Unmasking the lurking: Malicious behavior detection for IoT malware with multi-label classification

• Main Authors: FENG, Ruitao, LI, Sen, CHEN, Sen, GE, Mengmeng, LI, Xuewei, LI, Xiaohong
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2024
• Subjects: IoT malware; Malicious behavior detection; Masked Graph Embedding; Multi-label classification; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/8974; https://ink.library.smu.edu.sg/context/sis_research/article/9977/viewcontent/3652032.3657577_pvoa_cc_by_nc_nd.pdf
• Institution: Singapore Management University

Current methods for classifying IoT malware predominantly utilize binary and family classifications. However, these outcomes lack the detailed granularity to describe malicious behavior comprehensively. This limitation poses challenges for security analysts, failing to support further analysis and timely preventive actions. To achieve fine-grained malicious behavior identification in the lurking stage of IoT malware, we propose MaGraMal. This approach, leveraging masked graph representation, supplements traditional classification methodology, empowering analysts with critical insights for rapid responses. Through the empirical study, which took three person-months, we identify and summarize four fine-grained malicious behaviors during the lurking stage, constructing an annotated dataset. Our evaluation of 224 algorithm combinations results in an optimized model for IoT malware, achieving an accuracy of 75.83%. The maximum improvement brought by the hybrid features and graph masking achieves 5% and 4.16%, respectively. The runtime overhead analysis showcases MaGraMal’s superiority over the existing dynamic analysis-based detection tool (12x faster). This pioneering work combines machine learning and static features for malicious behavior profiling.