Browse > Article
http://dx.doi.org/10.3837/tiis.2021.03.016

Detecting Malware in Cyberphysical Systems Using Machine Learning: a Survey  

Montes, F. (Escuela Superior de Ingenieria y Tecnologia, Universidad Internacional de La Rioja)
Bermejo, J. (Escuela Superior de Ingenieria y Tecnologia, Universidad Internacional de La Rioja)
Sanchez, L.E. (Research Group GSyA, University of Castilla-la Mancha, Paseo de la Universidad)
Bermejo, J.R. (Escuela Superior de Ingenieria y Tecnologia, Universidad Internacional de La Rioja)
Sicilia, J.A. (Escuela Superior de Ingenieria y Tecnologia, Universidad Internacional de La Rioja)
Publication Information
KSII Transactions on Internet and Information Systems (TIIS) / v.15, no.3, 2021 , pp. 1119-1139 More about this Journal
Abstract
Among the scientific literature, it has not been possible to find a consensus on the definition of the limits or properties that allow differentiating or grouping the cyber-physical systems (CPS) and the Internet of Things (IoT). Despite this controversy the papers reviewed agree that both have become crucial elements not only for industry but also for society in general. The impact of a malware attack affecting one of these systems may suppose a risk for the industrial processes involved and perhaps also for society in general if the system affected is a critical infrastructure. This article reviews the state of the art of the application of machine learning in the automation of malware detection in cyberphysical systems, evaluating the most representative articles in this field and summarizing the results obtained, the most common malware attacks in this type of systems, the most promising algorithms for malware detection in cyberphysical systems and the future lines of research in this field with the greatest potential for the coming years.
Keywords
Cyber-physical System; IoT; Malware; Machine Learning; Detection;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 A. Cui and S. J. Stolfo, "A quantitative analysis of the insecurity of embedded network devices: results of a wide-area scan," in Proc. of the 26th Annual Computer Security Applications Conference, pp. 97-106, 2010.
2 A. Costin, J. Zaddach, A. Francillon, and D. Balzarotti, "A Large-Scale Analysis of the Security of Embedded Firmwares," in Proc. of the 23rd USENIX Security Symposium, pp. 95-110, 2014.
3 M. Chowdhury, A. Rahman, and R. Islam, "Malware Analysis and Detection Using Data Mining and Machine Learning Classification," in Proc. of International Conference on Applications and Techniques in Cyber Security and Intelligence, pp. 266-274, 2018.
4 A. Yeboah-Ofori and C. Boachie, "Malware Attack Predictive Analytics in a Cyber Supply Chain Context Using Machine Learning," in Proc. of 2019 International Conference on Cyber Security and Internet of Things (ICSIoT), pp. 66-73, May 2019.
5 Y. Maleh, "Machine Learning Techniques for IoT Intrusions Detection in Aerospace Cyber-Physical Systems," Machine Learning and Data Mining in Aerospace Technology, vol. 836, pp. 205-232, 2020.   DOI
6 H.-D. Ma, "Internet of Things: Objectives and Scientific Challenges," Journal of Computer Science and Technology, vol. 26, no. 6, pp. 919-924, Nov. 2011.   DOI
7 A. Costin, "IoT/Embedded vs. Security: Learn from the Past, Apply to the Present, Prepare for the Future," in Proc. of the 22nd Conference of Open Innovations Association, pp. 412-414, 2018.
8 G. Kambourakis, C. Kolias, and A. Stavrou, "The Mirai botnet and the IoT Zombie Armies - IEEE Conference Publication," in Proc. of IEEE Military Communications Conference, pp. 267-272, 2017.
9 A. Zaki and B. Humphrey, "Unveiling the kernel: rootkit discovery using selective automated kernel memory differencing," in Proc. of Virus Bulletin Conference, pp. 239-256, 2014.
