Abstract

     Physical layer security (PLS) in Internet-of-Things (IoT) has attracted great attention in recent years. As an important and intrinsic property in an IoT system, node mobility is not fully investigated when designing a PLS scheme. Existing PLS works with mobility are designed with typical random mobile models, which cannot represent a real scenario. Considering this challenge, we propose a friendly jamming handover scheme to protect the downlink transmission from a controller to an actuator, with the help of multiple cooperative jammers to fight against a mobile conscious eavesdropper. In particular, we first introduce a conscious eavesdropping model (CEM) to characterize a real mobile wiretapping scenario. Second, we present a handover scheme to enhance security in a mobile scenario and then define handover efficiency to discuss the handover performance. Finally, numerical results are provided to verify the effectiveness of the proposed handover scheme, which demonstrates that our scheme can efficiently fight against a conscious mobile eavesdropper.

Introduction

     Internet of Things (IoT) is expected as a promising technique to achieve ubiquitous connectivity and intelligent information processing for the intelligent future life [1, 2]. Since the IoT is penetrating our daily life, the security and privacy are of the utmost importance [3–5]. Physical layer security (PLS) techniques have been attracted growing interests for the scenarios with resource-constrained IoT sensors and actuators [6–8]. A PLS scheme taking advantage of the unique properties of wireless channels can guarantee the information-theoretic communication security, regardless of the computing capability of eavesdroppers [9]. Various PLS schemes have been investigated to enhance secrecy in IoT networks, including multi-antenna beamforming and precoding [10, 11], artificial noise (AN) [12], intermittent cooperative jamming [13], and sociability-enabled PLS [8, 14, 15].

Conclusion

     This work investigated secure downlink transmmission in an IoT system with a mobile eavesdropper, and proposed a handover scheme to enhance PLS with the help of multiple cooperative jammers. In order to reflect the real situation, the conscious eavesdropping model was proposed to compare with the typical RWP model. Moreover, we introduced a metric called handover efficiency to reflect the handover performance. The numerical results verified that the handover scheme could efficiently improve the secrecy performance and effectively confront the conscious eavesdropper. The proposed scheme is feasible to provide security enhancement in many real mobile eavesdropping scenarios.

Abstract

Document Sections

I. Introduction

II. Preliminaries

III. System Overview

IV. Experimental Evaluation

V. Conclusion

Abstract:

With the development of 5G networks, IoT devices are increasingly used in the industrial and household fields. Due to the characteristics of the CPU multi-architecture system of IoT devices, the traditional signature-based and single-architecture based detection methods is not effective are for detecting cross-architecture malware. To solve this problem, we propose a cross-architecture IoT malware detection system based on Graph Attention Networks (GAT). We employ the CFG extracted from the binary executable file as the graph structure and Opcode and PSI as the feature attributes of the graph nodes. Through GAT, we obtain the neighborhood features of each node, and assign different weights to different nodes in the neighborhood and finally complete detection. Different training phases are allocated to the edge and cloud center for execution to improve system performance and protect user data privacy. The experimental results of par show that the detection accuracy of our system reaches 99.67%. Compared with existing detection methods, we obtained the best accuracy.

I. INTRODUCTION

In recent years, with the vigorous development of various applications of the intelligent Internet of Things, attackers have used endless malware and its variants to pose a huge security threat to IoT devices. For example, controlling a large number of Internet of Things devices to launch DDOS attacks on the central server. In 2018, attackers used Mirai [1] infected malicious IoT devices to launch DDoS attacks on the GitHub website. It has a huge impact on the GitHub backend and users. To protect legitimate users from these threats, anti-malware providers usually provide software products based on signature methods to detect threats. However, attackers can easily use techniques such as instruction virtualization, packaging, and polymorphism to avoid detection. And because IoT devices often have different CPU architectures, for cross-architecture malware, traditional signature-based and single-architecture detection methods are not effective.

In recent years, deep learning algorithms including recurrent neural networks (RNN) [2], convolutional neural networks (CNN) [3] and deep networks (DNN) [4]. They have played a variety of irreplaceable roles in malware detection, which are considered to be an emerging research area. It encourages anti-malware providers to find novel detection method based on deep learning techniques. The work [5] converted Opcode of executable files to vectors Spatial and applied fuzzy and fast fuzzy pattern tree method to detect IoT malware. The authors performed the experiment on the ARM-based IoT dataset, which contained 1078 benign samples and 128 malware samples. The accuracy rate reached 99.83%. However, due to the diversity of the instruction set architecture used in IoT devices, the detection effect of heterogeneous IoT malware is doubtful. The work [6] proposed a function selection method for detection cross-architecture malware which called CFDVex. This experiment achieved good results in cross-architecture malware detection.

