A Blockchain-Based Malware Detection Model for IoT Devices

The number of malware files is increasing annually, and malware writers use different platforms and evading techniques to bypass security systems. Thus, security researchers must continue using new methods to detect malware. Moreover, malware has become increasingly destructive. Ransomware is a perfect example of how malware infection could be damaging. When ransomware infects a computer, data encryption occurs until the ransom is paid. Wannacry ransomware infected many computers in 2017, causing extreme damage worldwide. According to Cyber Security Ventures [1], in 2021, ransomware will attack new businesses every 40 s, and every 11 s by 2022. This has created a global annual cost of $20 billion. Moreover, they estimated that by 2031, victims' losses will be approximately $265 billion because of ransomware, and a new attack will occur every two seconds. Over time, malware writers have improved their malware payloads and related force activities.

Currently, IoT devices are widely used in various businesses and industries. As is, and are perfect for data analysis. However, IoT devices can gather large amounts of sensitive data. They include chips, cameras, sensors, and many other components. Moreover, IoT devices are the least secure, as linked security recently attracted significant attention to linked security and organization security. IoT devices are not regularly fine-tested and secured from cyber-attacks. Careless behaviors, such as weak passwords or unencrypted network services, complicate this problem. Due to its low computational power, the use of advanced security solutions is not easy. Therefore, malicious software can be quickly injected into IoT devices to access valuable data. In Palo Alto Networks [2], 135,000 security cameras were scanned in March 2022. They found one vulnerability in at least 54% of the scanned cameras. Attackers can use these vulnerabilities to attack cameras and later use them to attack an organization's network. Unfortunately, according to IoT Analytics, there is a predicted increase of 9% in terms of the total number of IoT devices that will reach 27 billion by 2025. Despite the increase in IoT use, 57% of the entities included in the survey were worried about security attacks and data leaks when deploying IoT devices. Moreover, according to Gartner, 20% of organizations have detected cyberattacks on IoT devices in the past three years.

By facing cybersecurity attacks, companies can benefit from IoT opportunities; however, they undertake different vulnerabilities, constituting a portion of the newest regulatory guidance. Global government organizations understand the dangers and threats of connected devices that are not manufactured with appropriate security in mind and react to various variables in blockchain, which changes companies will be required to meet. Different organizations have started to undergo digital transformation, making IoT attacks a worrisome trend. IoT devices convert "dumb" items into "smart.” It has sensors to collect data and access the Internet to share different data types, allowing new business models and opportunities.

Within a network, transparent information sharing via blockchain technology represents an innovative database mechanism. Data are stored by blockchain in blocks linked to each other in a chain. Once the blockchain records the data, it can’t be modified or deleted, making it a trusted, unalterable, or immutable ledger for malware signatures. Moreover, blockchain adds decentralization to malware detection solutions. Besides that, IoT devices that have low resources can benefit from blockchain networks without running heuristic malware detection techniques on them directly.

In this paper, we study recent malware detection approaches, especially those that use blockchain technology to achieve a high detection rate, decrease the false positive rate, or address a lack of resources to benefit from previous approaches in providing a hybrid malware detection framework based on blockchain for IoT devices, which addresses the limitations of existing techniques. In terms of the remainder of this paper, in Section 2, different malware detection techniques are presented, and in Section 3, blockchain technology is introduced. Different malware detection approaches are discussed and compared in Section 4. The Android malware detection methods are described and compared in Section 5.

Nakamoto developed blockchain technology in 2008. It is the primary technology for various virtual currencies, including Bitcoin, and it has attracted significant attention in recent years.

A blockchain consists of sequential blocks. Every block features a transaction record list. A successive number of blocks form a public ledger. A previous block hash is contained in each block header. The initial blockchain block that lacks any parent is the Genesis block [4, 5].

The block header comprises a block version that designates the block validation rules, Merkle tree root hash, which includes all block transactions' hash values, and timestamp to record the present time in universal time from January 1, 1970; n bits that mark a valid block hash threshold; once starts by zero and increases in each hash calculation, and the parent block hash is a 256-bit hash value that points to the previous block.

