Source-linked AI summary
EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques
Ayush Kumar, Teng Joon Lim
TL;DR
IoT malware exploiting software vulnerabilities can be harder to block with firewalls than malware scanning open TELNET ports. EDIMA uses gateway-level machine-learning classification of scanning traffic and supporting modules to detect malware activity during the scanning and infection phase. In testbed evaluation, k-NN performed best among the reported classifiers, followed by Random Forest and Gaussian Naive Bayes.
Problem
IoT malware exploiting software vulnerabilities through legitimate application protocols is harder to block with firewalls than TELNET-scanning malware.
Source: §I · p. 1Method
EDIMA classifies gateway-level traffic as benign or malicious based on malware-induced scanning packets, using machine learning and a modular architecture.
Source: §I · p. 2, B. ML Classification · p. 3Results
The reported Table II scores rank k-NN highest, followed by Random Forest and Gaussian Naive Bayes.
Source: C. Results · p. 5Takeaways & Limitations
EDIMA targets scanning and infection activity so bots can be detected before participating in an attack.
Source: §I · p. 2
Abstract
from arXiv · showhide
The widespread adoption of Internet of Things has led to many security issues. Post the Mirai-based DDoS attack in 2016 which compromised IoT devices, a host of new malware using Mirai's leaked source code and targeting IoT devices have cropped up, e.g. Satori, Reaper, Amnesia, Masuta etc. These malware exploit software vulnerabilities to infect IoT devices instead of open TELNET ports (like Mirai) making them more difficult to block using existing solutions such as firewalls. In this research, we present EDIMA, a distributed modular solution which can be used towards the detection of IoT malware network activity in large-scale networks (e.g. ISP, enterprise networks) during the scanning/infecting phase rather than during an attack. EDIMA employs machine learning algorithms for edge devices' traffic classification, a packet traffic feature vector database, a policy module and an optional packet sub-sampling module. We evaluate the classification performance of EDIMA through testbed experiments and present the results obtained.
I. INTRODUCTION
IoT malware has spread from Mirai variants using TELNET brute force to malware exploiting application vulnerabilities, which is harder to block with firewalls. EDIMA targets scanning and infection activity in large networks using gateway traffic classification and supporting modules.
I. INTRODUCTION
- Vulnerability-exploiting malware using legitimate application protocols such as HTTP and SOAP is harder to block with firewalls than TELNET-scanning malware.The paper also notes that IoT malware can cause prolonged network downtime, financial loss, and leakage of confidential data.Source: §I · p. 1
- The proposed solution combines gateway machine-learning classification, a database of malware scanning traffic patterns, and a policy module, with optional packet subsampling.The paper describes deployment on physical ISP access gateways or as NFV functions at customer premises or enterprises.Source: §I · p. 2
- EDIMA targets scanning and infection activity so network operators can detect and isolate bots before they participate in attacks such as DDoS.The proposed deployment scope includes large-scale enterprise and ISP networks; operators can block bot-originated traffic or notify local administrators.Source: §I · pp. 1–2
- The paper categorizes IoT malware, analyzes category-specific traffic patterns in testbed experiments, and proposes ML-based detection using those patterns.Source: §I · p. 2
II. RELATED WORK
Prior IoT detection work includes attack detection and normal-traffic profiling, while EDIMA focuses on individual IoT bots and their scanning activity before an attack. The authors distinguish this from PC-botnet CnC detection and note limitations in both scanning detection and device fingerprinting.
II. RELATED WORK
- EDIMA targets individual IoT bots rather than whole botnets, avoiding the computationally expensive clustering used in some botnet-detection approaches.The authors cite the scale and geographic spread of IoT botnets as making whole-network detection impractical.Source: §II · p. 2
- The authors note that normal-traffic fingerprinting can misclassify infected devices or miss sophisticated malware, while scanning detection may miss new malware absent from its feature database.They advocate combining device fingerprinting or anomaly detection with malware scanning-traffic detection.Source: §II · p. 2
III. EDIMA ARCHITECTURE
EDIMA is a modular system for detecting IoT malware scanning traffic using machine-learning classification at access gateways. Its modules support model training and updates, traffic-feature storage, administrator-defined responses, and optional subsampling.
III. EDIMA ARCHITECTURE
- EDIMA uses an access-gateway ML classifier to extract feature vectors from incoming traffic samples and classify them using a trained model.Source: §III · p. 3
- The ML model constructor trains classifiers from labeled feature vectors and can replace the deployed model when retraining on newly discovered malware improves performance significantly.Source: §III · p. 3
- The packet traffic feature database stores labeled vectors from gateways with infected and uninfected devices and is updated for newly discovered malware.The authors envisage data contributions from security researchers, industry personnel, and users.Source: §III · p. 3
- Administrator-defined policies determine responses to malicious classifications, while optional subsampling forwards only a fraction of traffic to reduce classifier overhead.Subsampling is proposed for premises with many IoT devices, such as enterprises and industries.Source: §III · p. 3
A. Malware Categorization
The paper groups known IoT malware into three categories according to the type of vulnerability targeted: TELNET, HTTP POST, and HTTP GET.