The malware detection methods are classified into two categories, namely, dynamic analysis (active analysis) and static analysis (passive analysis). These methods undergo unusual obstruction, and challenges that are process complexity, limitation over detection accuracy. The static method serves to discover malicious applications using various parameters like permission analysis, signature verification. It can be regularly obfuscated. Dynamic techniques entail investigating the performance of an application by administering it in a restricted environment. The complex version of a portable executable often emerges with an intervention by hardening the dynamic analysis centric malware detection methods. The various constraints of these dynamic and static models contribute to this manuscript represents a Multi-Level Malware detection using Triad Scale (MLMTS) built on regression coefficients. The proposed method MLMTS spans into three levels, such that the first and second level performs static analysis, and the third level performs the dynamic analysis. The second and third levels of the hierarchy invoke upon the ambiguous decision of their respective predecessor level. The proposed work is based on the Machine Learning (ML) model that determines the triad scale by applying linear regression for each level of malware detection. The call sequences of the portable executable, arguments passed to these call sequences and their fallouts (resultant values) in respective order of three levels of the MLMTS method. The experimental study manifests the significance of the proposal compared to the other recent malware detection methods.

1. Introduction

The malicious software that is often termed as malware intends to infiltrate, infect, or intrude the cryptographic verification of the owner in the computer system. According to contemporary statistics [1], an average of 400 million malware models is recognized per annum. Currently, the malware family has boosted through the software modules engineered by incredible software skills [2]. The attacks can anonymize the source of the attack [2] and considerably succeeds in hacking the potential industrial structures known as the Stuxnet [3]. Anonymized sources are significant challenges to contemporary malware detection strategies. Extensive utilization of computer-networks is vulnerable to potential malware attacks. The dynamic network connectivity exposes the vulnerabilities of the corresponding network, which entertains the attackers to exploit these vulnerabilities to inject the malware into the respective system. The Intel organization has estimated the impact of malware in terms of loss of revenue as above 400 billion (USD 400 * 109 ) dollars worldwide per annum [1]. These statistics concreting the need for potential malware detect and defense mechanisms.

Malware families typically evolve over a period of time. Differences between malware samples within a single family can originate from various code modifications designed to evade detection, or changes that are made to alter the functionality of the malware itself. Thus, malware samples from the same family from different time periods can exhibit significantly different behavior. In this research, we apply feature ranking—based on linear support vector machine (SVM) weights—to identify changes within malware families. We analyze numerous malware families over extended periods of time. Our goal is to demonstrate that we can detect evolutionary changes within malware families using an automated and quantifiable machine learning based technique.

Introduction

Malware can be defined as malicious software that is designed to cause disruption, deny activity, gather private data without user consent, allow unapproved access to system resources, and similar improper behavior (Aycock, 2006). Malware detection and prevention is a high priority for governments and businesses. Building effective countermeasures to malware threats is difficult due to the complexity of modern software and networked systems. Creators of malware can take advantage of weaknesses in security mechanisms of networks and end systems. Hackers and organized criminals frequently introduce new features to enable their malware to evade detection. In addition, it is highly likely that much—if not most—new malware is written based of existing code, rather than starting from scratch (Walenstein, Venable, Hayes, Thompson, & Lakhotia, 2007). Typically, in the software development process, new software is written on top of the existing software, and in this sense, malware is no different. Thus, malware writers are inclined to reuse existing malware code and release new variants of the same malware (Aycock, 2006). For these reasons, malware can be viewed as evolving over time.

1- Introduction

2- Related work

3- Methodology and experiments

4- Experimental results and discussions

5- Conclusion

References

Abstract

The Android operating system has been the most popular for smartphones and tablets since 2012. This popularity has led to a rapid raise of Android malware in recent years. The sophistication of Android malware obfuscation and detection avoidance methods have significantly improved, making many traditional malware detection methods obsolete. In this paper, we propose DL-Droid, a deep learning system to detect malicious Android applications through dynamic analysis using stateful input generation. Experiments performed with over 30,000 applications (benign and malware) on real devices are presented. Furthermore, experiments were also conducted to compare the detection performance and code coverage of the stateful input generation method with the commonly used stateless approach using the deep learning system. Our study reveals that DL-Droid can achieve up to 97.8% detection rate (with dynamic features only) and 99.6% detection rate (with dynamic + static features) respectively which outperforms traditional machine learning techniques. Furthermore, the results highlight the significance of enhanced input generation for dynamic analysis as DL-Droid with the state-based input generation is shown to outperform the existing state-of-the-art approaches.

