerable, so vendors update and distribute firmware. At the time of firmware distribution, a huge number of IoT devices may connect to the firmware server and excessive network traffic may occur. Consequently, a method using a peer-to-peer file sharing system and a blockchain has been proposed. One study proposed an update scheme considering incentives for distributors to help with updating. However, this method requires the IoT devices, which have limited processing power, to decrypt encrypted files, and the distribution nodes to pay the transaction cost. This paper proposes a firmware distribution method that provides incentives for distributors to help with distribution to reduce the gas costs, using a smart contract and access control based on update records. The additional computations performed by IoT devices and distributors key management were reduced compared to those in previous studies by using access control instead of encryption. Further, the proposed approach was implemented and evaluated using a Raspberry Pi and laptop. The evaluation demonstrated that the gas cost per update was successfully lowered compared to the costs in previous studies.