MADEA: A Malware Detection Architecture for IoT Blending Network Monitoring and Device Attestation

Internet-of-Things (IoT) devices are vulnerable to malware and require new mitigation techniques due to their limited resources. To that end, previous research has used periodic Remote Attestation (<tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$R A$</tex>) or Traffic Analysis (<tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{T} A$</tex>) to detect malware in IoT devices. However, <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{R A}$</tex> is expensive, and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{T}$</tex> A only raises suspicion without confirming malware presence. To solve this, we design MADEA, the first system that blends <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{R A}$</tex> and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{T A}$</tex> to offer a comprehensive approach to malware detection for IoT. <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{T}$</tex> A builds profiles of expected packet traces during benign operations of each device and then uses them to detect malware from network traffic in real-time. <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{R A}$</tex> confirms the presence or absence of malware on the device. MADEA achieves 100 % true positive rate. It also outperforms other approaches with <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$160 \times$</tex> faster detection time. Finally, without MADEA, effective periodic <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\mathcal{R A}$</tex> can consume at least <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\sim 14 \times$</tex> the amount of energy that a device needs in one hour.