A. Malware Categorization
- Known IoT malware are grouped by targeted vulnerability type into TELNET, HTTP POST, and HTTP GET categories.TELNET supports bidirectional byte-oriented communication; HTTP GET requests data, while HTTP POST sends data to server resources.Source: A. Malware Categorization · p. 3
B. ML Classification
EDIMA classifies traffic at the IoT access gateway, using fixed traffic sessions rather than individual packets. Its pipeline filters sessions, extracts features, and applies a trained classifier; longer sessions are proposed as a response to slower malware scanning.
B. ML Classification
- Gateway-level classification uses aggregate traffic because it is faster and requires less memory than device-level classification.Traffic is classified as benign when it has no malware-induced scanning packets and malicious when it includes such packets.Source: B. ML Classification · p. 3
- The classifier analyzes fixed-interval traffic sessions, avoiding per-packet classification because it is more computationally costly and offers no significant benefit.Malicious sessions include both benign traffic and malware-generated scanning or infection packets.Source: B. ML Classification · p. 3
- Sessions are filtered for TCP packets with the SYN flag and destination ports on a malware-exploit-based target list before feature extraction and classification.TELNET targets include ports 23 and 2323; HTTP GET uses port 80, while HTTP POST includes ports 37215, 80, 20736, and 36895.Source: B. ML Classification · p. 4
- Features include unique destination IP count and per-destination packet-count maximum, minimum, and mean.The rationale is that malware scans random IPs and typically sends only one malicious packet per destination, potentially reaching more devices during propagation.Source: B. ML Classification · p. 4
- Longer traffic sessions are proposed to counter reduced scanning rates, while the scanning-performance trade-off remains future work.The paper notes that less aggressive scanning could reduce infected devices within a fixed time period.Source: B. ML Classification · p. 4
A. Testbed Description
The testbed combined IoT devices with a laptop and smartphone behind a wireless access gateway. A switch mirrored their cumulative traffic to a Raspberry Pi for monitoring.
A. Testbed Description
- The testbed included a Philips Hue bridge, D-Link Wi-Fi camera, TP-Link smart plug, laptop PC, Android smartphone, and wireless access gateway.The laptop and smartphone ran ordinary user applications, including web, media, social, messaging, and device-control apps.Source: A. Testbed Description · p. 4
- A port-mirroring switch sent cumulative traffic from the IoT devices, laptop, and smartphone to a Raspberry Pi 3B+ for monitoring.The traffic was collected at the gateway as input for training the ML algorithms.Source: A. Testbed Description · p. 4, Figure 2 · p. 5
- The wireless gateway was a D-Link DIR-600 router with a 350 MHz network processor, 32 MB RAM, and 4 MB flash.Source: A. Testbed Description · p. 4
B. Evaluation Methodology
Because real malware could not be used, the evaluation generated malicious traffic with scripts based on public exploits. The collected benign and malicious sessions were split into training and test sets.
B. Evaluation Methodology
- Scripts simulated malicious packets using public exploits and random IP addresses, with non-malicious injected commands to avoid harming devices.The simulated scanning and infection rates were designed using online reports and Mirai source-code behavior as a guide.Source: B. Evaluation Methodology · p. 5
- One malware was selected per category for evaluation because malware within each category was considered to have similar scanning and infection behavior.Source: B. Evaluation Methodology · p. 5
- The testbed yielded 60 sessions of 15 minutes each for both benign and malicious classes, divided into training and test sets using a 70:30 split.Source: B. Evaluation Methodology · p. 5
C. Results
Among the evaluated classifiers, k-NN performed best, followed by Random Forest and Gaussian Naive Bayes. Feature distributions varied in how clearly they separated benign from malicious traffic across the evaluated categories.
C. Results
- TELNET feature F1 distributions were visibly distinct between benign and malicious training data, while other TELNET features and HTTP POST/GET features were less clearly distinguishable.The paper notes that indistinguishable distributions may impair detection performance.Source: C. Results · p. 5, Figure 3 · p. 5
- k-NN performed best, followed by Random Forest and Gaussian Naive Bayes in the reported classifier scores.Table II reports accuracy, precision, recall, and F1 scores; the supplied passages do not give their numerical values.Source: Table II · p. 5, C. Results · p. 5
- The evaluation trained Gaussian Naive Bayes, k-NN, and Random Forest models and assessed classification accuracy, precision, recall, and F1 scores.Accuracy is the fraction of correctly predicted samples; F1 is the harmonic mean of precision and recall.Source: C. Results · p. 5
VI. CONCLUSION
EDIMA is a modular machine-learning approach for early detection of IoT malware network activity, evaluated using packet traffic from a testbed. The conclusion also outlines software implementation and botnet-detection comparisons as future work.
VI. CONCLUSION
- EDIMA is a modular solution for early detection of network activity originating from IoT malware using machine-learning classification.The conclusion describes early detection of network activity, not detection of an attack already underway.Source: §VI · p. 6
- The authors categorize IoT malware by targeted software vulnerabilities and describe the classifier operation and features used for classification.Source: §VI · p. 6
- A testbed with a PC, smartphone, and IoT devices connected to an access gateway evaluated classification using gateway packet captures labeled benign or malicious.Feature vectors were split into training data for standard machine-learning algorithms and test data for reporting classification scores.Source: §VI · p. 6
- Future work includes implementing EDIMA in software, evaluating its performance, and comparing it with botnet-detection techniques using command-and-control features.Source: §VI · p. 6