Malware Detection in Internet of Things (IoT) Devices Using Deep Learning
Abstract
:1. Introduction
- Many machine learning techniques, including KNN, SVM, LR and Fuzzy C-Mean have been evaluated for malware classification.
- Evolutionary computing techniques have less computational complexity and better global optimization. Hence, GA and PSO are used for better feature selection.
- Deep learning algorithms such as CNN and LSTM are also studied. Moreover, CNN and LSTM are combined for better accuracy.
- To test the efficiency of our proposed algorithm, the proposed algorithms are compared with other state-of-the-art algorithms.
2. Related Work
3. Proposed Method
3.1. Dataset
3.2. Feature Selection
3.3. Classification
- Import the Keras library;
- Initialize of neural network;
- Add the input layer with defined dimensions and dropout layer;
- Add hidden layers with the number of neurons and set the dropout layer value;
- Add the output layer with the total number of label classes as neurons.
3.4. Deep Neural Networks
3.5. Long Short-Term Memory (LSTM)
4. Results and Discussion
5. Conclusions and Future Work
Author Contributions
Funding
Acknowledgments
Conflicts of Interest
Appendix A
Fold | Logistic Regression | SVM | GA-KNN | PSO- KNN |
---|---|---|---|---|
1 | 99.4 | 99.4 | 99.6 | 92 |
2 | 99.4 | 99.4 | 99.8 | 99 |
3 | 97 | 97 | 99.4 | 98 |
4 | 99.8 | 99 | 98.7 | 99.8 |
5 | 99.8 | 99.8 | 95.4 | 99.8 |
6 | 99.8 | 99.4 | 96.5 | 99.4 |
7 | 99.8 | 99 | 98.9 | 99.4 |
8 | 99.8 | 99.4 | 98.1 | 99 |
9 | 99.8 | 99.4 | 99.3 | 99 |
10 | 99 | 99 | 99.2 | 99 |
Fold | Logistic Regression | SVM | GA-KNN | PSO-KNN |
---|---|---|---|---|
1 | 99.8 | 99.8 | 99.4 | 79 |
2 | 99.8 | 99.8 | 99 | 90 |
3 | 90 | 90 | 99.7 | 90 |
4 | 99.8 | 96 | 99.4 | 99.8 |
5 | 99.8 | 99.8 | 99 | 99.8 |
6 | 99.4 | 99.8 | 99.4 | 99.8 |
7 | 99.4 | 90 | 99.8 | 99.4 |
8 | 99.4 | 99.8 | 99.7 | 99 |
9 | 99.4 | 99.8 | 99.8 | 99 |
10 | 96 | 90 | 99.7 | 96 |
Fold | Logistic Regression | SVM | GA-KNN | PSO-KNN |
---|---|---|---|---|
1 | 99.8 | 99.8 | 98.6 | 95 |
2 | 99.8 | 99.8 | 98.7 | 99 |
3 | 98 | 98 | 99.1 | 99 |
4 | 99.8 | 99 | 99.4 | 99.4 |
5 | 99.8 | 99.8 | 99.2 | 99.4 |
6 | 99.8 | 99.8 | 99 | 99.4 |
7 | 99.4 | 99.2 | 99.7 | 99.4 |
8 | 99.4 | 99.4 | 99.1 | 99 |
9 | 99.4 | 99.4 | 99.8 | 95 |
10 | 99 | 99 | 99 | 99 |
Fold | Logistic Regression | SVM | GA-KNN | PSO-KNN |
---|---|---|---|---|
1 | 99.8 | 99.8 | 99.8 | 84 |
2 | 99.4 | 99.4 | 99.4 | 95 |
3 | 98 | 94 | 98.5 | 95 |
4 | 99.4 | 97 | 97.8 | 99.4 |
5 | 99.4 | 99.4 | 99.1 | 99.4 |
6 | 99.4 | 99.4 | 95.6 | 99.4 |
7 | 99.8 | 98 | 97.6 | 99.8 |
8 | 99.8 | 99.8 | 98.1 | 97 |
9 | 99.8 | 99.8 | 99 | 97 |
10 | 99 | 97 | 98.2 | 97 |
Folds | Accuracy | Precision | Recall | F1-Score | ||||
---|---|---|---|---|---|---|---|---|
Hybrid CNN | LSTM- CNN | Hybrid CNN | LSTM- CNN | Hybrid CNN | LSTM- CNN | Hybrid CNN | LSTM- CNN | |
1 | 99.99 | 99.99 | 99.99 | 99.99 | 99.4 | 99.99 | 99.99 | 99.99 |
2 | 99.99 | 99.99 | 99.4 | 99.99 | 99.99 | 99.99 | 99.4 | 99.99 |
3 | 99.4 | 99.8 | 99.99 | 99.99 | 99.6 | 99.99 | 99.4 | 99.4 |
4 | 99.99 | 99.99 | 99.6 | 99.8 | 99.99 | 99.99 | 99.99 | 99.8 |
5 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.8 | 99.6 | 99.99 |
6 | 99.8 | 98.36 | 99.99 | 98.16 | 99.4 | 99.99 | 99.99 | 99.99 |
7 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.8 |
8 | 99.17 | 99.6 | 99.08 | 99.99 | 99.6 | 99.99 | 99.4 | 99.99 |
