CEUR Workshop Proceedings
ceur-ws.org ISSN 1613-0073 most challenging task in the network. Public surveillance systems [4] are common applications to prevent from malware attacks. Hence, malware detection is significant for the IoT multimedia device for secure communication among the devices [1]. Malware detection can be done through signature-based methods, visualization ideas, and machine learning-based techniques for the detection and mitigation of malware from the network [5]. The machine learning techniques transform the binary code to image data and visualize the result for various samples and the speed of detection can also be enhanced through machine learning. The malware identification and mitigation are easier and simple while considering the traditional method of the malware detection technique [6]. Machine learning methods [7, 8] are used to identify and predict the network attacks. The non-destructive malware detection method detects the malware without any feature selection strategy. In addition, the optimization strategy of machine learning further enhances the accuracy of detection. Besides, machine learning ofers reduced computation complexity with minimal processing time along with robust performance [9]. The research aims to devise an eficient malware detection technique based on the multimedia-enabled IoT scenario. For safe interaction among the devices, malware needs to be detected and prevented. Thus, an automatic malware detection technique is required with a more accurate detection rate. Here, a novel optimization-based machine learning is introduced for malware detection in the multimedia-enabled IoT environment. For this Feline cad optimization algorithm is proposed by integrating the foraging behavior of the birdie and the hounding behavior of the feline, which is used to train the Deep convolutional neural network (Deep CNN) that enhances the detection accuracy through the fast convergence rate and global best solution. The major contribution of the research is: • Proposed Feline cad optimization: The proposed feline cad optimization is designed by integrating the foraging behavior of the birdie with the hounding behavior of the feline to obtain the global best optimal solution for tuning the weights of the Deep CNN for the malware detection. • Proposed Cat creep based Profound CNN for malware recognition: The malware location in the mixed media empowered IoT climate is finished utilizing the Profound CNN, which is prepared utilizing the proposed Cat scoundrel streamlining. Here, the loads of the classifier are tuned to get a more exact identification through quick union rate by staying away from the catching at neighborhood optima.
The remaining section of the research is: Section 2 details the literature review along with the challenges faced by the existing system. Section 3 elaborates the system model of the proposed method and the result and discussion is presented in Section 4. Finally, the conclusion is provided in section 5.
This section details the review of the conventional literature regarding the multimedia-enabled IoT-based malware detection techniques. The challenges faced by the existing system motivate the author to devise a novel malware detection technique based on machine learning.
The conventional methods of malware detection based on multimedia-enabled IoT is detailed in this section. The multimedia-enabled IoT-based attack detection was utilized by [2] using the adaptive hybrid strategy that uses the timed automata controller technique. Here, the detection of the malware was done through the timed automaton with self-tuning, in which the pattern set for malware was created based on the signature by the crowd-sourcing online repository. Besides, the knowledge regarding the multimedia file format was utilized for the analysis of packets that carries the multimedia files and obtained enhanced classification accuracy. A machine learning-based malware detection was employed in [6] for the IoT environment to avoid the threat. In this strategy, both the unknown and known malware was detected in a very fast manner. Besides, the feature extraction and selection were performed before the detection of malware. Minimal error along with better accuracy was obtained by the method utilized. Dynamic diferential game-based cloud-assisted malware detection was utilized by [ 5] to provide a secure network. Here, the secure data sharing was done using the support vector machine (SVM) and the cost function is minimized through the optimal defense strategy. The utility was evaluated to show the performance enhancement of the malware detection technique. IoT-based malware detection based on the mobile multimedia application was used by [1] through the machine learning approach. Here, the features based on the permission were extracted and were utilized to train the classifier to enhance the classification accuracy. The feature selection was done using the random forest regressor to minimize the number of features for further processing. The accuracy was evaluated to show the performance enhancement. The IoT-based malware detection was employed by [10] based on the intelligent behavior, in which the rule based and learning-based features were selected for the detection of the unknown malware. Here, the elevated accuracy and minimal FNR and FPR were the achievements obtained by the introduced method.
