A New Method to Analysis of Internet of Things Malware Using Image Texture Component and Machine Learning Techniques

Abstract

Threats derived from Internet of Things (IoT) malicious software are fast progressing and difficult phenomena. Contrary to conventional networks, Internet of things has unique attributes like non compatibility of devices, elevated scalability and different architectures that makes its malware analysis difficult. In this paper, we have developed a new method to analyzing and classifying IoT malware using decomposition image based on the Partial Differential Equations (PDE), the effective texture features extraction is performed not on the original image but on its texture component obtained by the PDE. The texture features based on Haralick are then calculated, and machine learning classifiers namely K-nearest neighbor (KNN), naïve Bayes (NB) and random forest (RF) are used. A binary file (malicious or benign) is transformed to a gray scale image. The gray level co-occurence matrix (GLCM) is computed not on the original image but on its texture component.

Based on these gray level co-occurence matrix parameters, five Haralick features namely angular second moment, entropy, contrast; inverse different moment and correlation are calculated. Finally, these Haralick texture features are used to perform malware classification using random forest, naïve Bayes and K-nearest neighbor. Experimental results show that our approach obtains 95% accuracy for Random Forest, 89% for naïve Bayes and 80% for K-nearest neighbor classifiers. Generally, use of texture component for feature extraction can realize a low computational and platform independent classification scheme for IoT malware.