Subgraph-based adversarial examples against graph-based IoT malware detection systems

Ahmed Abusnaina; Hisham Alasmary; Mohammed Abuhamad; Saeed Salem; Dae Hun Nyang; Aziz Mohaisen

doi:10.1007/978-3-030-34980-6_30

Subgraph-based adversarial examples against graph-based IoT malware detection systems

Ahmed Abusnaina, Hisham Alasmary, Mohammed Abuhamad, Saeed Salem, Dae Hun Nyang, Aziz Mohaisen

Department of Cyber Security

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

15 Scopus citations

Abstract

Internet of Things (IoT) has become widely adopted in many fields, including industry, social networks, health care, and smart homes, connecting billions of IoT devices through the internet. Understanding and studying IoT malware through analysis using various approaches, such as Control Flow Graph (CFG)-based features and then applying deep learning detection, are widely explored. In this study, we investigate the robustness of such models against adversarial attacks. Our approach crafts the adversarial IoT software using the Subgraph Embedding and Augmentation (SGEA) method that reduces the embedded size required to cause misclassification. Intensive experiments are conducted to evaluate the performance of the proposed method. We observed that SGEA approach is able to misclassify all IoT malware samples as benign by embedding an average size of 6.8 nodes. This highlights that the current detection systems are prone to adversarial examples attacks; thus, there is a need to build more robust systems to detect such manipulated features generated by adversarial examples.

Original language	English
Title of host publication	Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings
Editors	Andrea Tagarelli, Hanghang Tong
Publisher	Springer
Pages	268-281
Number of pages	14
ISBN (Print)	9783030349790
DOIs	https://doi.org/10.1007/978-3-030-34980-6_30
State	Published - 2019
Event	8th International Conference on Computational Data and Social Networks, CSoNet 2019 - Ho Chi Minh City, Viet Nam Duration: 18 Nov 2019 → 20 Nov 2019

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11917 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	8th International Conference on Computational Data and Social Networks, CSoNet 2019
Country/Territory	Viet Nam
City	Ho Chi Minh City
Period	18/11/19 → 20/11/19

Bibliographical note

Publisher Copyright:
© Springer Nature Switzerland AG 2019.

Keywords

Adversarial learning
Graph embedding
IoT malware detection

Access to Document

10.1007/978-3-030-34980-6_30

Cite this

Abusnaina, A., Alasmary, H., Abuhamad, M., Salem, S., Nyang, D. H., & Mohaisen, A. (2019). Subgraph-based adversarial examples against graph-based IoT malware detection systems. In A. Tagarelli, & H. Tong (Eds.), Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings (pp. 268-281). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11917 LNCS). Springer. https://doi.org/10.1007/978-3-030-34980-6_30

Abusnaina, Ahmed ; Alasmary, Hisham ; Abuhamad, Mohammed et al. / Subgraph-based adversarial examples against graph-based IoT malware detection systems. Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings. editor / Andrea Tagarelli ; Hanghang Tong. Springer, 2019. pp. 268-281 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{a9deca76bab54787925b61724c034661,

title = "Subgraph-based adversarial examples against graph-based IoT malware detection systems",

abstract = "Internet of Things (IoT) has become widely adopted in many fields, including industry, social networks, health care, and smart homes, connecting billions of IoT devices through the internet. Understanding and studying IoT malware through analysis using various approaches, such as Control Flow Graph (CFG)-based features and then applying deep learning detection, are widely explored. In this study, we investigate the robustness of such models against adversarial attacks. Our approach crafts the adversarial IoT software using the Subgraph Embedding and Augmentation (SGEA) method that reduces the embedded size required to cause misclassification. Intensive experiments are conducted to evaluate the performance of the proposed method. We observed that SGEA approach is able to misclassify all IoT malware samples as benign by embedding an average size of 6.8 nodes. This highlights that the current detection systems are prone to adversarial examples attacks; thus, there is a need to build more robust systems to detect such manipulated features generated by adversarial examples.",

keywords = "Adversarial learning, Graph embedding, IoT malware detection",

author = "Ahmed Abusnaina and Hisham Alasmary and Mohammed Abuhamad and Saeed Salem and Nyang, {Dae Hun} and Aziz Mohaisen",

