Rule-Based Approach to Detect IoT Malicious Files
- 1 Saudi Electronic University, Saudi Arabia
- 2 The University of Jordan, Jordan
Abstract
The current immersive increase of cyber-attacks requires constant evolution of the used security solutions. Current malware detection solutions are only able to identify known malwares that were previously detected. They also lack the ability to deeply investigate every file in the system. Therefore, new detection techniques are needed to fill this gab. In this study, a flexible and an effective rule-based approach is proposed to detect malicious files by searching for specific types of strings that should not exist in normal legitimate files. The proposed detection technique relies on the use of LOKI as a scanning agent that uses customized YARA rules with different complexities to search for the needed strings. The proposed methodology has been tested and it detected all malwares successfully.
DOI: https://doi.org/10.3844/jcssp.2020.1203.1211
Copyright: © 2020 Faisal Alsattam, Mousa Al-Akhras, Marwah M. Almasri and Mohammed Alawairdhi. This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
- 3,620 Views
- 2,870 Downloads
- 0 Citations
Download
Keywords
- Digital Forensics
- IoT Forensics
- LOKI
- YARA Rules
- IoT Malware