Malware Detection for Internet of Things Using One-Class Classification.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• The proliferation of Internet of Things (IoT) and Industrial IoT (IIoT) devices increases operational efficiency but introduces significant cybersecurity vulnerabilities, primarily through sophisticated IoT malware.
• Detecting novel and evolving malware in dynamic IoT environments remains a critical challenge for traditional security approaches.

Purpose of the Study:

• To investigate the efficacy of one-class classification, a form of unsupervised learning, for detecting IoT malware.
• To compare the performance of one-class classification models against multi-class models using both benign and malicious NetFlow data.

Main Methods:

• Utilized the TF-IDF method combined with n-grams to transform nominal NetFlow features into a numerical format suitable for machine learning models.
• Implemented and evaluated one-class classification models (Isolation Forest, deep autoencoder) trained exclusively on benign data.
• Compared performance metrics (recall, precision) against multi-class classification models trained on both benign and malicious data.

Main Results:

• One-class classification models achieved 100% recall across diverse test datasets.
• Precision rates exceeding 80% and 90% were consistently obtained with one-class classification models.
• Unsupervised learning, particularly one-class classification, demonstrated high adaptability to evolving IoT malware threats.

Conclusions:

• One-class classification offers a robust and adaptable solution for detecting IoT malware, even with limited or no prior knowledge of malicious patterns.
• The findings highlight the potential of unsupervised learning techniques to significantly enhance the security of IoT ecosystems.
• Future research should focus on further refining these models and integrating them into comprehensive IoT security frameworks.