Lightweight Classification of IoT Malware based on Image Recognition

• Main Authors: Su, Jiawei, Vargas, Danilo Vasconcellos, Prasad, Sanjiva, Sgandurra, Daniele, Feng, Yaokai, Sakurai, Kouichi
• Format: Journal Article
• Language: English
• Published: 11.02.2018
• Subjects: Computer Science - Computer Vision and Pattern Recognition; Computer Science - Cryptography and Security
• DOI: 10.48550/arxiv.1802.03714

The Internet of Things (IoT) is an extension of the traditional Internet, which allows a very large number of smart devices, such as home appliances, network cameras, sensors and controllers to connect to one another to share information and improve user experiences. Current IoT devices are typically micro-computers for domain-specific computations rather than traditional functionspecific embedded devices. Therefore, many existing attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. For example, DDoS attacks have become very common in IoT environments, as these environments currently lack basic security monitoring and protection mechanisms, as shown by the recent Mirai and Brickerbot IoT botnets. In this paper, we propose a novel light-weight approach for detecting DDos malware in IoT environments.We firstly extract one-channel gray-scale images converted from binaries, and then utilize a lightweight convolutional neural network for classifying IoT malware families. The experimental results show that the proposed system can achieve 94.0% accuracy for the classification of goodware and DDoS malware, and 81.8% accuracy for the classification of goodware and two main malware families.