The dificulties looked by the customary media based IoT malware discovery is point by point in this segment.
• The computation complexity of the network is not evaluated and the delays such as state transition and response are neglected [2]. • The machine learning technique for malware detection obtained better accuracy but failed to incorporate the optimization approach that enhances the detection accuracy further [1, 6]. • With the usage of Nash equilibrium criteria, the computation deviation happens, which is considered a non-negligible deviation [5]. • The malware detection technique developed by [10] utilizes an elevated number of features and is not suitable for the detection of new malware.
The interaction of device to device in the virtual and physical environment through the collection of protocols, interfaces, and multimedia-related information constitutes the multimedia-enabled IoT. During the communication process, the malware attack in such a network is unavoidable. Hence there is a need for an automatic malware detection technique. Here, an eficient technique named, Feline cad-based Deep CNN is proposed for the detection of malware in the multimediaenabled IoT network. Initially, the information from the multimedia-enabled IoT devices is gathered and then pre-processed to extract the essential 27 attributes. Here, the first five attributes such as SHA1 hashes and executable MD5 unique attributes along with three textual attributes such as dynamic compilers, functions, and libraries are extracted. In addition, the remaining 22 numerical attributes such as entropy, time data stamp, uninitialized data size, header’s optional size, initialized data’s size, image and code size, size of the pointer to the symbol table, type of PE, total symbols, total section number, size and virtual address number, magic, machine, the base of the image, alignment of the file, characteristics of dynamic link library, database, and codebase are also extracted. From the extracted 27 attributes, the malware detection is employed using the proposed Feline cad-based Deep CNN, in which the classifier named Profound CNN is prepared utilizing the proposed Cat creep advancement calculation to improve the exactness of recognition. The illustration of the proposed Feline cad-based Deep CNN for malware detection is shown in Fig. 1.
The data acquisition for the proposed malware detection technique is taken from the Brazilianmalware-dataset [8], in which 22 attributes numeral attributes, 2 unique attributes, and 3 textual attributes are utilized for the malware detection. Initially, the null data needs to be checked and it should be removed if available. Then, the above mentioned 27 significant attributes are extracted and the redundant information is removed for the reduction of the computational complexity.
The malware detection in the multimedia-enabled IoT environment is done using the proposed Feline cad optimization based on Deep CNN. Here the malware detection is done using the extracted 27 attributes from the IoT network which is fed as input to the Deep CNN. The Profound CNN is prepared utilizing the proposed Cat lowlife enhancement calculation to expand the precision of identification.
A deep convolutional neural network (Deep CNN) [11] is widely used in visual imaginary-based applications due to its eficiency, accuracy, and reliability. Besides, Deep CNN is a feed-forward category network, in which the feedback cannot be fed in itself. The Deep CNN comprises several layers such as a fully connected layer, pooling layer, and convolutional layer. The functioning of each layer is detailed below and is illustrated in Fig. 2.
Convolutional Layer: The input attributes are fed into the convolutional layer, in which several patterns are generated, and it performs the convolutional operation with the filters and forms the feature maps. Here, the input is categorized into several windows and these categorized inputs are convolved with the filters based on certain weights. The output obtained by the convolutional neural network is formulated as, (1) (2) where, refers to the size of the kernel, the th feature map with the layer is notated as , the bias is represented as , and the weight is denoted as .
Pooling Layer: The down-sampling of the spatial dimension is performed in this layer to avoid overfitting issues. The output obtained in this layer is invariant to distortions and translational shifts.
Fully connected layer: The output produced at this layer is nonlinear. Here, the activation function named Rectified Linear Unit (ReLU) is used to avoid the issues related to the vanishing gradient problem. The output of the fully connected layer is formulated as, = ( ) with = 1( −1) 2( −1) 3( −1) ∑ =1 ∑ =1 ∑ =1 ,,, ( −1 )
, ,,, where, the weights of the location (, ) is referred as ,,, and 1( − 1 , 2( − 1) , and 3( − 1) refers to the feature maps
refers to the weights of the location. The loads of the classifier are tuned utilizing the proposed Cat Miscreant Advancement calculation to limit the preparation misfortune and to raise the location precision.
