Source-linked AI summary
Lightweight Classification of IoT Malware based on Image Recognition
Jiawei Su, Danilo Vasconcellos Vargas, Sanjiva Prasad, Daniele Sgandurra, Yaokai Feng, Kouichi Sakurai
TL;DR
IoT devices are vulnerable to DDoS malware but often lack sufficient resources for conventional security solutions. The paper converts binaries into one-channel gray-scale images and classifies them with a lightweight convolutional neural network for local IoT detection. The system achieves 94.0% accuracy for goodware versus DDoS malware and 81.8% for goodware versus two main malware families.
Problem
IoT devices have vulnerabilities and insufficient computational resources for existing PC-based security solutions, while defensive solutions remain limited.
Method
The approach converts malware binaries into one-channel gray-scale images and feeds them to a small convolutional neural network for classification.
Results
94.0% accuracy was achieved for classifying goodware and DDoS malware, while 81.8% accuracy was achieved for goodware and two main malware families.
Takeaways & Limitations
The proposed classifier can be deployed on real IoT devices and used to classify goodware and IoT DDoS malware.
Takeaways & Limitations
The paper identifies IoT malware obfuscation as an insufficiently evaluated practical case with unresolved questions about its behavior and resource effects.
Abstract
from arXiv · showhide
The Internet of Things (IoT) is an extension of the traditional Internet, which allows a very large number of smart devices, such as home appliances, network cameras, sensors and controllers to connect to one another to share information and improve user experiences. Current IoT devices are typically micro-computers for domain-specific computations rather than traditional functionspecific embedded devices. Therefore, many existing attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. For example, DDoS attacks have become very common in IoT environments, as these environments currently lack basic security monitoring and protection mechanisms, as shown by the recent Mirai and Brickerbot IoT botnets. In this paper, we propose a novel light-weight approach for detecting DDos malware in IoT environments.We firstly extract one-channel gray-scale images converted from binaries, and then utilize a lightweight convolutional neural network for classifying IoT malware families. The experimental results show that the proposed system can achieve 94.0% accuracy for the classification of goodware and DDoS malware, and 81.8% accuracy for the classification of goodware and two main malware families.
1 INTRODUCTION
IoT devices expand connectivity and functionality but remain vulnerable, difficult to standardize, and resource-constrained for conventional security solutions. The paper proposes lightweight local classification of IoT DDoS malware using binary gray-scale images and a small convolutional neural network.
- IoT devices face increased vulnerabilities because hardware and software complexity creates more opportunities for adversaries.
- The proposed approach converts program binaries to gray-scale images and feeds them to a small convolutional neural network for local classification.The target classes include benign applications and the Mirai and Linux.Gafgyt malware families.
- 94.0% accuracy was achieved when classifying goodware and DDoS malware.
- 81.8% accuracy was achieved when classifying goodware and two main malware families.
- The research emphasizes testing on real IoT malware samples and deploying the classifier on real IoT devices.The authors identify the lack of publicly available IoT malware datasets as a practical research difficulty.
2 RELATED WORKS
Prior IoT malware defenses are scarce and commonly rely on cloud-assisted signature matching, while malware-image and machine-learning approaches offer alternatives with different resource demands. This paper positions its approach as a lightweight image-classification solution for IoT malware.
- Few defensive solutions for IoT security existed in the literature, and early collected samples were mostly DDoS malware.The first IoT-specific honeypot simulated eight CPU architectures and initially collected 43 distinct malware samples.
- Cloudeye used local preliminary scanning and cloud analysis of hashed suspicious-file abstracts, but could not handle new variants of existing samples.
- Machine-learning malware detection can use cloud training while resource-constrained IoT devices run the trained classifiers locally.
- Malware-image classification was effective for common PC malware, but prior methods could require feature filtering or computationally heavy fully connected layers.The paper applies malware images to IoT malware classification as a feasible alternative for resource-constrained devices.