The block body is comprised of transactions and a counter. Transactions and block sizes determine the maximum number of transactions in a block. The authentication of transactions is verified using an asymmetric cryptography mechanism. Each user had a pair of private and public keys. The user uses a private key to sign the transition. The signed transactions are then broadcast over the entire network. Other users use public keys to verify each transaction signature. The elliptic curve digital signature algorithm (ECDSA) is used in the digital signature, signing, and verification phases. Consensus algorithms are used to secure blockchain transactions. It is a protocol to ensure that all network nodes agree on the ledger's current state, making blockchain reliable. There are different types of consensus algorithms based on other principles. Proof of Work (PoW) is one of the oldest consensus algorithms. Many blockchain platforms use it, such as Bitcoin, Ethereum, and others. It is the most reliable and secure consensus algorithm, but its main problem is scalability. In POW, network nodes that work as miners have to prove their work to have the right to add new transactions to the ledger. Thus, miners must solve mathematical puzzles before adding every new block to the ledger. Then, the validators verify the answer before recording the new block. After that, no one can modify ledger records after every node in the network approves the block. As mentioned before, there are different consensus algorithms based on other ideas, such as Proof of Authority, Proof of Stake (PoS), Delegated Proof of Stake (DPoS), Proof of Importance (PoI), and others.

Thus, every user who wants to transact uses their private key to sign and broadcast it into the network. Every node on the network uses the sender's public key to check new transactions by checking their UTXO to find if the transaction is valid or discard it. Each node collects several transactions to create the block if the transaction is valid. To save any block on the ledger, the POW steps start. Every miner tries to solve the mathematical challenge, and the correct and fast answer will be rewarded after validators approve the answer. Finally, the block will be recorded and can’t be modified.

Blockchain has been used in different fields other than virtual currencies because of its vital characteristics, as follows:

Decentralization: In original transaction-based systems, the central trusted entity must verify every transaction reflected in the cost and performance. Unlike a blockchain, there is no need for a third party. Blockchain consensus algorithms were used to conserve data stability in a distributed network.

Persistency: Transactions can be verified quickly. Honest miners admit only valid transactions. Once transactions are included in a blockchain, they are difficult to edit or delete. Blocks containing invalid transactions were also revealed.

Anonymity: In a blockchain, users handle their generated addresses. Thus, their identities cannot be revealed.

Auditability: The Bitcoin blockchain records Users' balance data using the Unspent Transaction Output (UTXO) model. There is a reference for every transaction to previous unspent transactions. Moreover, the unspent time consumed changes a spent transaction once the current transaction is stored in the blockchain. Thus, every transaction can be confirmed and tracked.

Blockchain has three architectural types with different features, as shown in Table 1.

Public blockchain: A permission-less distributed ledger system in which anybody can read, send transactions, and store valid transactions in the blockchain, and anybody can contribute to the consensus process.

Private blockchain: A restrictive or permission blockchain in which a specific organization has permission to write on the blockchain, although permission to read can be restricted or public.

Consortium blockchain: More than one organization manages a blockchain network. A preselected set of nodes is used to control the consensus process. Before users join, they must ask for permission as a permissioned blockchain. Consortium blockchain shares some characteristics with both private and public blockchains.

Figure 1 shows the different blockchain architecture types used in malware detection approaches. Table 1 explains the reason for using hybrid architecture from blockchain in the majority of malware detection approaches. Using public blockchain provides complete decentralization and persistence to malware detection approaches, making blockchain more suitable for them.