Introduction

Android operating system, which is provided by Google, is predicted to continue have a dramatic increase in the market with around 1.5 billion Android-based devices to be shipped by 2021 sta. It is currently leading the mobile OS market with over 80% market share compared to iOS, Windows, Blackberry, and Symbian OS. The availability of diverse Android markets such as Google Play, the official store, and third-party markets makes Android devices a popular target to not only legitimate developers, but also malware developers. Over one billion devices have been sold and more than 65 billion downloads have been made from Google Play (Smartphone, 0000). Android apps can be found in different categories, such as educational apps, gaming apps, social media apps, entertainment apps, banking apps, etc. As a technology that is open source and widely adopted, Android is facing many challenges especially with malicious applications. The malware infected apps have the ability to send text mes-sages to premium rate numbers without the user acknowledgment, gain access to private data, or even install code that can download and execute additional malware on the victim’s device. The malware can also be used to create mobile botnets (Anagnostopoulos et al., 2016). Over the last few years, the number of malware samples attacking Android has significantly increased. According to a recent report from McAfee, over 2.5 million new Android malware apps were discovered in 2017, thus increasing the number of mobile malware samples in the wild to almost 25 million in 2017 (McA, 0000).

1- Introduction

2- Association Rule Learning for Darknet Traffic Data

3- Darknet Analysis for Scan Attacks Using Association Rule Learning

4- Conclusions

References

Abstract

In this paper, we report an interesting observation of the darknet traffic before the source code of IoT malware Mirai was first opened on September 7th 2016. In our darknet analysis, the frequent pattern mining and the association rule learning were performed to a large set of TCP SYN packets collected from July 1st 2016 to September 15th 2016 with the NICT/16 darknet sensor. The number of collected packets is 1,840,973,403 packets in total which were sent from 17,928,006 unique hosts. In this study, we focus on the frequently appeared combinations of “window sizes” in TCP headers. We successfully extracted a certain number of frequent patters and association rules on window sizes, and we specified source hosts that sent out SYN packets matched with either of the extracted rules. In addition, we show that almost all such hosts sent SYN packets satisfying the three conditions known from the source code of Mirai. Such hosts started their scan activities from August 2nd 2016, and ended on September 4th 2016 (i.e., 3 days before the source code was opened).

Introduction

Information technologies (IT) have brought drastic changes in our life and many people have enjoyed new benefits on the Internet. In recent years, in addition to this IT revolution, the great progress of the Internet of Things (IoT), where various services and devices are connected to the network, is about to bring us further revolution. However, along with sophistication of IT and IoT systems, cyberattacks exploiting new system vulnerabilities are becoming serious these days. In particular, the impact of a recent IoT malware Mirai was enormous. Mirai is a worm-type malware that finds an IoT device with similar vulnerability for self-replication. An attacker manipulates a number of IoT devices infected with Mirai as bots and uses this to conduct a Distributed Denial of Service (DDoS) attack by seeding a large number of packets to target hosts. In order to deal with such a large-scale intelligent cyberattack promptly, it is necessary to construct a mechanism that is capable of observing cyberattacks occurring on the Internet with a wide view. For this purpose, the use of the darknet, known as network telescope, has been studied for many years [1]. Darknet is an unused address space. It is considered that no communication occurs because there is no computer installed in the darknet, but many packets are arriving in reality. These packets are mainly caused by scan activity or backscatter of reply packets from hosts targeted by DDoS attack; thus, it can be considered that packet observed in the darknet is generated by malwares. Therefore, through the analysis of Darknet packets, it is possible to observe a part of cyberattacks on the Internet. In this research, we analyze the behavior of scan attacks from packets observed in Darknet. In particular, we focus on TCP SYN packets characterizing scan attacks and aim to find statistical features in the TCP headers of those packets. For this purpose, we apply the association rule learning to SYN packets and discuss the dynamic features of malware performing scan attacks. As for the destination port information, there have been reported several prior works analyzing SYN packets. Ban et al. [1] and some researchers [2, 3] applied the association rule learning to destination port numbers of SYN packets, and they discovered several association rules related to Carna botnet and other malwares. These rules are currently used as a signature when performing network scan. In this work, we focus on different header information such as window size instead of destination port.

