Abstract As digital transformation accelerates, data generated in a convergence information and communication technology (ICT) environment must be secured. This data includes confidential information such as personal and financial information, so attackers spread malware in convergence ICT environments to steal this information. To protect convergence ICT environments from diverse cyber threats, deep learning models have been utilized for malware detection. However, accurately detecting rapidly generated variants and obfuscated malware is challenging. This study proposes a three‐tier malware detection (TMaD) scheme that utilizes a cloud‐fog‐edge collaborative architecture to analyse multi‐view features of executable files and detect malware. TMaD performs signature‐based malware detection at the edge device tier, then sends executables detected as unknown or benign to the fog tier. The fog tier conducts static analysis on non‐obfuscated executables and those transferred from the previous tier to detect variant malware. Subsequently, TMaD sends executables detected as benign in the fog tier to the cloud tier, where dynamic analysis is performed on obfuscated executables and those detected as benign to identify obfuscated malware. An evaluation of TMaD's detection performance resulted in an accuracy of 94.78%, a recall of 0.9794, a precision of 0.9535, and an f1‐score of 0.9663. This performance demonstrates that TMaD, by analysing executables across several tiers and minimizing false negatives, exhibits superior detection performance compared to existing malware detection models.

With the steady increase in the demand for Internet of Things (IoT) devices in diverse industries, such as manufacturing, medical care, and transportation infrastructure, the production of malware tailored for Smart IoT environments is also increasing. Accordingly, various malware detection studies are being conducted to detect not only known malware but also variant malware. However, it is difficult to detect malware transformed in a way that hides malicious behavior by changing and deleting bytes or modifying the assembly code. Therefore, in this study, we propose a malware detection for static security service (Mal3S) scheme that provides a secure Smart IoT environment by accurately detecting various types of malware. Mal3S extracts bytes, opcodes, API calls, strings, and dynamic link libraries (DLLs) through static analysis and then generates five types of images. Images of various sizes are trained on a multi spatial pyramid pooling network (SPP-net) model to detect malware. When evaluating the performance of Mal3S using three malware datasets, the average detection accuracy was 98.02% and the classification accuracy was 98.43%, showing better performance than existing malware detection techniques. In addition, Mal3S has demonstrated effective generalization capabilities for various types of malware.

The healthcare industry is collecting considerable patient and medical data by using Internet of Things (IoT) devices.Consequently, ransomware attacks to encrypt healthcare systems or leak such data have increased recently.Many studies are aiming to predict ransomware behaviours early to protect the healthcare IoT environment from such attacks.However, previous studies analysed ransomware behaviours for long periods of time, and systems would already get infected and encrypted meanwhile.To avoid this problem, this study proposes an early prediction scheme of ransomware behaviour (EPS-Ran) to reduce the likelihood of systems being infected during behavioural analysis.EPS-Ran analyses behaviours for 30 s to extract the opcode and API calls sequence.The extracted behaviour features are entered into a hybrid deep learning model that combines the bidirectional gated recurrent unit (Bi-GRU) model and the temporal convolutional network (TCN) model to predict a future 90 s API calls sequence.The MAE, MSE, and RMSE of the prediction performance of EPS-Ran were measured to be 0.3438, 0.5648, and 0.6342, respectively.EPS-Ran predicted ransomware behaviours early with a low error rate even when the analysis time was reduced from 120 s to 30 s.

In this article, we propose the hybrid malware detection scheme, HyMalD, with bidirectional long short-term memory (Bi-LSTM) and the spatial pyramid pooling network (SPP-Net). Its purpose is to protect Internet of Things (IoT) devices and minimize the damage caused by infection through obfuscated malware. HyMalD performs the static and dynamic analyses logically simultaneously to detect obfuscated malware, which is impossible to do using static analysis alone. First, it extracts static features of the opcode sequence using a reconstructed dataset according to the obfuscation and extracts the application programming interface (API) call sequence dynamically. The extracted features are trained through the Bi-LSTM and SPP-Net models, which HyMalD uses to detect and classify IoT malware. The performance of HyMalD was evaluated, and its detection accuracy was 92.5%. The false-negative rate (FNR) of HyMalD was 7.67%. Thus, HyMalD detects IoT malware more accurately and with a lower FNR than in the static analysis, which had 92.09% detection accuracy and 9.97% FNR.