Malware Squid: A Novel IoT Malware Traffic Analysis Framework Using Convolutional Neural Network and Binary Visualisation

  • Robert Shire
  • Stavros ShiaelesEmail author
  • Keltoum Bendiab
  • Bogdan Ghita
  • Nicholas Kolokotronis
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11660)


Internet of Things devices have seen a rapid growth and popularity in recent years with many more ordinary devices gaining network capability and becoming part of the ever growing IoT network. With this exponential growth and the limitation of resources, it is becoming increasingly harder to protect against security threats such as malware due to its evolving faster than the defence mechanisms can handle with. The traditional security systems are not able to detect unknown malware as they use signature-based methods. In this paper, we aim to address this issue by introducing a novel IoT malware traffic analysis approach using neural network and binary visualisation. The prime motivation of the proposed approach is to faster detect and classify new malware (zero-day malware). The experiment results show that our method can satisfy the accuracy requirement of practical application.


Traffic analysis Neural network Binary visualization Network anomaly detection Intrusion detection system 



This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement no. 786698. This work reflects authors’ view and Agency is not responsible for any use that may be made of the information it contains.


  1. 1.
  2. 2.
    Anthony, O., John, O., Siman, E.: Intrusion detection in Internet of Things (IoT). Int. J. Adv. Res. Comput. 9(1) (2018)Google Scholar
  3. 3.
  4. 4.
  5. 5.
  6. 6.
    Gandotra, E., Bansal, D., Sofat, S.: Malware analysis and classification: a survey. J. Inf. Secur. 5(02), 56–64 (2014)Google Scholar
  7. 7.
    Santos, I., Nieves, J., Bringas, P.G.: Semi-supervised learning for unknown malware detection. In: Abraham, A., Corchado, J.M., González, S.R., De Paz Santana, J.F. (eds.) International Symposium on Distributed Computing and Artificial Intelligence, pp. 415–422. Springer, Heidelberg (2011). Scholar
  8. 8.
    Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., Vázquez, E.: Anomaly-based network intrusion detection: techniques, systems and challenges. Comput. Secur. 28(1–2), 18–28 (2009)CrossRefGoogle Scholar
  9. 9.
    Gao, N., Gao, L., Gao, Q., Wang, H.: An intrusion detection model based on deep belief networks. In: 2014 Second International Conference on Advanced Cloud and Big Data, IEEE, Huangshan, China, pp. 247–252 (2014)Google Scholar
  10. 10.
    Shone, N., Ngoc, T.N., Phai, V.D., Shi, Q.: A deep learning approach to network intrusion detection. IEEE Trans. Emerg. Top. Comput. Intell. 2(1), 41–50 (2018)CrossRefGoogle Scholar
  11. 11.
    Torres, P., Catania, C., Garcia, S., Garino, C.G.: An analysis of recurrent neural networks for botnet detection behavior. In: 2016 IEEE biennial congress of Argentina (ARGENCON), IEEE, pp. 1–6 (2016)Google Scholar
  12. 12.
    Wang, W., Zhu, M., Zeng, X., Ye, X., Sheng, Y.: Malware traffic classification using convolutional neural network for representation learning. In: 2017 International Conference on Information Networking (ICOIN), IEEE, Da Nang, Vietnam, pp. 712–717 (2017)Google Scholar
  13. 13.
    Bezerra, V.H., da Costa, V.G.T., Martins, R.A., Junior, S.B., Miani, R.S., Zarpelao, B.B.: Providing IoT host-based datasets for intrusion detection research. In: SBSeg 2018, SBC, pp. 15–28 (2018)Google Scholar
  14. 14.
    Baptista, I., Shiaeles, S., Kolokotronis, N.: A Novel Malware Detection System Based On Machine Learning and Binary Visualization. arXiv preprint arXiv:1904.00859 (2019)
  15. 15.
    Zhou, D., Yan, Z., Fu, Y., Yao, Z.: A survey on network data collection. J. Network Comput. Appl. 116, 9–23 (2018)CrossRefGoogle Scholar
  16. 16.
  17. 17. Accessed 12 Mar 2019
  18. 18.
    Jagadish, H.V.: Analysis of the Hilbert curve for representing two-dimensional space. Inf. Process. Lett. 62(1), 17–22 (1997)MathSciNetCrossRefGoogle Scholar
  19. 19.
    Abadi, M., et al.: TensorFlow: a system for large-scale machine learning. In: 12th {USENIX} Symposium on Operating Systems Design and Implementation ({OSDI} 16), pp. 265–283 (2016)Google Scholar
  20. 20.
    Géron, A.: Hands-On Machine Learning with Scikit-Learn and TensorFlow: Concepts, Tools, and Techniques to Build Intelligent Systems. O’Reilly Media, Inc. (2017)Google Scholar
  21. 21.
  22. 22.
    Abdellatif. A.: Image Classification using Deep Neural Networks—A beginner friendly approach using TensorFlow. Accessed 23 Feb 2019
  23. 23.
  24. 24.
    Huseby, S.H.: Common security problems in the code of dynamic web applications. Web Application Security Consortium (2005).
  25. 25.
    Afianian, A., Niksefat, S., Sadeghiyan, B., Baptiste, D.: Malware Dynamic Analysis Evasion Techniques: A Survey. arXiv preprint arXiv:1811.01190 (2018)
  26. 26.
    Büschkes, R., Laskov, P.: Detection of intrusions and malware and vulnerability assessment. In: Proceedings of Third International Conference DIMVA, pp. 13–14, July 2006Google Scholar
  27. 27.
    Snort-IDS. Accessed 10 Mar 2019
  28. 28.
    Suricata. Accessed 10 Mar 2019
  29. 29.
    Roesch, M.: Lightweight intrusion detection for networks. In: Proceedings of LISA, vol. 99 (2005)Google Scholar
  30. 30.
    Shah, S.A.R., Issac, B.: Performance comparison of intrusion detection systems and application of machine learning to Snort system. Future Gener. Comput. Syst. 80, 157–170 (2018)CrossRefGoogle Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Robert Shire
    • 1
  • Stavros Shiaeles
    • 1
    Email author
  • Keltoum Bendiab
    • 1
  • Bogdan Ghita
    • 1
  • Nicholas Kolokotronis
    • 2
  1. 1.Centre for Security, Communications and Network ResearchUniversity of PlymouthPlymouthUK
  2. 2.Department of Informatics and TelecommunicationsUniversity of PeloponneseTripolisGreece

Personalised recommendations