Behavioral anomaly detection of malware on home routers

Ni An, Alexander M. Duff, Gaurav Naik, Michalis Faloutsos, Steven Weber, Spiros Mancoridis

Abstract: The Internet of Things (IoT) introduced new targets and attack vectors for malicious actors who infect insecure devices with malware in order to form large botnets that can launch distributed denial of service (DDoS) attacks. These botnets comprise various infected devices such as Internet-connected cameras and home routers. This paper focuses on the unsolved problem of creating robust malware detection to secure home routers. This research compares the effectiveness of three different approaches to behavioral malware detection on home endpoint routers through the observation of kernel-level system calls on these routers: i) principal component analysis (PCA), ii) one-class support vector machines, and iii) a naive anomaly detector based on unseen n-grams.