Authors:
Dorottya Papp
1
;
Gergely Ács
1
;
Roland Nagy
1
and
Levente Buttyán
1
;
2
Affiliations:
1
CrySyS Lab, Budapest University of Technology and Economics, Műegyetem rkp. 3., H-1111 Budapest, Hungary
;
2
ELKH-BME Information Systems Research Group, Műegyetem rkp. 3., H-1111 Budapest, Hungary
Keyword(s):
IoT, Embedded Systems, Malware Detection, Machine Learning.
Abstract:
Embedded devices are increasingly connected to the Internet to provide new and innovative applications in many domains. However, these devices can also contain security vulnerabilities, which allow attackers to compromise them using malware. In this paper, we present SIMBIoTA-ML, a light-weight antivirus solution that enables embedded IoT devices to take advantage of machine learning-based malware detection. We show that SIMBIoTA-ML can respect the resource constraints of embedded IoT devices, and it has a true positive malware detection rate of ca. 95%, while having a low false positive detection rate at the same time. In addition, the detection process of SIMBIoTA-ML has a near-constant running time, which allows IoT developers to better estimate the delay introduced by scanning a file for malware, a property that is advantageous in real-time applications, notably in the domain of cyber-physical systems.