9 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.6 | 99.99 | 99.6 |
10 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.99 | 99.4 | 99.99 |
Average | 99.83 | 99.79 | 99.80 | 99.78 | 99.79 | 99.93 | 99.71 | 99.85 |
Variance | 0.09 | 0.26 | 0.11 | 0.33 | 0.07 | 0.02 | 0.09 | 0.04 |
References
- Mendez, D.M.; Papapanagiotou, I.; Yang, B. Internet of things: Survey on security and privacy. arXiv 2017, arXiv:1707.01879. [Google Scholar]
- Tama, B.A.; Rhee, K.H. An integration of pso-based feature selection and random forest for anomaly detection in iot network. MATEC Web Conf. 2018, 159, 01053. [Google Scholar] [CrossRef]
- Naeem, H.; Ullah, F.; Naeem, M.R.; Khalid, S.; Vasan, D.; Jabbar, S.; Saeed, S. Malware detection in industrial internet of things based on hybrid image visualization and deep learning model. Ad Hoc Netw. 2020, 105, 102154. [Google Scholar] [CrossRef]
- Moti, Z.; Hashemi, S.; Karimipour, H.; Dehghantanha, A.; Jahromi, A.N.; Abdi, L.; Alavi, F. Generative adversarial network to detect unseen internet of things malware. Ad Hoc Netw. 2021, 122, 102591. [Google Scholar] [CrossRef]
- Humayun, M.; Jhanjhi, N.; Alsayat, A.; Ponnusamy, V. Internet of things and ransomware: Evolution, mitigation and prevention. Egypt. Inform. J. 2021, 22, 105–117. [Google Scholar] [CrossRef]
- Yan, Q.; Huang, W.; Luo, X.; Gong, Q.; Yu, F.R. A multi-level DDoS mitigation framework for the industrial Internet of Things. IEEE Commun. Mag. 2018, 56, 30–36. [Google Scholar] [CrossRef]
- Kumar, S. MCFT-CNN: Malware classification with fine-tune convolution neural networks using traditional and transfer learning in Internet of Things. Future Gener. Comput. Syst. 2021, 125, 334–351. [Google Scholar]
- Chaganti, R.; Ravi, V.; Pham, T.D. Deep Learning based Cross Architecture Internet of Things malware Detection and Classification. Comput. Secur. 2022, 120, 102779. [Google Scholar] [CrossRef]
- Madan, S.; Sofat, S.; Bansal, D. Tools and Techniques for Collection and Analysis of Internet-of-Things malware: A systematic state-of-art review. J. King Saud Univ.-Comput. Inf. Sci. 2022. [Google Scholar] [CrossRef]
- da Costa, K.A.; Papa, J.P.; Lisboa, C.O.; Munoz, R.; de Albuquerque, V.H.C. Internet of Things: A survey on machine learning-based intrusion detection approaches. Comput. Netw. 2019, 151, 147–157. [Google Scholar] [CrossRef]
- Xiao, L.; Wan, X.; Lu, X.; Zhang, Y.; Wu, D. IoT security techniques based on machine learning: How do IoT devices use AI to enhance security? IEEE Signal Process. Mag. 2018, 35, 41–49. [Google Scholar] [CrossRef]
- Diro, A.A.; Chilamkurti, N. Distributed attack detection scheme using deep learning approach for Internet of Things. Future Gener. Comput. Syst. 2018, 82, 761–768. [Google Scholar] [CrossRef]
- Usman, S.M.; Khalid, S.; Aslam, M.H. Epileptic seizures prediction using deep learning techniques. IEEE Access 2020, 8, 39998–40007. [Google Scholar] [CrossRef]
- Yeo, M.; Koo, Y.; Yoon, Y.; Hwang, T.; Ryu, J.; Song, J.; Park, C. Flow-based malware detection using convolutional neural network. In Proceedings of the 2018 International Conference on Information Networking (ICOIN), Chiang Mai, Thailand, 10–12 January 2018; pp. 910–913. [Google Scholar]
- Naveed, M.; Arif, F.; Usman, S.M.; Anwar, A.; Hadjouni, M.; Elmannai, H.; Hussain, S.; Ullah, S.S.; Umar, F. A Deep Learning-Based Framework for Feature Extraction and Classification of Intrusion Detection in Networks. Wirel. Commun. Mob. Comput. 2022, 2022, 2215852. [Google Scholar] [CrossRef]