10 E. B. Barker, M. Smid, and D. Branstad, "A Profile for U. S. Federal Cryptographic Key Management Systems," National Institute of Standards and Technology (NIST SP 800-152), Oct. 2015.
11 J. Gao, L. Li, P. Kong, T. F. Bissyande, and J. Klein, "Should You Consider Adware as Malware in Your Study?," in Proc. of IEEE 26th International Conference on Software Analysis, Evolution and Reengineering (SANER), pp. 604-608, 2019.
12 N. Scaife, H. Carter, P. Traynor, and K. Butler, "CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data," in Proc. of IEEE 36th International Conference on Distributed Computing Systems, pp. 303-312, June 2016.
13 Y. Ye, T. Li, D. Adjeroh, and S. S. Iyengar, "A Survey on Malware Detection Using Data Mining Techniques," ACM Computing Surveys, vol. 50, no. 3, June 2017.
14 J. Landage and M. P. Wankhade, "Malware and Malware Detection Techniques: A Survey," International Journal of Engineering Research and Technology, 2013.
15 I. Memon, R. A. Shaikh, H. Fazal, H. Tunio, and Q. A. Arain, "The World of Hacking: A Survey," University Sindh Journal of Information and Communication Technology, vol. 4, no. 1, Mar. 2020.
16 Z. Bazrafshan, H. Hashemi, S. M. H. Fard, and A. Hamzeh, "A survey on heuristic malware detection techniques," in Proc. of the 5th Conference on Information and Knowledge Technology, pp. 113-120, May 2013.
17 E. Cozzi, M. Graziano, Y. Fratantonio, and D. Balzarotti, "Understanding Linux Malware," in Proc. of IEEE Symposium on Security and Privacy (SP), pp. 161-175, May 2018.
18 D. Uhricek, "LiSa - Multiplatform Linux Sandbox for Analyzing IoT Malware," Excel FIT, pp. 1-6, 2019.
19 A. Damodaran, F. D. Troia, C. A. Visaggio, T. H. Austin, and M. Stamp, "A comparison of static, dynamic, and hybrid analysis for malware detection," Journal of Computer Virology and Hacking Techniques, vol. 13, no. 1, pp. 1-12, Feb. 2017.   DOI
20 O. Vermesan and P. Friess, Internet of Things: Converging Technologies for Smart Environments and Integrated Ecosystems, River Publishers, Denmark, 2013.
21 S. Tweneboah-Koduah, K. E. Skouby, and R. Tadayoni, "Cyber Security Threats to IoT Applications and Service Domains," Wireless Personal Communications, vol. 95, no. 1, pp. 169-185, July 2017.   DOI
22 O. Or-Meir, N. Nissim, Y. Elovici, and L. Rokach, "Dynamic Malware Analysis in the Modern Era-A State of the Art Survey," ACM Computing Survey, vol. 52, no. 5, Sep. 2019.
23 A. Marzano, D. Alexander, O. Fonseca, E. Fazzion, C. Hoepers, K. S. Jessen, M. Chaves, I. Cunha, D. Guedes, and W. Meira, "The Evolution of Bashlite and Mirai IoT Botnets," in Proc. of IEEE Symposium on Computers and Communications (ISCC), pp. 00813-00818, 2018.
24 A. Humayed, J. Lin, F. Li, and B. Luo, "Cyber-Physical Systems Security-A Survey," IEEE Internet of Things Journal, vol. 4, no. 6, pp. 1802-1831, Dec. 2017.   DOI
25 Y. Ashibani and Q. H. Mahmoud, "Cyber physical systems security: Analysis, challenges and solutions," Computer and Security, vol. 68, pp. 81-97, July 2017.   DOI
26 R. Sihwail, K. Omar, and K. A. Zainol Ariffin, "A survey on malware analysis techniques: static, dynamic, hybrid and memory analysis," vol. 8, pp. 1662-1671, Jan. 2018.   DOI
27 C. Paulsen and P. Toth, "Small Business Information Security: The Fundamentals," National Institute of Standards and Technology (NIST IR 7621r1), Oct. 2016.