note = "Publisher Copyright: {\textcopyright} Springer Nature Switzerland AG 2019.; 8th International Conference on Computational Data and Social Networks, CSoNet 2019 ; Conference date: 18-11-2019 Through 20-11-2019",

year = "2019",

doi = "10.1007/978-3-030-34980-6_30",

language = "English",

isbn = "9783030349790",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "268--281",

editor = "Andrea Tagarelli and Hanghang Tong",

booktitle = "Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings",

}

Abusnaina, A, Alasmary, H, Abuhamad, M, Salem, S, Nyang, DH & Mohaisen, A 2019, Subgraph-based adversarial examples against graph-based IoT malware detection systems. in A Tagarelli & H Tong (eds), Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11917 LNCS, Springer, pp. 268-281, 8th International Conference on Computational Data and Social Networks, CSoNet 2019, Ho Chi Minh City, Viet Nam, 18/11/19. https://doi.org/10.1007/978-3-030-34980-6_30

Subgraph-based adversarial examples against graph-based IoT malware detection systems. / Abusnaina, Ahmed; Alasmary, Hisham; Abuhamad, Mohammed et al.
Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings. ed. / Andrea Tagarelli; Hanghang Tong. Springer, 2019. p. 268-281 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11917 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Subgraph-based adversarial examples against graph-based IoT malware detection systems

AU - Abusnaina, Ahmed

AU - Alasmary, Hisham

AU - Abuhamad, Mohammed

AU - Salem, Saeed

AU - Nyang, Dae Hun

AU - Mohaisen, Aziz

N1 - Publisher Copyright: © Springer Nature Switzerland AG 2019.

PY - 2019

Y1 - 2019

N2 - Internet of Things (IoT) has become widely adopted in many fields, including industry, social networks, health care, and smart homes, connecting billions of IoT devices through the internet. Understanding and studying IoT malware through analysis using various approaches, such as Control Flow Graph (CFG)-based features and then applying deep learning detection, are widely explored. In this study, we investigate the robustness of such models against adversarial attacks. Our approach crafts the adversarial IoT software using the Subgraph Embedding and Augmentation (SGEA) method that reduces the embedded size required to cause misclassification. Intensive experiments are conducted to evaluate the performance of the proposed method. We observed that SGEA approach is able to misclassify all IoT malware samples as benign by embedding an average size of 6.8 nodes. This highlights that the current detection systems are prone to adversarial examples attacks; thus, there is a need to build more robust systems to detect such manipulated features generated by adversarial examples.

AB - Internet of Things (IoT) has become widely adopted in many fields, including industry, social networks, health care, and smart homes, connecting billions of IoT devices through the internet. Understanding and studying IoT malware through analysis using various approaches, such as Control Flow Graph (CFG)-based features and then applying deep learning detection, are widely explored. In this study, we investigate the robustness of such models against adversarial attacks. Our approach crafts the adversarial IoT software using the Subgraph Embedding and Augmentation (SGEA) method that reduces the embedded size required to cause misclassification. Intensive experiments are conducted to evaluate the performance of the proposed method. We observed that SGEA approach is able to misclassify all IoT malware samples as benign by embedding an average size of 6.8 nodes. This highlights that the current detection systems are prone to adversarial examples attacks; thus, there is a need to build more robust systems to detect such manipulated features generated by adversarial examples.

KW - Adversarial learning

KW - Graph embedding

KW - IoT malware detection

UR - http://www.scopus.com/inward/record.url?scp=85077775056&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-34980-6_30

DO - 10.1007/978-3-030-34980-6_30

M3 - Conference contribution

AN - SCOPUS:85077775056

SN - 9783030349790

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 268

EP - 281

BT - Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings

A2 - Tagarelli, Andrea

A2 - Tong, Hanghang

PB - Springer

T2 - 8th International Conference on Computational Data and Social Networks, CSoNet 2019

Y2 - 18 November 2019 through 20 November 2019

ER -

Abusnaina A, Alasmary H, Abuhamad M, Salem S, Nyang DH, Mohaisen A. Subgraph-based adversarial examples against graph-based IoT malware detection systems. In Tagarelli A, Tong H, editors, Computational Data and Social Networks - 8th International Conference, CSoNet 2019, Proceedings. Springer. 2019. p. 268-281. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-34980-6_30

Subgraph-based adversarial examples against graph-based IoT malware detection systems

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Fingerprint

Cite this