In recent years, the popularity of IoT (Internet of Things) applications and services has brought great convenience to people's lives, but ubiquitous IoT has also brought many security problems. Among them, advanced persistent threat (APT) is one of the most representative attacks, and its continuous outbreak has brought unprecedented security challenges for the large-scale deployment of the IoT. However, important research on analyzing the attribution of APT malware samples is still relatively few. Therefore, we propose a classification method for attribution organizations with APT malware in IoT using machine learning. It aims to mark the real attacking organization entities to better identify APT attack activity and protect the security of IoT. This method performs feature representation and feature selection based on APT behavior data obtained from devices in the Internet of Things and selects the features with a high degree of differentiation among organizations. Then, it trains a multiclass model named SMOTE-RF that can better deal with imbalance and multiclassification problems. Our experiments on real dynamic behavior data are combined to verify the effectiveness of the method proposed in this paper for attribution analysis of APT malware samples and achieve good performance. Our method could identify the organization behind complex APT attacks in IoT devices and services.

/pdf/attribution-classification-method-of-apt-malware-in-iot-1gwkd4fdfk.pdf

Attribution Classification Method of APT Malware in IoT Using Machine Learning Techniques

Abstract Interaction between devices, people, and the Internet has given birth to a new digital communication model, the internet of things (IoT). The integration of smart devices to constitute a network introduces many security challenges. These connected devices have created a security blind spot, where cybercriminals can easily launch attacks to compromise the devices using malware proliferation techniques. Therefore, malware detection is a lifeline for securing IoT devices against cyberattacks. This study addresses the challenge of malware detection in IoT devices by proposing a new CNN-based IoT malware detection architecture (iMDA). The proposed iMDA is modular in design that incorporates multiple feature learning schemes in blocks including (1) edge exploration and smoothing, (2) multi-path dilated convolutional operations, and (3) channel squeezing and boosting in CNN to learn a diverse set of features. The local structural variations within malware classes are learned by Edge and smoothing operations implemented in the split-transform-merge (STM) block. The multi-path dilated convolutional operation is used to recognize the global structure of malware patterns. At the same time, channel squeezing and merging helped to regulate complexity and get diverse feature maps. The performance of the proposed iMDA is evaluated on a benchmark IoT dataset and compared with several state-of-the CNN architectures. The proposed iMDA shows promising malware detection capacity by achieving accuracy: 97.93%, F1-Score: 0.9394, precision: 0.9864, MCC: 0. 8796, recall: 0.8873, AUC-PR: 0.9689 and AUC-ROC: 0.9938. The strong discrimination capacity suggests that iMDA may be extended for the android-based malware detection and IoT Elf files compositely in the future. 

/pdf/iot-malware-detection-architecture-using-a-novel-channel-1sxruqj2.pdf

IoT malware detection architecture using a novel channel boosted and squeezed CNN

Among the large number of network attack alerts generated every day, actual security incidents are usually overwhelmed by a large number of redundant alerts. Therefore, how to remove these redundant alerts in real time and improve the quality of alerts is an urgent problem to be solved in large-scale network security protection. This paper uses the method of combining machine learning and deep learning to improve the effect of false alarm detection and then more accurately identify real alarms, that is, in the process of training the model, the features of a hidden layer output of the DNN model are used as input to train the machine learning model. In order to verify the proposed method, we use the marked alert data to do classification experiments, and finally use the accuracy recall rate, precision, and F1 value to evaluate the model. Good results have been obtained.

False Alert Detection Based on Deep Learning and Machine Learning

With the prosperity of modern technology, propagation phenomena of diverse information become universal nowadays. Nevertheless, spreading of malicious information will inevitably bring undesired harm or economic losses. These spreading phenomena are usually triggered by limited sources; therefore, it is of great significance to locate these sources to avoid further losses. With the emergence of various social platforms, social networks seem to be integrated. Hence, multiplex networks are desirable to mimic the properties of integrated social networks. Source localization problems on single-layer networks are studied by various scholars whereas less attention has been paid to corresponding problems on multiplex networks. Regarding this, we propose a source locating method in this manuscript, named path-based source localization on multiplex networks (PSLM). With the adoption of the source centrality theory, we apply a label iteration process in order to find nodes with the largest local labels which are regarded as the sources. Furthermore, high uncertainty of spreading path will be incurred by the low spreading probability. Aiming to address such uncertainty, observers are deployed in advance to record the spreading directions. Then, extensive experiments are performed on selected datasets and we find PSLM outperforms the existing ones. Moreover, we also study the effects of various factors on the locating accuracy and find that the locating accuracy improves with the increase of the inter-layer spreading rate. 

Path-based multi-sources localization in multiplex networks

Parallel Deep Learning with a hybrid BP-PSO framework for feature extraction and malware classification

Malicious mining code detection based on ensemble learning in cloud computing environment

A Novel Smart Contract Reentrancy Vulnerability Detection Model based on BiGAS

We propose a novel smart contract re-entry vulnerability detection model based on BiGAS. The model combines a BiGRU neural network that introduces an attention mechanism with an SVM. We start from the data features of smart contracts, learn the model layer by layer to achieve feature extraction and vulnerability identification, introduce batch normalization, Dropout processing and use improved model classifiers to improve the vulnerability identification accuracy, model convergence speed and generalization capability of smart contracts. We had conducted numerous experiments, and the experimental results showed that BiGAS Detection Model has a strong vulnerability detection ability. The accuracy of vulnerability detection reached 93.24%, and the F1-score was 93.17%. We compared our approach with advanced automated audit tools and other deep learning-based vulnerability detection methods. The conclusion was that our method is significantly better than the existing advanced methods in detecting smart contract reentrancy vulnerabilities. 

An Efficient Detection Model for Smart Contract Reentrancy Vulnerabilities

In recent years, the increasing prevalence of Intelligent Transportation Systems with advanced technologies has led to the emergence of many targeted forms of malware such as ransomware, Trojans, viruses, and malicious mining programs. And malware authors use policies like category disguise or family obfuscation in malware components to evade detection, which poses a great security threat to enterprises, government agencies, and Internet users. In this paper, we propose a malware family classification approach based on multimodal fusion and weight self-learning. Firstly, multiple modalities of malware such as byte, format, statistic, and semantic are fused in various ways to generate effective features. And then, we creatively add a weight self-learning mechanism of malware families into the classification model, which works by continuously calculating log-loss based on the family label and the probabilities predicted by each feature. The approach proves to achieve excellent classification performance on highly imbalanced malware family datasets with high efficiency and small resource overhead, which helps to identify and classify malware families and enhance the efficiency of massive malware analysis in Intelligent Transportation Systems.

Yuan Li

Papers

Malicious mining code detection based on ensemble learning in cloud computing environment

A Novel Smart Contract Reentrancy Vulnerability Detection Model based on BiGAS

An Efficient Detection Model for Smart Contract Reentrancy Vulnerabilities

Imbalanced Malware Family Classification Using Multimodal Fusion and Weight Self-Learning