28 R. Sharp, "An Introduction to Malware," DTU Library, 2017.
29 P. Celeda, R. Krejc, and V. Krmicek, "Revealing Botnets Using Network Traffic Statistics," Security Protection of Information, pp. 7-16, 2011.
30 J. B. Higuera, C. A. Aramburu, J. R. Bermejo Higuera, M. A. Sicilia Urban, and J. A. Sicilia Montalvo, "Systematic Approach to Malware Analysis (SAMA)," Applied Science, vol. 10, no. 4, Jan. 2020.
31 S. Bardhan, D. Montgomery, J. Filliben, and A. Heckert, "A general methodology for deriving network propagation models of computer worms," National Institute of Standards and Technology, Feb. 2019.
32 M. Alazab, S. Venkataraman, and P. Watters, "Towards Understanding Malware Behaviour by the Extraction of API Calls," in Proc. of 2010 Second Cybercrime and Trustworthy Computing Workshop, pp. 52-59, July 2010.
33 A. Lakhotia, V. Notani, and C. LeDoux, "Malware Economics and its Implication to Anti-Malware Situational Awareness," in Proc. of 2018 International Conference On Cyber Situational Awareness, Data Analytics And Assessment, pp. 1-8, June 2018.
34 C. S. Wickramasinghe, D. L. Marino, K. Amarasinghe, and M. Manic, "Generalization of Deep Learning for Cyber-Physical System Security: A Survey," in Proc. of the 44th Annual Conference of IEEE Industrial Electronics Society, pp. 745-751, 2018.
35 R. Mitchell and I. R. Chen, "A survey of intrusion detection techniques for cyber-physical systems," ACM Computing Surveys, vol. 46, no. 4, pp. 55:1-55:29, Mar. 2014.
36 I. You and K. Yim, "Malware Obfuscation Techniques: A Brief Survey," in Proc. of International Conference on Broadband, Wireless Computing, Communication and Applications, pp. 297-300, Nov. 2010.
37 S. Zeadally, E. Adi, Z. Baig, and I. A. Khan, "Harnessing Artificial Intelligence Capabilities to Improve Cybersecurity," IEEE Access, vol. 8, pp. 23817-23837, 2020.   DOI
38 D. Ucci, L. Aniello, and R. Baldoni, "Survey of machine learning techniques for malware analysis," Computers and Security, vol. 81, pp. 123-147, Mar. 2019.   DOI
39 H. S. Ham, H. H. Kim, M. S. Kim, and M. J. Choi, "Linear SVM-Based Android Malware Detection for Reliable IoT Services," Journal of Applied Mathematics, Sep. 03, 2014.
40 P. Celeda, R. Krejci, J. Vykopal, and M. Drasar, "Embedded Malware - An Analysis of the Chuck Norris Botnet," in Proc. of 2010 European Conference on Computer Network Defense, pp. 3-10, 2010.
41 R. Langner, "Stuxnet: Dissecting a Cyberwarfare Weapon," IEEE Security and Privacy, vol. 9, no. 3, pp. 49-51, May 2011.   DOI
42 J. P. Farwell and R. Rohozinski, "Stuxnet and the Future of Cyber War," Survival, vol. 53, no. 1, pp. 23-40, Feb. 2011.   DOI
43 E. Bertino and N. Islam, "Botnets and Internet of Things Security," Computer, vol. 50, no. 2, pp. 76-79, Feb. 2017.   DOI
44 Y. Pan, J. White, D. Schimidt, A. Elhabash, L. Sturm, J. Camelio, and C. Williams, "Taxonomies for Reasoning About Cyber-physical Attacks in IoT-based Manufacturing Systems," International Journal of Interactive Multimedia and Artificial Intelligence, vol. 4, no. 3, p. 45, 2017.