- Althubiti, S.A.; Jones, E.M.; Roy, K. LSTM for anomaly-based network intrusion detection. In Proceedings of the 2018 28th International Telecommunication Networks and Applications Conference (ITNAC), Sydney, NSW, Australia, 21–23 November 2018; pp. 1–3. [Google Scholar]
- Dovom, E.M.; Azmoodeh, A.; Dehghantanha, A.; Newton, D.E.; Parizi, R.M.; Karimipour, H. Fuzzy pattern tree for edge malware detection and categorization in IoT. J. Syst. Archit. 2019, 97, 1–7. [Google Scholar] [CrossRef]
- Huda, S.; Yearwood, J.; Hassan, M.M.; Almogren, A. Securing the operations in SCADA-IoT platform based industrial control system using ensemble of deep belief networks. Appl. Soft Comput. 2018, 71, 66–77. [Google Scholar] [CrossRef]
- El Boujnouni, M.; Jedra, M. New Intrusion Detection System Based on Support Vector Domain Description with Information Gain Metric. Int. J. Netw. Secur. 2018, 20, 25–34. [Google Scholar]
- Kaur, G. A novel distributed machine learning framework for semi-supervised detection of botnet attacks. In Proceedings of the 2018 Eleventh International Conference on Contemporary Computing (IC3), Noida, India, 2–4 August 2018; pp. 1–7. [Google Scholar]
- Azmoodeh, A.; Dehghantanha, A.; Choo, K.K.R. Robust malware detection for internet of (battlefield) things devices using deep eigenspace learning. IEEE Trans. Sustain. Comput. 2018, 4, 88–95. [Google Scholar] [CrossRef]
- Pajouh, H.H.; Javidan, R.; Khayami, R.; Dehghantanha, A.; Choo, K.K.R. A two-layer dimension reduction and two-tier classification model for anomaly-based intrusion detection in IoT backbone networks. IEEE Trans. Emerg. Top. Comput. 2016, 7, 314–323. [Google Scholar] [CrossRef]
- Sharma, A.; Sahay, S.K. An effective approach for classification of advanced malware with high accuracy. arXiv 2016, arXiv:1606.06897. [Google Scholar] [CrossRef]
- Kaur, A.; Pal, S.K.; Singh, A.P. Hybridization of K-means and firefly algorithm for intrusion detection system. Int. J. Syst. Assur. Eng. Manag. 2018, 9, 901–910. [Google Scholar] [CrossRef]
- Prokofiev, A.O.; Smirnova, Y.S.; Surov, V.A. A method to detect Internet of Things botnets. In Proceedings of the 2018 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus), Moscow and St. Petersburg, Russia, 29 January–1 February 2018; pp. 105–108. [Google Scholar]
- Zhou, Y.; Han, M.; Liu, L.; He, J.S.; Wang, Y. Deep learning approach for cyberattack detection. In Proceedings of the IEEE INFOCOM 2018-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Honolulu, HI, USA, 15–19 April 2018; pp. 262–267. [Google Scholar]
- Zak, R.; Raff, E.; Nicholas, C. What can N-grams learn for malware detection? In Proceedings of the 2017 12th International Conference on Malicious and Unwanted Software (MALWARE), Fajardo, PR, USA, 11–14 October 2017; pp. 109–118. [Google Scholar]
- Hafeez, I.; Antikainen, M.; Ding, A.Y.; Tarkoma, S. IoT-KEEPER: Detecting malicious IoT network activity using online traffic analysis at the edge. IEEE Trans. Netw. Serv. Manag. 2020, 17, 45–59. [Google Scholar] [CrossRef] [Green Version]
- Vinayakumar, R.; Alazab, M.; Srinivasan, S.; Pham, Q.V.; Padannayil, S.K.; Simran, K. A visualized botnet detection system based deep learning for the Internet of Things networks of smart cities. IEEE Trans. Ind. Appl. 2020, 56, 4436–4456. [Google Scholar] [CrossRef]
