arXiv 2203.047762022-03-09cs.CRcs.NI

NURSE: eNd-UseR IoT malware detection tool for Smart homEs

Antoine d'Estalenx, Carlos H. Gañán

DOI：: 10.1145/3494322.3494340

英文摘要：

Traditional techniques to detect malware infections were not meant to be used by the end-user and current malware removal tools and security software cannot handle the heterogeneity of IoT devices. In this paper, we design, develop and evaluate a tool, called NURSE, to fill this information gap, i.e., enabling end-users to detect IoT-malware infections in their home networks. NURSE follows a modular approach to analyze IoT traffic as captured by means of an ARP spoofing technique which does not require any network modification or specific hardware. Thus, NURSE provides zero-configuration IoT traffic analysis within everybody's reach. After testing NURSE in 83 different IoT network scenarios with a wide variety of IoT device types, results show that NURSE identifies malware-infected IoT devices with high accuracy (86.7%) using device network behavior and contacted destinations.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

阅读原文

阅读 PDF ↗

arXiv 页面 ↗HTML 原文 ↗

本文内容

英文摘要相关论文

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

继续探索

相关论文

IoT网络中恶意软件传播的最优控制

Optimal Control of Malware Propagation in IoT Networks

针对智能家居IoT网络补丁部署前的恶意软件扩散问题，提出含即时响应状态的SI_HI_LR_FR_C节点流行病学模型与最优控制策略，并通过数值分析和自建数据集验证其降低感染设备数量的效果。

2024-01-20cs.CR

Lightweight Classification of IoT Malware based on Image Recognition

Kyushu University（九州大学）；Indian Institute of Technology Delhi（德里印度理工学院）；Royal Holloway University of London（伦敦大学皇家霍洛威学院）

The Internet of Things (IoT) is an extension of the traditional Internet, which allows a very large number of smart devices, such as home appliances, network cameras, sensors and controllers to connect to one another to share information and improve user experiences. Current IoT devices are typically micro-computers for domain-specific computations rather than traditional functionspecific embedded devices. Therefore, many existing attacks, targeted at traditional computers connected to the Internet, may also be directed at IoT devices. For example, DDoS attacks have become very common in IoT e…

2018-02-11cs.CRcs.CV

用于恶意软件多类分类的结构化状态空间序列模型

A Structured State Space Sequence Model for Multi-Class Classification of Malware

Artificial Intelligence Research (AIR) Center（人工智能研究（AIR）中心）

针对物联网恶意软件威胁，提出基于结构化状态空间序列（S4）模型的恶意软件检测与分类新框架，首次实证应用S4模型并与其他深度学习架构全面比较，提升系统安全性。

2026-10-02cs.AIcs.CRcs.LG

Malware Detection Module using Machine Learning Algorithms to Assist in Centralized Security in Enterprise Networks

Sardar Patel Institute of Technology（萨达尔·帕特尔技术学院）；University of Mumbai（孟买大学）

Malicious software is abundant in a world of innumerable computer users, who are constantly faced with these threats from various sources like the internet, local networks and portable drives. Malware is potentially low to high risk and can cause systems to function incorrectly, steal data and even crash. Malware may be executable or system library files in the form of viruses, worms, Trojans, all aimed at breaching the security of the system and compromising user privacy. Typically, anti-virus software is based on a signature definition system which keeps updating from the internet and thus k…

2012-02-08cs.CRcs.LG

Windows 恶意软件检测器作为复合人工智能系统：准确性、效率与对抗鲁棒性之间的权衡

Windows Malware Detector as a Compound AI System: Trade-Offs in Accuracy, Efficiency, and Adversarial Robustness

University of Genova（热那亚大学）；University of Cagliari（卡利亚里大学）

提出一种平衡检测性能、计算效率与对抗鲁棒性的复合人工智能系统评估方法，引入系统级威胁模型，实验表明可缩短训练时间并提升响应能力，同时为从业者提供部署指南。

2026-09-09cs.CR

面向 IoT 智能家居环境的自适应流量异常检测系统

Self-adaptive Traffic Anomaly Detection System for IoT Smart Home Environments

本文提出由蜜罐服务器与网关构成的 IoT 自适应流量异常检测系统，利用实时流量持续更新模型，以检测已知与未知网络攻击。

2024-03-05cs.CR

更多相关论文收起更多论文

面向 AIoT 设备的轻量级恶意软件检测模型优化

Optimization of Lightweight Malware Detection Models For AIoT Devices

National Taiwan University of Science and Technology（台湾科技大学）；National Sun Yat-sen University（国立中山大学）

针对低端 AIoT 设备资源受限问题，本文优化超级学习器元学习恶意软件检测集成模型，在保持准确率和 FPR 的同时降低推理时间与内存占用。

2024-04-06cs.CRcs.LG

使用BERT改进路由器安全

Improving Router Security using BERT

Drexel University（德雷塞尔大学）；Harvard University（哈佛大学）

本研究通过改进的eBPF系统调用传感器和对比增强学习，提升路由器安全检测性能，并在物联网环境中验证其有效性。

2026-01-02cs.CR

我被感染了吗？运营大规模IoT安全诊断服务的经验教训

Am I Infected? Lessons from Operating a Large-Scale IoT Security Diagnostic Service