45 H. Sinanovic and S. Mrdovic, "Analysis of Mirai malicious software," in Proc. of the 25th International Conference on Software, Telecommunications and Computer Networks (SoftCOM), pp. 1-5, 2017.
46 M. Krotofil, A. A. Cardenas, B. Manning, and J. Larsen, "CPS: driving cyber-physical systems to unsafe operating conditions by timing DoS attacks on sensor signals," in Proc. of the 30th Annual Computer Security Applications Conference, pp. 146-155, 2014.
47 K. N. Junejo and J. Goh, "Behaviour-Based Attack Detection and Classification in Cyber Physical Systems Using Machine Learning," in Proc. of the 2nd ACM International Workshop on Cyber-Physical System Security, pp. 34-43, May 2016.
48 S. D. Anton, S. Kanoor, D. Fraunholz, and H. D. Schotten, "Evaluation of Machine Learningbased Anomaly Detection Algorithms on an Industrial Modbus/TCP Data Set," in Proc. of the 13th International Conference on Availability, Reliability and Security, pp. 1-9, 2018.
49 W. Zhou and B. Yu, "A cloud-assisted malware detection and suppression framework for wireless multimedia system in IoT based on dynamic differential game," China Communications, vol. 15, no. 2, pp. 209-223, Feb. 2018.   DOI
50 D. Antonioli, G. Bernieri, and N. O. Tippenhauer, "Taking Control: Design and Implementation of Botnets for Cyber-Physical Attacks with CPSBot," ArXiv180200152 Cs, Jan. 2018.
51 T. Liu and W. Wen, "Deep-evasion: Turn deep neural network into evasive self-contained cyber-physical malware: poster," in Proc. of the 12th Conference on Security and Privacy in Wireless and Mobile Networks, pp. 320-321, 2019.
52 H. V. Nath and B. M. Mehtre, "Static Malware Analysis Using Machine Learning Methods," in Proc. of International Conference on Security in Computer Networks and Distributed Systems, pp. 440-450, 2014.
53 U. Bayer, E. Kirda, and C. Kruegel, "Improving the efficiency of dynamic malware analysis," in Proc. of the 2010 ACM Symposium on Applied Computing, pp. 1871-1878, 2010.
54 S. Huda, J. Abawajy, B. Al-Rubaie, L. Pan, and M. M. Hassan, "Automatic extraction and integration of behavioural indicators of malware for protection of cyber-physical networks," Future Generation Computing Systems, vol. 101, pp. 1247-258, Dec. 2019.   DOI
55 M. Egele, S. Theodoor, K. Engin, and C. Kruegel, "A survey on automated dynamic malware-analysis techniques and tools," ACM Computing Survey, vol. 44, no. 2, Mar. 2008.
56 T. Teller and A. Hayon, "Enhancing Automated Malware Analysis Machines with Memory Analysis," Teller Enhancing AM, pp. 1-5, 2014.
57 M. Tracy, W. Jansen, K. Scarfone, and J. Butterfield, "Guidelines on Electronic Mail Security," NIST Special Publication, vol. 2, Feb. 2007.
58 A. Moser, C. Kruegel, and E. Kirda, "Limits of Static Analysis for Malware Detection," in Proc. of the 23rd Annual Computer Security Applications Conference (ACSAC 2007), pp. 421-430, 2017.
59 M. Ajay Kumara and C. Jaidhar, "Automated multi-level malware detection system based on reconstructed semantic view of executables using machine learning techniques at VMM," Future Generation Computer Systems, vol. 79, pp. 431-446, Feb. 2018.   DOI
60 N. Nikolakis, V. Maratos, and S. Makris, "A cyber physical system (CPS) approach for safe human-robot collaboration in a shared workplace," Robotics and Computer Integrated Manufacturing, vol. 56, pp. 233-243, Apr. 2019.   DOI
61 S. M. Dibaji, M. Pirani, D. B. Flamholz, A. M. Annaswamy, K. H. Johansson, and A. Chakrabortty, "A systems and control perspective of CPS security," Annual Reviews in Control, vol. 47, pp. 394-411, Jan. 2019.   DOI
62 K. Chung, X. Li, R. K. Lyer, and T. Kesavadas, "Smart Malware that Uses Leaked Control Data of Robotic Applications: The Case of Raven-II Surgical Robots," in Proc. of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses, pp. 337-351, 2019.
