Network Traffic Oriented Malware Detection in IoT (Internet-of-Things)

With the wide popularity of Internet-of-Things (IoT), machine learning-based malware detection systems are incapable of being installed on IoT devices due to restricted computing power and resources. To bridging the above gap, this paper proposes an integrated deep learning system for malware detection based on features extracted from network packet, NetFlow and malware samples. By referring models popular in natural language processing domain, 7 neural networks with attention mechanism are designed based on both character-level and word-level features. The results demonstrated that all models achieve satisfactory performance on accuracy, recall, precision and F1-Score. Among them, Transformer outperforms other models on character-level features with 99.83% accuracy. By using word-level features, all models achieve better performance than models on character-level features with the best accuracy as 99.54%. By visualizing heat map, we measured and ordered features in descending order based on their contributions to final classification. It is important to find out that features that greatly contribute in IoT malware detection are almost the same with those in network anomaly detection.