Detecting crypto-ransomware in IoT networks based on energy consumption footprint

• Published in: Journal of ambient intelligence and humanized computing Vol. 9; no. 4; pp. 1141 - 1152
• Main Authors: Azmoodeh, Amin, Dehghantanha, Ali, Conti, Mauro, Choo, Kim-Kwang Raymond
• Format: Journal Article
• Language: English
• Published: Berlin/Heidelberg Springer Berlin Heidelberg 01.08.2018; Springer Nature B.V
• Subjects: Artificial Intelligence; Classification; Computational Intelligence; Devices; Energy consumption; Engineering; Internet of Things; Machine learning; Malware; Neural networks; Original Research; Power consumption; Ransomware; Robotics and Automation; Support vector machines; User Interfaces and Human Computer Interaction; Power consumption; Ransomware detection; Malware detection; Internet of Things security; Machine learning; Android
• ISSN: 1868-5137; 1868-5145
• DOI: 10.1007/s12652-017-0558-5

An Internet of Things (IoT) architecture generally consists of a wide range of Internet-connected devices or things such as Android devices, and devices that have more computational capabilities (e.g., storage capacities) are likely to be targeted by ransomware authors. In this paper, we present a machine learning based approach to detect ransomware attacks by monitoring power consumption of Android devices. Specifically, our proposed method monitors the energy consumption patterns of different processes to classify ransomware from non-malicious applications. We then demonstrate that our proposed approach outperforms K-Nearest Neighbors, Neural Networks, Support Vector Machine and Random Forest, in terms of accuracy rate, recall rate, precision rate and F-measure.