63 C. Greer, M. J. Burns, D. A. Wollman, and E. R. Griffor, "Cyber-Physical Systems and Internet of Things," National Institute of Standards and Technology, 2019.
64 S. Madakam, R. Ramaswamy, and S. Tripathi, "Internet of Things (IoT): A Literature Review," Journal of Computer and Communications, vol. 3, no. 5, May 2015.
65 R. Minerva, A. Biru, and D. Rotondi, "Towards a Definition of the Internet of Things (IoT)," IEEE Internet of Tnings, no. 1, pp. 1-86, May 2015.
66 V. Gunes, S. Peter, T. Givargis, and F. Vahid, "A Survey on Concepts, Applications, and Challenges in Cyber-Physical Systems," KSII Transactions on Internet and Information Systems, vol. 8, no. 12, pp. 4242-4268, Dec. 2014.   DOI
67 K. Jayasinghe and G. Poravi, "A Survey of Attack Instances of Cryptojacking Targeting Cloud Infrastructure," in Proc. of 2nd Asia Pacific Information Technology Conference, pp. 100-107, 2020.
68 A. Costin, "Security of CCTV and Video Surveillance Systems: Threats, Vulnerabilities, Attacks, and Mitigations," in Proc. of the 6th International Workshop on Trustworthy Embedded Devices, pp. 45-54, 2016.
69 L. Bilge and T. Dumitras, "Before we knew it: an empirical study of zero-day attacks in the real world," in Proc. of the 2012 ACM Conference on Computer and Communications Security, pp. 833-844, Oct. 2012.
70 A. Ahmad, W. Shafiuddin, M. N. Kama, and M. M. Saudi, "A New Cryptojacking Malware Classifier Model Based on Dendritic Cell Algorithm," in Proc. of the 3rd International Conference on Vision, Image and Signal Processing, vol. 84, pp. 1-5, 2019.
71 National Academy of Science and Engineering, Germany, "Acatech Position Paper: CyberPhysical Systems Driving Force for Innovation in Mobility, Health, Energy and Production," National Academy of Science and Engineering, Germany, 2019.
72 N. An, A. Duff, G. Naik, M. Faloutsos, S. Weber, and S. Mancoridis, "Behavioral anomaly detection of malware on home routers," in Proc. of the 12th International Conference on Malicious and Unwanted Software (MALWARE), pp. 47-54, Oct. 2017.
73 S. Sharmeen, S. Huda, and J. Abawajy, "Identifying Malware on Cyber Physical Systems by incorporating Semi-Supervised Approach and Deep Learning," in Proc. of IOP Conference on Earth Environmental Science, vol. 322, Sep. 2019.
74 I. Letteri, G. D. Penna, and G. D. Gasperis, "Security in the internet of things: botnet detection in software-defined networks by deep learning techniques," International Journal of High Performance and Networking, vol. 15, no. 3, 2019.
75 W. Niu, X. Zhang, G. Yang, J. Zhu, and Z. Ren, "Identifying APT Malware Domain Based on Mobile DNS Logging," Mathematical Problems in Engineering, pp. 1-9, 2017.
76 I. Stojmenovic and F. Zhang, "Inaugural issue of "cyber-physical systems," Cyber-Physical Systems, vol. 1, no. 1, pp. 1-4, Jan. 2015.   DOI
77 A. Yeboah-ofori, J. D. Abdulai, and F. Katsriku, "Cybercrime and Risks for Cyber Physical Systems: A Review," Apr. 2018.