- Yin, B.; Yin, H.; Wu, Y.; Jiang, Z. FDC: A secure federated deep learning mechanism for data collaborations in the Internet of Things. IEEE Internet Things J. 2020, 7, 6348–6359. [Google Scholar] [CrossRef]
- Nguyen, T.D.; Marchal, S.; Miettinen, M.; Fereidooni, H.; Asokan, N.; Sadeghi, A.R. DÏoT: A federated self-learning anomaly detection system for IoT. In Proceedings of the 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), Dallas, TX, USA, 7–10 July 2019; pp. 756–767. [Google Scholar]
- HaddadPajouh, H.; Dehghantanha, A.; Khayami, R.; Choo, K.K.R. A deep recurrent neural network based approach for internet of things malware threat hunting. Future Gener. Comput. Syst. 2018, 85, 88–96. [Google Scholar] [CrossRef]
- Yin, C.; Zhu, Y.; Fei, J.; He, X. A deep learning approach for intrusion detection using recurrent neural networks. IEEE Access 2017, 5, 21954–21961. [Google Scholar] [CrossRef]
- Pektaş, A.; Acarman, T. Botnet detection based on network flow summary and deep learning. Int. J. Netw. Manag. 2018, 28, e2039. [Google Scholar] [CrossRef]
- Kudugunta, S.; Ferrara, E. Deep neural networks for bot detection. Inf. Sci. 2018, 467, 312–322. [Google Scholar] [CrossRef] [Green Version]
- McDermott, C.D.; Majdani, F.; Petrovski, A.V. Botnet detection in the internet of things using deep learning approaches. In Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN), Rio de Janeiro, Brazil, 8–13 July 2018; pp. 1–8. [Google Scholar]
- Xiao, L.; Li, Y.; Huang, X.; Du, X. Cloud-based malware detection game for mobile devices with offloading. IEEE Trans. Mob. Comput. 2017, 16, 2742–2750. [Google Scholar] [CrossRef]
- Zhao, G.; Zhang, C.; Zheng, L. Intrusion detection using deep belief network and probabilistic neural network. In Proceedings of the 2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC), Guangzhou, China, 21–24 July 2017; Volume 1, pp. 639–642. [Google Scholar]
- Azmoodeh, A.; Dehghantanha, A.; Conti, M.; Choo, K.K.R. Detecting crypto-ransomware in IoT networks based on energy consumption footprint. J. Ambient. Intell. Humaniz. Comput. 2018, 9, 1141–1152. [Google Scholar] [CrossRef]
- Guo, C.; Ping, Y.; Liu, N.; Luo, S.S. A two-level hybrid approach for intrusion detection. Neurocomputing 2016, 214, 391–400. [Google Scholar] [CrossRef]
- Guarino, A.; Lettieri, N.; Malandrino, D.; Zaccagnino, R.; Capo, C. Adam or Eve? Automatic users’ gender classification via gestures analysis on touch devices. Neural Comput. Appl. 2022, 34, 18473–18495. [Google Scholar] [CrossRef]
- Seeland, M.; Mäder, P. Multi-view classification with convolutional neural networks. PLoS ONE 2021, 16, e0245230. [Google Scholar] [CrossRef] [PubMed]
- Guarino, A.; Malandrino, D.; Zaccagnino, R. An automatic mechanism to provide privacy awareness and control over unwittingly dissemination of online private information. Comput. Netw. 2022, 202, 108614. [Google Scholar] [CrossRef]
- Ganesan, S.; Ravi, V.; Krichen, M.; Sowmya, V.; Alroobaea, R.; Soman, K. Robust malware detection using residual attention network. In Proceedings of the 2021 IEEE International Conference on Consumer Electronics (ICCE), Las Vegas, NV, USA, 10–12 January 2021; pp. 1–6. [Google Scholar]
- Ben Fredj, O.; Mihoub, A.; Krichen, M.; Cheikhrouhou, O.; Derhab, A. CyberSecurity attack prediction: A deep learning approach. In Proceedings of the 13th International Conference on Security of Information and Networks, Merkez, Turkey, 4–7 November 2020; pp. 1–6. [Google Scholar]
