{"title":"在支持 SDN 的物联网场景中检测恶意软件的混合方法","authors":"Cristian H. M. Souza, Carlos H. Arima","doi":"10.1002/itl2.534","DOIUrl":null,"url":null,"abstract":"<p>Malware presents a significant threat to computer systems security, especially in ARM and MIPS architectures, driven by the rise of the internet of things (IoT). This paper introduces Heimdall, a hybrid approach that integrates YARA signatures and machine learning in programmable switches for efficient malware detection in SDN-enabled IoT environments. The machine learning classifier achieved an accuracy of 99.33% against the IoT-23 dataset. When evaluated in an emulated environment with real malware samples, Heimdall exhibits a 98.44% detection rate and an average processing time of 0.0217 s.</p>","PeriodicalId":100725,"journal":{"name":"Internet Technology Letters","volume":"7 6","pages":""},"PeriodicalIF":0.9000,"publicationDate":"2024-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"A hybrid approach for malware detection in SDN-enabled IoT scenarios\",\"authors\":\"Cristian H. M. Souza, Carlos H. Arima\",\"doi\":\"10.1002/itl2.534\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"<p>Malware presents a significant threat to computer systems security, especially in ARM and MIPS architectures, driven by the rise of the internet of things (IoT). This paper introduces Heimdall, a hybrid approach that integrates YARA signatures and machine learning in programmable switches for efficient malware detection in SDN-enabled IoT environments. The machine learning classifier achieved an accuracy of 99.33% against the IoT-23 dataset. When evaluated in an emulated environment with real malware samples, Heimdall exhibits a 98.44% detection rate and an average processing time of 0.0217 s.</p>\",\"PeriodicalId\":100725,\"journal\":{\"name\":\"Internet Technology Letters\",\"volume\":\"7 6\",\"pages\":\"\"},\"PeriodicalIF\":0.9000,\"publicationDate\":\"2024-04-23\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Internet Technology Letters\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://onlinelibrary.wiley.com/doi/10.1002/itl2.534\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"Q4\",\"JCRName\":\"TELECOMMUNICATIONS\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Internet Technology Letters","FirstCategoryId":"1085","ListUrlMain":"https://onlinelibrary.wiley.com/doi/10.1002/itl2.534","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q4","JCRName":"TELECOMMUNICATIONS","Score":null,"Total":0}
引用次数: 0
摘要
在物联网（IoT）兴起的推动下，恶意软件对计算机系统安全构成了重大威胁，尤其是在 ARM 和 MIPS 架构中。本文介绍了一种混合方法 Heimdall，它将 YARA 签名和机器学习集成到可编程交换机中，用于在支持 SDN 的物联网环境中高效检测恶意软件。机器学习分类器对 IoT-23 数据集的准确率达到 99.33%。在使用真实恶意软件样本的模拟环境中进行评估时，Heimdall 的检测率为 98.44%，平均处理时间为 0.0217 秒。
A hybrid approach for malware detection in SDN-enabled IoT scenarios
Malware presents a significant threat to computer systems security, especially in ARM and MIPS architectures, driven by the rise of the internet of things (IoT). This paper introduces Heimdall, a hybrid approach that integrates YARA signatures and machine learning in programmable switches for efficient malware detection in SDN-enabled IoT environments. The machine learning classifier achieved an accuracy of 99.33% against the IoT-23 dataset. When evaluated in an emulated environment with real malware samples, Heimdall exhibits a 98.44% detection rate and an average processing time of 0.0217 s.
求助内容：
应助结果提醒方式：
京公网安备 11010802042870号
