IoT Malware Detection Using Local-Remote ML Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection solutions for resource-constrained IoT and I-IoT devices are complex, resource-intensive, and vulnerable to attacks, lacking efficient methods to detect unknown malware without significant overhead.
Innovation Solution
A dual-layer malware detection system comprising a local machine learning module for data filtering and high-probability detection, and a remote machine learning module for finalizing malware detection, using hardware performance counters and data scaling to minimize resource usage and enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complex malware detection solutions are used, then detection accuracy is improved, but device resource consumption increases
Solution Approach 1:
The malware detection system is segmented into two independent modules: a lightweight local detection module embedded in the resource-constrained device that performs initial filtering, and a comprehensive remote detection module in the cloud that handles complex analysis. This segmentation allows the device to maintain low power consumption while still achieving high detection accuracy through collaboration with the remote system.
Solution Approach 2:
A gateway server acts as an intermediary between the local device and the remote cloud system. The gateway receives detection requests from the device, coordinates with the remote detection system, and returns results. This intermediary manages the complexity of communication and data exchange, allowing the device to remain simple and resource-efficient while accessing powerful remote detection capabilities.
2Adaptability or versatility
If comprehensive malware detection is implemented, then security coverage is improved, but device complexity increases
Solution Approach 1:
The detection system is divided into a simple local component and a comprehensive remote component. The local device only needs to implement basic collection of hardware performance counter data and simple detection logic, while the complex comprehensive detection algorithms run remotely in the cloud, thus achieving wide malware coverage without increasing device complexity.
Solution Approach 2:
The resource-constrained device performs self-service by autonomously collecting hardware performance counter data and executing basic detection algorithms locally. This self-service capability allows the device to maintain simplicity while still contributing to comprehensive malware detection through its local analysis and by sharing data with the remote system.
3Speed
If real-time malware detection is performed, then response speed is improved, but resource consumption increases
Solution Approach 1:
The local detection module performs partial detection actions by analyzing only hardware performance counter data, which is a subset of all possible malware detection features. This partial action enables real-time detection with minimal memory usage, while the remote system performs the remaining detection actions using more comprehensive data and algorithms, achieving both speed and completeness.
Solution Approach 2:
The system extracts only the essential hardware performance counter data locally for immediate analysis, separating this critical real-time component from the broader set of detection features that require more resources. By taking out and analyzing only the most important indicators locally, the system achieves fast response with minimal memory consumption.
Data Source
Figure 1~2
Figure 3
Figure 4(a)~4(d)
AI summary
A system for detecting malwares in a resources constrained device (200), the system comprising: - a monitoring module (203), embedded on the device (200), for measuring, at a predefined adaptable monitoring period, internal hardware events related data (202), - a local machine learning module (205), embedded on the device (200), for providing a confidence score that each monitored data is a malware, the local machine learning module being configured to raise an alert (207) if the confidence score is higher than a first predefined alert threshold and to locally store the monitored data in a memory (206) if the confidence score is lower than the first predefined alert threshold and higher than a second predefined suspicious threshold, - a remote machine learning module (208), embedded on a remote server, for receiving the stored monitored data at a predefined transmission rate and process the received data to detect if it corresponds to malware.