MVC-RSN: A Malware Classification Method With Variant Identification Ability

With the rapid development of the Internet of Things (IoT), a substantial number of mobile devices may need to be connected to and communicate with the other devices. IoT smart nodes, which play a key role in these processes, provide not only connectivity but also data security during data collection and transmission. While existing research has considered security issues concerning data collection and transmission to some extent, the inherent vulnerabilities of smart nodes themselves have rarely received adequate attention. Actually, smart nodes can be susceptible to malware attacks, and the fundamental task to protect them is the timely and accurate identification of malware. However, the stealthy nature of malware, the imbalance in its types, and the sharp increase in malware variants make this task challenging. Existing static malware classification methods, which require known malware features, may struggle with a whole new set of malware variants. Dynamic methods plausibly have the potential to identify malware variants but necessitate running malware beforehand. In this article, we propose a deep-learning-based malware classification method designed to help most smart IoT nodes running mainstream operating systems preventing attacks from the malware and its variants. The proposed method incorporates an automatically adjusting threshold mechanism to extract trivial features of malware, refining the classification process even if original features are modified. It also performs well with insufficient malware samples and is compatible with most mainstream convolutional neural network (CNN) models allowing flexible implements. Experiments concerning byte-level variants, operation-code-level variants, and noise-caused variants are conducted. The results show that for the malware files and their variants, the proposed method can accurately accomplish the malware classification tasks. In addition, the proposed method offers a robust solution for the malware classification, which helps to enhance the security of smart nodes against a wide range of malware and its variants. Last but not least, its compatibility with mainstream CNN models and flexibility in deployment make it a practical approach for real-world applications.