Lightweight Classification of IoT Malware based on Image Recognition

TL;DR

This paper introduces a lightweight image-based convolutional neural network approach for detecting DDoS malware in IoT devices, achieving high accuracy with minimal resource requirements.

Contribution

It presents a novel method converting binaries into grayscale images and classifying malware using a lightweight CNN, suitable for resource-constrained IoT environments.

Findings

94.0% accuracy in distinguishing goodware from DDoS malware

81.8% accuracy in classifying malware families

Effective for real-time IoT malware detection

Abstract

The Internet of Things (IoT) is an extension of the traditional Internet, which allows a very large number of smart devices, such as home appliances, network cameras, sensors and controllers to connect to one another to share information and improve user experiences. Current IoT devices are typically micro-computers for domain-specific computations rather than traditional functionspecific embedded devices. Therefore, many existing attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. For example, DDoS attacks have become very common in IoT environments, as these environments currently lack basic security monitoring and protection mechanisms, as shown by the recent Mirai and Brickerbot IoT botnets. In this paper, we propose a novel light-weight approach for detecting DDos malware in IoT environments.We firstly extract one-channel gray-scale images converted from binaries, and then utilize a lightweight convolutional neural network for classifying IoT malware families. The experimental results show that the proposed system can achieve 94.0% accuracy for the classification of goodware and DDoS malware, and 81.8% accuracy for the classification of goodware and two main malware families.