Android malware is widespread despite the effort provided by Google in order to prevent it from the official application market, Play Store. Two techniques namely static and dynamic analysis are commonly used to detect malicious applications in Android ecosystem. Both of these techniques have their own advantages and disadvantages. In this paper, we propose a novel hybrid Android malware analysis approach namely mad4a which uses the advantages of both static and dynamic analysis techniques. The aim of this study is revealing some unknown characteristics of Android malware through the used various analysis techniques. As the result of static and dynamic analysis on the widely used Android application datasets, digital investigators are informed about some underestimated characteristics of Android malware.

Introduction

Smartphones have changed the life of people dramatically in the last decade thanks to the provided functionalities and mobility. Android leads the mobile operating system market by being used on over 2 billion monthly active devices (Burke, 2017; Popper, 2017). According to a recent report by IDC1 , Android dominates the global smartphone market with being used on 85% of smartphones in all around the world (IDC Smartphone OS Market Share, 2017). It is expected that Android’s global market share is expected to rise to 90% in 2017 (Bosnjak, 2017). As a result of this popularity, the official application market, Play Store, is used to install 82 billion applications in 2016 (Burke, 2017). It is reported that Play Store is growing at three times the rate of Apple’s App Store which is the official application market of iOS and the biggest official mobile application market after Play Store (Lookout, 2011). As a result of this popularity, Play Store attracts the attention of malware developers (Delac et al., 2011; Portokalidis et al., 2010; Wu et al., 2012; Zhou et al., 2012). Android malware has grown by 580% between September 2011 and September 2012 (Protalinski, 2012). According to a recent report by Check Point2 , the Android malware app “Judy” may have reached as many as 36.5 million users (The Judy Malware Possibly the largest malware campaign found on Google Play, 2017). McAfee Labs report that there are around 2.5 million new Android malware samples exposed yearly (McAfee Labs Threats Predictions Report, 2016). Also, they report that total mobile malware grew 79% in the past four quarters to 16.7 million samples (McAfee Labs Threats Report June 2017, 2017). Despite that these reports demonstrate how serious the threat is, the lack of security awareness of Android digital investigators is reported by many researches (Enck et al., 2009; Kelley et al., 2012; King et al., 2011; Mylonas et al., 2013). According to a recent report, while only 17% of participants are interested in permissions while installing the applications, 42% of participants are even unaware of the permissions (Felt et al., 2012). Google uses Bouncer which is a service supposed to detect malicious applications which are available on Play Store by scanning every available application using dynamic analysis (Alzaylaee et al., 2017; Lockheimer, 2012). Alongside to the Bouncer, Google has announced Google Play Protect during the event Google I/O 2017 (Android e Google Play Protect, 2017; Cunningham, 2017). Google Play Protect is an always-on service which is bundled with the Play Store app. Google Play Protect scans the applications automatically even after the installation to ensure the applications remain safe in terms of security. According to the official website of Google Play Protect, it is reported that 50 billion applications are scanned by Google Play Protect daily (Android e Google Play Protect, 2017). An advantage of Google Play Protect over Bouncer is that Google Play Protect is able to scan applications which are not installed from Play Store. To the best of our knowledge, this paper is the first academic paper which introduces the Google Play Protect. Android malware detection systems are generally categorized into two: (1) Static analysis, and (2) dynamic analysis.

In this paper, we propose a deep learning framework for malware classification. There has been a huge increase in the volume of malware in recent years which poses a serious security threat to financial institutions, businesses and individuals. In order to combat the proliferation of malware, new strategies are essential to quickly identify and classify malware samples so that their behavior can be analyzed. Machine learning approaches are becoming popular for classifying malware, however, most of the existing machine learning methods for malware classification use shallow learning algorithms (e.g. SVM). Recently, Convolutional Neural Networks (CNN), a deep learning approach, have shown superior performance compared to traditional learning algorithms, especially in tasks such as image classification. Motivated by this success, we propose a CNN-based architecture to classify malware samples. We convert malware binaries to grayscale images and subsequently train a CNN for classification. Experiments on two challenging malware classification datasets, Malimg and Microsoft malware, demonstrate that our method achieves better than the state-of-the-art performance. The proposed method achieves 98.52% and 99.97% accuracy on the Malimg and Microsoft datasets respectively.