The proposed feline cad optimization is designed by integrating the foraging behavior of the birdie [12] with the hounding behavior of the feline [13] to enhance the searching capability and for the attainment of a more accurate global best optimal solution. Thus, more accurate malware detection is possible through the proposed method. a) Motivation Birdie is a bird with strong memory and intelligence and is mostly a residential bird. Cadger and the producer are the two diferent categories of the birdie in the food search. Here, the cadger obtains food from the producer and the producer obtains its food in the searching process. The low energies birdie utilizes the cadging behavior than the producer. In addition, the feline is a hunting animal with deliberate and hounding characteristics. The hounding characteristic of the feline to hunt the target is high and clear. Thus, in the proposed optimization the foraging behavior of the birdie is incorporated with the hounding behavior of the feline to enhance the convergence rate. b) Mathematical modeling For the mathematical modeling of the proposed feline cad optimization, the fol-lowing rules are considered. Rule 1: The producers of birdie are high-energy members and they need to direct all the cadger in the group in search of food. The energy reserves depend on the fitness value of the birdie.
Rule 2: An alarming signal is generated by the birdie when they detect a predator. The producer birdie needs to lead the entire cadger in the group to a safe location when the alarming sound exceeds the threshold level. Rule 3: The proportion of both the cadger and the producer remains the same in the population, but the birdie with better food searcher can become the producer of the food source. Rule 4: The producers have more energy levels and the cadgers are in search of food when they are in a starving condition. Rule 5: The cadgers follow the producers in search of the food and they constantly monitor them for enhancing the level of predation. Rule 6: When the birdies in the edge face the danger then they move randomly to-ward the neighbor in the safe area.
Initialization: The birdies in the population can be initialized as, where, refers to the dimension of the solution and refers to the birdie. The fitness of the birdie in the population is formulated as, (3) (4) (5) (6)
Here, the fitness of the unique birdie is represented in a row. The producers have the highest iftness and have the priority in food search and are responsible for guiding all the members. Thus, the producers search more areas compared to the cadger. Here, the search capability of the producer is enhanced by incorporating the hounding capability of the feline in search of food. Then, the position updation of the producer depends on rule 1 and 2 and is formulated as, ,+1 = { , ⋅ exp ( , +
− ⋅ max ) if Rand 2 < if Rand 2 ≥ where, refers to the iteration, the th birdie in th dimension is referred as , . The random number is represented as ∈ [0, 1] , the alarm value is notated as Rand 2 ∈ [0, 1] and the safety threshold is referred as ∈ [0, 5, 1] . The random number that satisfies the normal distribution is notated as and the matrix of size [1 × ] is denoted as . The producers search the food when there are no predators found, which satisfies the condition Rand 2 < . The birdies fly to the safe location when they found the predator, the condition for it is Rand 2 ≥ .
As per rule 5 cadgers search and monitors the producers and when they found the food immediately move to the food-rich location and compete with the producer. If they win, then the position updation of the cadger is formulated as, = ⎢
1,1 1,2 = ⎢⎢ ([ 2,1 ⎡ ⎢ ⎣ ([ ,1 1,2 2,2
⋮ ,2 ⋯ ⋯ ⋮ ⋯ ⋯ ⋯ ⋮ ⋯ ⋯ 1, ⎤ ⋯ 2, ⎥ ⋮
⋮ ⋯ , ⎦ ⎥ ⎥ ⋯ 1, ]) ⋯ 2, ]) ⎥ ⋮ ⋯
⋮ , ]) ⎦ ⎤ ⎥ ⎥ ,+1 = { ⋅ exp ( worst − , )
⋅ max +1 + | , − +1 | ⋅ + ⋅ if > /2 otherwise as worst , and + = ( and the condition for it is > /2 .
where, the optimal position of the producer is referred as , the worst solution is denoted )−1. The birdie with the lowest fitness is considered as starving (7) (8) (9)
Let us consider 10% to 20% of the birdie are aware of the danger and according to rule 6 , the position updation is formulated as, where, the constant included to minimize the zero-divisionerror is represented as , the control parameter for the step size is referred as , the best solution is referred as best , and the random number is represented as , and ranges between [−1, 1]. Here, the current birdie’s present fitness is represented as and the worst and the best fitness of the birdie are notated as and respectively. The condition > indicates that the birdie is at the edge and = depicts the danger and hence moves towards the other members of the group.