3 METHODOLOGY
The methodology combines cloud-supported lightweight filtering with binary-to-image conversion and a small two-layer convolutional neural network. It is designed for local IoT deployment despite limited computation and storage resources.
- The method feeds malware images as features into a small two-layer convolutional neural network for detection.
- The system uses a local client-side detector and cloud backend support for deeper analysis and detector updates.Suspicious files or abstracts can be sent to remote cloud servers, which periodically distribute newly trained detectors.
- IoT malware can target cameras and DVRs, and some samples attempt to kill competing malware to obtain scarce system resources.
- 3.3 Malware Image Classification: Binary files are reformatted as 8-bit sequences and converted into one-channel gray-scale images with pixel values from 0 to 255.
- 3.3 Malware Image Classification: Converting binaries to images requires creating 8-bit input vectors for the convolutional neural network, making the operation very fast.
- Convolutional neural networks automatically extract higher-level nonlinear features from raw inputs, avoiding reliance on manually selected features.
4 EXPERIMENT AND RESULTS
The experiments evaluate a lightweight image-based classifier on a balanced IoT malware dataset across binary goodware-versus-malware and three-class family classification. The system achieves stronger separation of benign and malicious samples than of the two malware families, while remaining more lightweight than prior systems.
- 4.1 Preparing the Dataset: The dataset was collected by IoTPOT, balanced across classes, and reduced to 365 samples, with 45 reserved for testing and the remainder for training.The original dataset contained 500 malware samples spanning several families before preprocessing and balancing.
- 4.2 Malware Image Generation: Each binary was encoded as an 8-bit sequence, mapped to one-channel grayscale pixels, and resized to 64X64 for CNN input.The decimal value of each 8-bit string determines a pixel value in the range [0, 255].
- 4.3 CNN Implementation: The classifier uses a small, two layer shallow convolutional neural network trained for 5000 iterations with batch size 32 and learning rate 0.0001.The design is intended to reduce computational demands relative to common deep image-recognition models.
- 4.4 Results: The experiments repeat both classification settings five times using completely different training/test combinations without shared test samples.The evaluated settings are two-class benign-versus-malicious classification and three-class benign-versus-Mirai-versus-Gafgyt classification.
- 4.4 Results: 94.0% average accuracy was achieved for two-class classification of goodware and DDoS malware.This setting evaluates whether a sample is malicious rather than identifying its malware family.
- 4.4 Results: In three-class classification, 6.67% of malicious samples were misclassified as benign, all from Gafgyt, while no Mirai samples were misclassified as benign.The results indicate that benign-versus-malicious differences are more recognizable than differences between the two malware families; Mirai and Gafgyt misclassification is attributed to shared or similar functions and obfuscation.
- 4.5 Discussion: The proposed system is more lightweight than compared prior works because it uses a smaller network, lower-dimensional input, and simpler preprocessing.Unlike a cited VGG-based approach with more than 10 layers and feature-selection preprocessing, this system directly uses raw image features.
5 CONCLUSION AND FUTURE WORK
The paper presents a lightweight convolutional-neural-network scheme for local IoT DDoS malware detection and identifies further optimization and obfuscation handling as future work.
- 5 CONCLUSION AND FUTURE WORK: The proposed scheme detects IoT DDoS malware locally using malware images and convolutional neural networks.The network can be made more efficient by reducing its size.
- 5 CONCLUSION AND FUTURE WORK: Further network optimization could support implementation on IoT devices with even fewer computational resources.Suggested techniques include removing noncritical neurons and links to reduce classification parameters.
- 5 CONCLUSION AND FUTURE WORK: New malware image extraction methods could be developed to obtain more representative classification features.
- 5 CONCLUSION AND FUTURE WORK: Systematic evaluation of IoT malware obfuscation remains an open direction for improving detection rates.The paper identifies unanswered questions about whether IoT obfuscation resembles traditional malware obfuscation and how resource limits affect obfuscation methods.