1.png

Figure 1. Blockchain architecture

Table 1. Blockchain types

Android is a modified version of the Linux operating system developed by Google. The device was designed for use in touchscreen smartphones. According to the Statista Research Department [13], in 2019 87% of the global market used Android operating system-based mobile devices, with this proportion estimated to increase in subsequent years, while the Apple (iOS) mobile operating system held the remaining market share segment of 13%. Simultaneously, Android operating systems are open-source and encourage attackers to write malicious software on the Android platform. By contrast, IOS security has stern rights supervision of the system, which gives it a high level of protection. On the other hand, Android users use different application markets to install various applications because of the lack of Google Store, which leaves them in great danger of malicious software and Trojan horses.

Typically, malicious applications are Android malware. It can be downloaded from a Play Store or other third-party store. Android malware has different and severe activities on victim mobile devices, such as information leakage, system damage, and financial losses to users. Thus, there is a significant need for anti-malicious software to protect the Android system, which must consider mobile devices' lack of resources, such as storage and power. Owing to resource problems, blockchain technology has been used in recent malware detection approaches for Android operating systems, as shown in Figure 2. Smartphone malware's intense growth indicates malware developers' shift to mobile devices from traditional desktop systems. Hence, security researchers must switch to and propose new anti-malware mechanisms to achieve the required protection.

2.png

Figure 2. Targeted operating systems

5.1 Malicious Android applications detection using blockchain

In the context of attaining greater concrete predictions, Gupta et al. [14] presented a consensus-based blockchain framework, since blockchains are low-cost and highly reliable. When a Random Forest classifier was used, the proposed model was demonstrated by the experimental results to provide a 95.44% detection accuracy, achieved via the top 45 Information Value-ranked permissions.

For the identification of users and distinguishing permissions that could detect Android malware efficiently, the permissions were ranked via the weight of evidence and information value. After that, each application's obtained permissions were converted into sentences through their concatenation and separation based on the space. The above sentences had TF-IDF applied for their convention into numeric values. To obtain numeric values, machine learning algorithms were employed, namely, Extremely Randomized Trees, Naive Bayes, and Random Forest. A deep learning architecture was also applied through word embedding and an LSTMS to numeric permissions. Finally, the development of a consensus-based blockchain architecture facilitated superior predictions of greater accuracy in terms of the aforementioned problem.

Aneja et al. [15] proposed a blockchain-based system for detecting Android malware applications. Machine learning was used in the proposed malware detection system. They used two types of blockchain networks: an internal blockchain used in feature extraction and an external blockchain used to provide feedback on different machine-learning feature algorithms to complete the task. They used different internal blockchains for each application to improve the detection ratio and decrease the false positive rate.

Alotaibi [16] introduced a new malware detection method called the biserial correlative Miyaguchi–Preneel. It is a Ruzicka-index deep multilayer perceptive learning (BCMPB-RIDMPL) algorithm based on blockchain. The present research aims to improve malware detection accuracy and minimize time consumption. One input layer, three hidden layers, and one output layer are included in the BCMPB-RIDMPL technique. The input layer receives malware features. The malware features are then referred to as the first hidden layer to perform feature selection using a point biserial correlation. The authors found that this step reduces the time required for malware detection. Subsequently, the second hidden layer received the selected features and applications. This layer generates a blockchain hash based on every selected feature using Miyaguchi–Preneel. The generated hash values are then recorded in the blockchain. In the third hidden layer, classification was performed. The Ruzicka index is used to confirm the training and testing of malware feature hash values. The application was classified as malicious if the hash was present; otherwise, it was classified as benign. Compared with state-of-the-art methods, the authors improved malware detection accuracy, Matthews’ correlation coefficient, and required time for malware detection.

Kumar et al. [17] presented a new framework to benefit from blockchain technology and machine learning methodology to detect Android malware in IoT devices. The proposed method uses a clustering, classification, and blockchain-in-sequence (BIS) approach. First, classification is used to classify the target file as benign or malware. They calculated each feature set weight to improve clustering by making feature selections and removing irrelevant features. They then used a naive Bayes classification algorithm in the second phase of malware classification. Finally, a permission-based blockchain is used as a database to store the malware feature information. Thus, new blocks were generated to identify new IoT malware, which improved the runtime malware detection efficiency.