The position updation based on the hounding capability of the feline in search of food is formulated as, ,+1 = , + , where, the velocity of searching for food by the feline at th feline in th dimension.
As per the rule utilized in [14] utilized for the integration of the characteristic behavior of two algorithms by combining equation (7) and equation (8) and is expressed as, ′ = 0.5 [ + | , − |] + 0.5 [ , + , ]
The pseudo-code for the proposed Feline cad optimization algorithm is presented in Fig. 3 given below.
Here, the global best solution obtained is utilized for tuning the weights of the Deep CNN optimally. The proposed calculation has the capacity to get the worldwide arrangement with quick assembly by staying away from the catching at neighborhood optima utilizing the reasonable investigation and abuse stage. The incorporation of the hounding behavior of the Feline helps the birdie to escape from the attack leading to the maintenance of the population and helps to explore more regions that assist to obtain the global best solution. Thus, the optimal tuning using the proposed optimization algorithm helps to detect the malware in the network more accurately and hence the preventive mechanism can be employed to avoid the damage.
The result evaluated by the proposed Feline cad-based DeepCNN is detailed in this section based on the performance metrics such as accuracy, sensitivity, and specificity.
For the evaluation of the proposed malware detection technique, MATLAB is uti-lized with an Intel i3 core processor, 2GB RAM, and Windows 10 OS.
The Brazilian-malware-dataset [15] comprises of 80GB malicious binary samples with 23,033 unique samples with a total of 29,704 samples. In addition, each sample consists of 27 attributes, in which 3 textual, two unique, and 22 numerical attributes.
The analysis of the proposed method is compared with the traditional malware de-tection techniques such as Neural Network [16], Deep CNN [11], PSO- based DeepCNN [17],CSObased DeepCNN [13] and Sparrow search based DeepCNN [12].
and Neg represent false negative. detection technique and is expressed as, The eficiency of the developed Feline cad-based DeepCNN is evaluated in terms of accuracy, sensitivity and specificity.
Accuracy (A): The measure of the closeness of the target obtained by the proposed method is measured in terms of accuracy and is formulated as, where, Pos represent true positive, Pos indicate false positive, indicate true negative, Sensitivity (S1): The ratio of a positive which correctly detected by the proposed malware Specificity
(2 ∶) :The ratio of negatives that are correctly detected by the proposed malware detection technique and is represented by, 1 =
Pos
Pos + 2 =
+ Pos
This research proposed a malware detection technique for the multimedia enabled IoT environment. Here, the data gathered from the IoT environment is extracted based on 27 attributes for the reduction of the computational complexity and is fed to the input for the detection of the malware using the DeepCNN, which is trained using the proposed Feline cad optimization approach that is designed by integrating the forag-ing behavior of the birdie with the hounding behavior of the feline to obtain the glob-al best optimal solution for tuning the weights. The proposed method obtained the maximal accuracy, sensitivity, and specificity and obtained the values of 99.95%, 97.45%, and 96.12% respectively. [1] R. Taheri, R. Javidan, Z. Pooranian, Adversarial android malware detection for mobile multimedia applications in IoT environments, Multimed. Tools Appl. 80 (2021) 16713–16729. [2] S. Venkatraman, B. Surendiran, Adaptive hybrid intrusion detection system for crowd sourced multimedia internet of things systems, Multimed. Tools Appl. 79 (2020) 3993–4010. [3] V. Madaan, D. Sethi, P. Agrawal, L. Jain, R. Kaur, Public network security by blufing the intruders through encryption over encryption using public key cryptography method, in: Advanced Informatics for Computing Research: First International Conference, ICAICR