- Mihoub, A.; Fredj, O.B.; Cheikhrouhou, O.; Derhab, A.; Krichen, M. Denial of service attack detection and mitigation for internet of things using looking-back-enabled machine learning techniques. Comput. Electr. Eng. 2022, 98, 107716. [Google Scholar] [CrossRef]
- Aazam, M.; St-Hilaire, M.; Lung, C.H.; Lambadaris, I.; Huh, E.N. IoT resource estimation challenges and modeling in fog. In Fog Computing in the Internet of Things; Springer: Cham, Switzerland, 2018; pp. 17–31. [Google Scholar]
- Malhotra, P.; Vig, L.; Shroff, G.; Agarwal, P. Long short term memory networks for anomaly detection in time series. Proceedings 2015, 89, 89–94. [Google Scholar]
Method | Dataset | Algorithm | Results | Limitations |
---|---|---|---|---|
[17] | MQTT Dataset | Deep learning and machine learning-based Multiclass classification model that is used to feed into intrusion detection system using RF, Boosting Gradient, SVM, and LSTM | Accuracy: 99.37 Precision: 96 Recall: 95.67 F1-score: 95.67 | The testing time is not mentioned. Confusion matrix and ROC-Curves are missing |
[18] | Kaggle and Vx Heaven datasets. | Machine learning-based Edge malware detection is considered an investigation into its potentiality for the proposed solution Fuzzy and Fast Fuzzy pattern tree | Accuracy: 98.01 Precision: 99 Recall: 99.10 F1-score: 99.10 | The value of FPR, FDR, FNR, FOR, and time complexity is not mentioned |
[19] | SCADA network traffic | Machine and deep learning-based secure architecture ICS network that is used as a detection model based on two ensemble model deep belief network (DBN) and SVM | Accuracy: 94.65 | Need to consider feature selection techniques to help to gain detection accuracy. Lack in calculating various parameters such as precision, recall FDR, F-1 score |
[20] | NSL, KDD | Machine learning-based intrusion detection system (IDS) based on SSPV SVDD as classifier and SMO | Accuracy: 99 Precision: 93 Recall: 92.62 F1-score: 92.68 | Paper lack in the experimental part. The paper only considered the detection accuracy. |
[21] | NSL, KDD | Machine learning-based novel metaheuristic approach to build an intrusion detection system | Accuracy:72 Precision:69 Recall:68 F1-score:68 | The detection accuracy is too low. Need to use some feature selection technique |
[22] | Self Generated | Machine learning-based method to detect the ransomware using power consumption with KNN, MLP, DT | Accuracy: 95.65 Precision: 89.19 Recall: 85 F1-score: 85 | The dataset is not well enough to detect an attack. Need to a utilized deep learning algorithm. |
[23] | NSL, KDD | Machine learning-based novel model for intrusion detection based Two-layer Dimension Reduction and Two-tier Classification (TDTC) classification module using KNN | Accuracy: 84.86 Precision: 80.37 Recall: 79 F1-score: 79 | The detection accuracy is very low overall. Need to use a deep learning technique. |
[24] | Malicia | Machine learning-based malware detection system | Accuracy: 97.95 | Detect the advanced malware by analyzing the features by grouping them. |
[25] | ISCX | Machine learning-based K-mean Clustering Decision Tree | Accuracy: 88 Precision: 85 Recall: 83 F1-score: 83 | Classify the traffic by using a distributed framework. |
[26] | Self Generated | Machine learning-based Logistic Regression | Accuracy: 97.3 Precision: 95.49 Recall: 93.10 F1-score: 93.10 | Detect the botnet on IoT’s initiate with brute force attack using SSH protocol. |