INTRODUCTION

Malware is malicious software (e.g. viruses, worms, trojan horses, and spyware) that damages or performs harmful actions on computer systems [1]. In this Internet-age, many malware attacks happen that pose serious security threats to financial institutions and everyday users. Fig. 1 presents statistics of malware over the last 10 years. It is clear that the total number of instances of malware has drastically increased over the years. For example, Symantec reported that more than 357 million new variants of malware were observed in 2016 [2]. One of the main reasons for this high volume of malware samples is the extensive use of obfuscation techniques by malware developers, which means that malicious files from the same malware family (i.e. similar code and common origin) are constantly modified and/or obfuscated. In order to cope with the rapid evolution of malware, it is essential to develop robust malware classification techniques that are tolerant of variants of malware files that belong to same family. Towards this endeavor, we propose a deep learning architecture for malware classification. Previous research on malware classification suggests that malware samples typically fall into a family that shares common behaviors, i.e. most new malware are variants of existing ones [3]. Hence, the prospect of building a method that can efficiently classify malware based on its family irrespective of being a variant, seems especially fruitful and a means of dealing with the rapid growth of malware. In this paper, we take a completely different approach to analyze and classify malware compared with traditional methods. We use a Convolutional Neural Network (CNN), a deep learning architecture, to tackle this problem. Recently, deep learning has produced state-of-the-art performance for various tasks in many fields such as natural language processing, computer vision, speech recognition, and bioinformatics. However, the capabilities for applying CNNs has not been well explored in many other fields. One field that may benefit significantly by advances in deep learning is cyber security.

مقاله سال 2017

انتظار می رود که ارتباطات دستگاه به دستگاه (D2D), یک ویژگی کلیدی پشتیبانی شده توسط شبکه های نسل پنجم , بخصوص باتوجه به گسترش کامپیوتری نسل پرسرعت تر شبکه موبایل (MEC ), که نقش مهمی در کاهش فشار شبکه با تغییر کارکردهای کامپیوتری از اینترنت به نسل پرسرعت تر شبکه موبایل دارد, باشد. جدا از اینکه قسمتی از MECبوده است , D2D می تواند پوشش سلولی را گسترش دهد و به کاربران امکان ارتباط مستقیم هنگامی که زیرساخت های مخابراتی (ارتباطی دور) بسیار متراکم است یا وجود ندارد, می دهد. این انحراف چشمگیر از پارادایم سلولی معمولی, نیاز به پروتکل های مسیریابی شبکه غیر متمرکز را تحمیل می کند. علاوه بر این، قابلیت های پیشرفته ی دستگاه های تلفن همراه و شبکه های D2D به احتمال زیاد موجب گسترش انواع بدافزارهای جدید و همه گیر می شود. اگر چه مطالعات و تحقیقات, از نظر پروتکل های مسیریابی D2D بسیار غنی بوده ,که موجب افزایش کیفیت سرویس و مصرف انرژی می شود، تنها پشتیبانی امنیتی اساسی، به عنوان مثال، در قالب رمزگذاری را ارائه می کنند. با این وجود, تصمیم مسیریابی می تواند در تشخیص مشترک بدافزارهای تلفن همراه با بهره گیری از انواع مختلف نرم افزار ضد تروجان نصب شده روی دستگاه های تلفن همراه کمک کند. با بهره گیری از ماهیت همیاری ارتباطات D2D، دستگاه می تواند به مشارکت یک دیگر برای تشخیص نرم افزارهای مخرب تکیه کند. تاثیر کار ما روی هدایت شبکه های D2D بدافزارهای رایگان بوده است. برای دسترسی به این موضوع, ما یک پروتکل مسیریابی جدید برای ارتباطات D2D طراحی و راه اندازی کردیم, که تصمیمات مسیریابی برای صراحت بهبود تشخیص بدافزارها را بهینه سازی کردیم. این پروتکل ها مسیرهای شبکه بهینه را از نظر کاهش بدافزار و انرژی صرف شده برای تشخیص نرم افزارهای مخرب، بر اساس یک مدل نظری شناسایی می کنند. قابلیت های متنوع دستگاه های شبکه در حال اجرا در انواع مختلف نرم افزار ضد تروجان و پتانسیل آنها بمنظور بررسی پیام های تقویت شده بسمت یک دستگاه مقصد مورد نظر با استفاده از ابزارهای نظری بازی نفوذ کرده است. تجزیه و تحلیل بهینگی در دو بازی های امنیتی نش و استکلبرگ انجام شده است, که شامل دو حاصل جمع متغیر صفر و غیرصفر و استراتژی های تعادلی است. با انجام شبیه سازی های شبکه، نتایج نظری به دست آمده, تصادفا سناریوهای شبکه ی تولیده شده را نشان می دهد, همچنین نشان می دهد که چگونه پروتکل ما ، از نظر بازده مورد انتظار, پروتکل های مسیریابی معمولی فراتری هستند ، که متشکل از: آسیب امنیتی وارد شده توسط نرم افزارهای مخرب و هزینه تشخیص نرم افزارهای مخرب هستند.