本研究通过运营面向日本用户的大规模IoT安全诊断网页服务，基于用户参与数据、评估调研等分析用户行为与反馈，总结了非专业用户的安全预期与服务运营经验。

2025-01-13cs.CR

智能电表的安全问题：分析与防护

Security aspects in Smart Meters: Analysis and Prevention

该研究针对家用即插即用智能电表的安全风险，基于Smartpi 2.0开源方案提出支持设备协作的网络配置与数据流设计，经两类攻击验证其漏洞后，给出了可检测并解决相关攻击的协作机制。

2023-12-13cs.CRcs.NI

DÏoT: A Federated Self-learning Anomaly Detection System for IoT

IoT devices are increasingly deployed in daily life. Many of these devices are, however, vulnerable due to insecure design, implementation, and configuration. As a result, many networks already have vulnerable IoT devices that are easy to compromise. This has led to a new category of malware specifically targeting IoT devices. However, existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different types of devices and manufacturers involved. In this paper, we present DÏoT, an autonomous s…

2019-05-10cs.CR

Machine Learning-Based Early Detection of IoT Botnets Using Network-Edge Traffic

Singapore University of Technology and Design（新加坡科技设计大学）；National University of Singapore（新加坡国立大学）；University of Sydney（悉尼大学）

In this work, we present a lightweight IoT botnet detection solution, EDIMA, which is designed to be deployed at the edge gateway installed in home networks and targets early detection of botnets prior to the launch of an attack. EDIMA includes a novel two-stage Machine Learning (ML)-based detector developed specifically for IoT bot detection at the edge gateway. The ML-based bot detector first employs ML algorithms for aggregate traffic classification and subsequently Autocorrelation Function (ACF)-based tests to detect individual bots. The EDIMA architecture also comprises a malware traffic …

2020-10-22cs.CRcs.LGcs.NI

Anomalous Communications Detection in IoT Networks Using Sparse Autoencoders

Télécom SudParis, Institut Polytechnique de Paris（巴黎理工学院南巴黎电信学院）；IMT Lille-Douai, Institut Mines-Télécom（法国国立高等矿业电信学校联盟里尔-杜埃国立高等矿业电信学校）；CNRS（法国国家科学研究中心）

Nowadays, IoT devices have been widely deployed for enabling various smart services, such as, smart home or e-healthcare. However, security remains as one of the paramount concern as many IoT devices are vulnerable. Moreover, IoT malware are constantly evolving and getting more sophisticated. IoT devices are intended to perform very specific tasks, so their networking behavior is expected to be reasonably stable and predictable. Any significant behavioral deviation from the normal patterns would indicate anomalous events. In this paper, we present a method to detect anomalous network communica…

2019-12-26cs.CRcs.LGcs.NE

Malicious Network Traffic Detection via Deep Learning: An Information Theoretic View

The Johns Hopkins University（约翰斯·霍普金斯大学）

The attention that deep learning has garnered from the academic community and industry continues to grow year over year, and it has been said that we are in a new golden age of artificial intelligence research. However, neural networks are still often seen as a "black box" where learning occurs but cannot be understood in a human-interpretable way. Since these machine learning systems are increasingly being adopted in security contexts, it is important to explore these interpretations. We consider an Android malware traffic dataset for approaching this problem. Then, using the information plan…

2020-09-16cs.CRcs.ITcs.LG

SecureDyn-FL: 一种用于物联网网络入侵检测的鲁棒隐私保护联邦学习框架

SecureDyn-FL: A Robust Privacy-Preserving Federated Learning Framework for Intrusion Detection in IoT Networks

Sir Syed CASE Institute of Technology（Sir Syed CASE 理工学院）；Habib University（哈比布大学）；Yeunganam University（延世南大学）；University of Nottingham Ningbo China（诺丁汉大学宁波分校）；Korea University（高丽大学）

SecureDyn-FL通过动态梯度审计、安全聚合和个性化学习，提升物联网入侵检测的隐私保护和鲁棒性。

2026-01-10cs.CRcs.NI

Characterising attacks targeting low-cost routers: a MikroTik case study (Extended)

Attacks targeting network infrastructure devices pose a threat to the security of the internet. An attack targeting such devices can affect an entire autonomous system. In recent years, malware such as VPNFilter, Navidade, and SonarDNS has been used to compromise low-cost routers and commit all sorts of cybercrimes from DDoS attacks to ransomware deployments. Routers of the type concerned are used both to provide last-mile access for home users and to manage interdomain routing (BGP). MikroTik is a particular brand of low-cost router. In our previous research, we found more than 4 million Mikr…

2020-11-03cs.CR