[27] | NSL, KDD | Machine learning based on a framework DFEL, to detect the intrusion in the IoT environment. | Accuracy: 98.86 Precision: 96 Recall: 95.32 F1-score: 93 | The detection accuracy is low. Need to consider feature selection. Techniques help to gain detection accuracy. Confusion matrix and ROC-Curve are missing |
Method | Dataset | Algorithm | Results | Limitations |
---|---|---|---|---|
[28] | Kitsune | Proposed an anomaly detection system based on recurrent neural network model | Accuracy: 98% | Testing time is not calculated. |
[29] | DS1-D1, DS1-P | Presented an IoT attack detection scheme | Accuracy: 98.8% | Old dataset used. |
[30] | Self-generated | DL-based federated technique is presented for multiparty computation with the security of IoT devices | Accuracy: 56% | Algorithm is unable to achieve promising detection accuracy. |
[31] | Self-generated | Proposed Self-Learning system D’IOT, an autonomous self-learning system to detect compromised IoT devices | Accuracy: 95.6% Precision: 92.10% Recall: 89% F1-score: 89 | The detection accuracy is low. Need to consider feature selection techniques to help to gain detection accuracy. |
[32] | ARM-based IoT application execution Opcodes | Proposed Deep learning-based Long-short-Term-Memory (LSTM) algorithm to hunt IoT malware based on Opcodes | Accuracy: 98% | A very small dataset has been used. |
[12] | NSL-KDD | Deep learning-based cybersecurity that enables the attack detection in IoT using deep model (DM) and shallow model (SM) | Accuracy: 99.20% Precision: 95.22% Recall: 93% F1-score: 93% | The used dataset belongs to the traditional network landscape and has no IoT traffic and attacks |
[33] | NSL-KDD | Deep learning-based intrusion detection using recurrent neural networks (RNN-IDS). | Accuracy: 97.09% Precision: 83.28% Recall: 81% F1-score: 81% | Testing time required for detection is high. |
[34] | CTU-13 | Deep learning-based method to detect the botnet by extracting the statistical-based network flow features between hosts such as packet size, duration, and the standard deviation of the packet using DNN | Accuracy: 99% | Testing time is not calculated. |
[35] | Obtain dataset from Cresci and collaborators | Deep learning-based model to exploit the content and metadata for detecting the bots using LSTMs | Accuracy:90% | The detection accuracy is low. Need to consider feature selection techniques for better accuracy. Testing time is not calculated. The confusion matrix and ROC-Curves and values of FPR, FDR, FOR, FNR are missing |
[36] | Mirai botnet data and Self generated data | Proposed Deep learning-based Novel approach of packet-level detection in IoTs and network by implementing Bidirectional LSTMs | Accuracy: 99 Precision: 98% Recall: 95.45% F1-score: 95.45% | Testing time is not calculated. The confusion matrix and ROC-Curve analysis is missing |
[37] | Real time environment | Malware detection scheme for mobile devices with Q learning for optimal offloading | Accuracy: 67% | Accuracy is too low. |
[38] | DARPA KDDCUP99 | Deep learning-based intrusion detection method by utilizing deep belief network and PNN. | Accuracy: 99.14% | The value of FPR, FNR, FDR and FOR are missing |
Sr. No. | Feature Name | Type | Sr. No. | Feature Name | Type |
---|---|---|---|---|---|
1 | call | Instructions | 12 | str.FlushProcessWriteBuffers | Strings |
