Game Theoretic Approach Toward Detection of Input‐Driven Evasive Malware in the IoT

ABSTRACT Numerous researchers have scrutinized evasive malware that exerts influences on various systems. Although these studies have examined a variety of aspects on evasive malware in terms of attack and defense, they have mainly focused on evasive malware driven by the environment and have rarely explored input‐driven evasive malware, which is regarded as a new type of evasive malware exhibiting malicious activities under the characteristics of incoming inputs. To mollify these limitations of existing studies, we dissect input‐driven evasive malware in the IoT from the perspective of game theoretic security analysis. More specifically, we first formulate an input‐driven evasive malware problem in the IoT, then provide a Bayesian signaling game theoretic security analysis of that problem and evaluate the proposed game theoretic security analysis, taking into consideration the diverse facets. In our game theoretic security analysis, we define two players: the input provider with both dynamic analyzer and human user types, and the input receiver with the input‐driven evasive malware type. Then, we derive the pure‐strategy and mixed‐strategy Bayesian Nash equilibria for a single‐stage game and weak sequential equilibrium with the aid of the sequential probability ratio test for a multiple‐stage game. The main evaluation result demonstrates that the input receiver with input‐driven evasive malware type begins to disclose its malicious activities between 6.0234th and 9.6663th stages on an average, under the condition that both the input provider with the dynamic analyzer type and the input receiver with the input‐driven evasive malware type adhere to their multi‐stage strategies of weak sequential equilibrium, contributing to successful discernment of input receiver with input‐driven evasive malware type.