Lekssays et al. [18] provided a dynamic framework for botnet detection. Botnets are used as DDoS attacks for different attacks against IoT devices. A botnet is a set of victim machines compromised and controlled by an attacker using Command and Control (C&C) servers. The authors proposed AutoBotCatcher, based on a blockchain, to detect botnets. They used several optimization methods, such as caching detection output and preprocessing of shared network traffic. Moreover, various privacy-preserving methods protect machines from botnet detection and reidentification. The experimental results indicated a high detection ratio.

In reference [19], an architecture was proposed for the real-time secure storage and distribution of such attack signatures to ensure detection in a prompt manner. The architecture proposed leverages blockchain technology's data immutability, distributed ledger technology, and tamper-proof nature. The examination of the proposed system's performance employed the blockchain network's latency. In the detection of cooperative intrusion, attack signatures are exchanged by IDS nodes to enable the detection of any attack promptly detected by other IDS. Thus, a significant problem is the security of the database housing these shared attack signatures. It is essential to detect and prevent malicious signature deletion, injection, or manipulation.

In reference [20], a Blockchain-Based Malware Detection Framework (B2MDF) was proposed by Homayoun et al. for the detection in mobile application (app) marketplaces (stores) of malicious applications. The B2MDF featured two private blockchains of an internal and external nature, thus representing a dual consortium/private blockchain to achieve the ultimate decision. Blocks attained by dynamic and static feature extractors are stored by the internal private blockchain, whereas the detection results are stored as blocks for current application versions by the external blockchain. Moreover, third parties receive feature blocks shared by B2MDF, thus assisting antimalware vendors in the provision of solutions with greater accuracy.

Kumar et al. [21] presented different malware detection methods. It is based on the blockchain. This framework uses a local neural network (LNN) for classification. They use smart contracts to ensure their authenticity. They used static and dynamic malware analysis to extract the features and then selected features using the information gain function. Malicious applications are verified by the smart contract for both download and upload network processes via the local models' stored aggregated features. The authors achieved improvements in malware detection accuracy besides model efficacy with blockchain in comparison to three state-of-the-art models.

Du et al. [22] proposed a new consortium blockchain-based framework for innovatively detecting and controling malware generation and propagation. Considering a range of factors, including the mobile platform's limited computing power and storage space, the mobile platform is not directly joined to the blockchain. Rather, a detection and reporting framework is utilized according to the log analysis of malicious behavior searches on mobile phones. The daemon process then resides in the memory. The system log information is recorded, with the Aho-Corasick automata algorithm used for matching log information potentially exhibiting behavior of a malicious nature, while identifying and reporting the application's malicious behavior. Based on the experimental results, the approach is able to carry out the detection, identification, and control of Android platform-based malicious applications.

Gu et al. [23] developed a malware-detection framework. The proposed framework is based on blockchain. It consists of two Blockchain networks. Users shared the public network, and the test members shared the consortium network. They used a fuzzy comparison method to create an equivalent to a multi-featured model and multiple-making functions to reduce the number of false positives. They extracted features from different malware files, such as software packages, blockchain networks, permissions and applications, and function call features. A malicious code fact base is used in blockchain technology.

5.2 Using blockchain in defensive description

A different approach was taken by Badih et al. [24], who built upon their previous work in reference [25], which was initially used for malware detection and later redirected to a decoy driver to capture specific data. They demonstrated that combining access control with defensive deception is more effective than other methods, as malware operates within deception mechanisms while attempting to bypass access control. Their approach enabled the detection of secondary webcam spyware more effectively than ever before by analyzing behavior.

They proposed integrating defensive deception methods into a chain of interactions that directs decoy I/O device usage with decoy servers. In their proposed paper, they utilized a smart contract as a decoy along with a decoy key management server. Their framework incorporates blockchain concepts, such as smart contracts and key management approaches, to evade malware while simultaneously leveraging its detection.