2 | push | Instructions | 13 | str.ComparreStringEx | Strings |
3 | pop | Instructions | 14 | str.EnumSystemLocalesEx | Strings |
4 | leave | Instructions | 15 | str.IsValidLocaleName | Strings |
5 | shl | Instructions | 16 | str.Kernel32.dll | Strings |
6 | cmp | Instructions | 17 | sym.imp.KERNEL32.dll HeapAlloc | Imports |
7 | eax | Instructions | 18 | sym.imp.str_str | Imports |
8 | jbe | Instructions | 19 | sym.imp.strlen | Imports |
9 | str.GetThreadLocale | Strings | 20 | sym.imp.memcpy | Imports |
10 | str.RuntimeErrorProgram | Strings | 21 | sym.imp.free | Imports |
11 | str.FlsSetValue | Strings | 22 | sym.imp._fprintf_chk | Imports |
23 | sym.imp.KERNEL32.dll_GMH | Imports |
Algorithm | Selected Features Count | Feature Index |
---|---|---|
PSO + CfsSubsetEval | 64 | 2, 14, 15, 18, 19, 20, 28, 39, 41, 44, 45, 47, 63, 72, 90, 92, 94, 102, 116, 117, 128, 130, 140, 146, 150, 152, 156, 160, 161, 165, 169, 175, 180, 182, 206, 207, 209, 210, 211, 212, 213, 215, 218, 219, 225, 226, 232, 233, 236, 237, 240, 244, 249, 253, 255, 256, 258, 262, 265, 269, 270, 275, 277, 283 |
PSO + Classifiersubseteval | 9 | 9, 55, 61, 88, 169, 198, 222, 230, 244 |
PSO + WrapperSubsetEval | 10 | 9, 34, 44, 49, 54, 113, 146, 234, 237, 238 |
PCA + Ranker | 29 | 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29 |
Result of k-Fold | Logistic Regression | SVM | GA-KNN | PSO- KNN |
---|---|---|---|---|
Average | 99.36 | 99.08 | 98.49 | 98.44 |
Variance | 0.6864 | 0.5376 | 1.8809 | 4.8464 |
Result of k-Fold | Logistic Regression | SVM | GA-KNN | PSO-KNN |
---|---|---|---|---|
Average | 98.28 | 96.48 | 99.49 | 95.18 |
Variance | 9.77 | 21.37 | 0.092 | 47.46 |
Result of k-Fold | Logistic Regression | SVM | GA-KNN | PSO-KNN |
---|---|---|---|---|
Average | 99.42 | 99.32 | 99.16 | 98.36 |
Variance | 0.324 | 0.32 | 0.14 | 3.17 |
Result of k-Fold | Logistic Regression | SVM | GA-KNN | PSO-KNN |
---|---|---|---|---|
Average | 99.38 | 98.36 | 98.31 | 96.3 |
Variance | 0.31 | 3.59 | 1.41 | 21.91 |
Hybrid CNN-CNN | Hybrid CNN-LSTM | Hybrid LSTM-LSTM | [15] LSTM | [20] LSTM-RNN | |
---|---|---|---|---|---|
Accuracy | 99.1% | 99.8% | 99.5% | 98.18% | 98.33 |
Result of k-Fold | Accuracy | Precision | Recall | F1-Score | ||||
---|---|---|---|---|---|---|---|---|
Hybrid CNN | LSTM- CNN | Hybrid CNN | LSTM- CNN | Hybrid CNN | LSTM- CNN | Hybrid CNN | LSTM- CNN | |
Average | 99.83 | 99.79 | 99.80 | 99.78 | 99.79 | 99.93 | 99.71 | 99.85 |
Variance | 0.09 | 0.26 | 0.11 | 0.33 | 0.07 | 0.02 | 0.09 | 0.04 |
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |
© 2022 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Riaz, S.; Latif, S.; Usman, S.M.; Ullah, S.S.; Algarni, A.D.; Yasin, A.; Anwar, A.; Elmannai, H.; Hussain, S. Malware Detection in Internet of Things (IoT) Devices Using Deep Learning. Sensors 2022, 22, 9305. https://doi.org/10.3390/s22239305
Riaz S, Latif S, Usman SM, Ullah SS, Algarni AD, Yasin A, Anwar A, Elmannai H, Hussain S. Malware Detection in Internet of Things (IoT) Devices Using Deep Learning. Sensors. 2022; 22(23):9305. https://doi.org/10.3390/s22239305
Chicago/Turabian StyleRiaz, Sharjeel, Shahzad Latif, Syed Muhammad Usman, Syed Sajid Ullah, Abeer D. Algarni, Amanullah Yasin, Aamir Anwar, Hela Elmannai, and Saddam Hussain. 2022. "Malware Detection in Internet of Things (IoT) Devices Using Deep Learning" Sensors 22, no. 23: 9305. https://doi.org/10.3390/s22239305