MADEA: A Malware Detection Architecture for IoT blending Network Monitoring and Device Attestation
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866909503443697664 |
|---|---|
| author | Prapty, Renascence Tarafder Trimananda, Rahmadi Jakkamsetti, Sashidhar Tsudik, Gene Markopoulou, Athina |
| author_facet | Prapty, Renascence Tarafder Trimananda, Rahmadi Jakkamsetti, Sashidhar Tsudik, Gene Markopoulou, Athina |
| contents | Internet-of-Things (IoT) devices are vulnerable to malware and require new mitigation techniques due to their limited resources. To that end, previous research has used periodic Remote Attestation (RA) or Traffic Analysis (TA) to detect malware in IoT devices. However, RA is expensive, and TA only raises suspicion without confirming malware presence. To solve this, we design MADEA, the first system that blends RA and TA to offer a comprehensive approach to malware detection for the IoT ecosystem. TA builds profiles of expected packet traces during benign operations of each device and then uses them to detect malware from network traffic in real-time. RA confirms the presence or absence of malware on the device. MADEA achieves 100% true positive rate. It also outperforms other approaches with 160x faster detection time. Finally, without MADEA, effective periodic RA can consume at least ~14x the amount of energy that a device needs in one hour. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2502_15098 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | MADEA: A Malware Detection Architecture for IoT blending Network Monitoring and Device Attestation Prapty, Renascence Tarafder Trimananda, Rahmadi Jakkamsetti, Sashidhar Tsudik, Gene Markopoulou, Athina Cryptography and Security Internet-of-Things (IoT) devices are vulnerable to malware and require new mitigation techniques due to their limited resources. To that end, previous research has used periodic Remote Attestation (RA) or Traffic Analysis (TA) to detect malware in IoT devices. However, RA is expensive, and TA only raises suspicion without confirming malware presence. To solve this, we design MADEA, the first system that blends RA and TA to offer a comprehensive approach to malware detection for the IoT ecosystem. TA builds profiles of expected packet traces during benign operations of each device and then uses them to detect malware from network traffic in real-time. RA confirms the presence or absence of malware on the device. MADEA achieves 100% true positive rate. It also outperforms other approaches with 160x faster detection time. Finally, without MADEA, effective periodic RA can consume at least ~14x the amount of energy that a device needs in one hour. |
| title | MADEA: A Malware Detection Architecture for IoT blending Network Monitoring and Device Attestation |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2502.15098 |