Evasion of IoT Malware Detection via Dummy Code Injection

2026-02-09

AI Summary

This work addresses the vulnerability of power side-channel–based IoT malware detection systems to adversarial attacks by proposing a novel evasion technique that injects structured no-operation (NOP) instructions during the scanning phase of Mirai botnet execution. This approach dynamically perturbs device power consumption signatures to effectively evade AI/ML-driven anomaly detection while preserving the core malicious functionality. To the best of our knowledge, this is the first use of structured NOPs for side-channel signal perturbation, exposing practical security limitations in current detection frameworks. Evaluation on a real-world dataset collected from smartphones across multiple vendors demonstrates an average attack success rate of 75.2% against several state-of-the-art power side-channel analysis models, confirming the method’s effectiveness and practicality in realistic deployment scenarios.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Application Domains: Internet of Things, Sensor Networks & Smart Cities

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

The Internet of Things (IoT) has revolutionized connectivity by linking billions of devices worldwide. However, this rapid expansion has also introduced severe security vulnerabilities, making IoT devices attractive targets for malware such as the Mirai botnet. Power side-channel analysis has recently emerged as a promising technique for detecting malware activity based on device power consumption patterns. However, the resilience of such detection systems under adversarial manipulation remains underexplored. This work presents a novel adversarial strategy against power side-channel-based malware detection. By injecting structured dummy code into the scanning phase of the Mirai botnet, we dynamically perturb power signatures to evade AI/ML-based anomaly detection without disrupting core functionality. Our approach systematically analyzes the trade-offs between stealthiness, execution overhead, and evasion effectiveness across multiple state-of-the-art models for side-channel analysis, using a custom dataset collected from smartphones of diverse manufacturers. Experimental results show that our adversarial modifications achieve an average attack success rate of 75.2\%, revealing practical vulnerabilities in power-based intrusion detection frameworks.

Problem

• IoT malware
• evasion attack
• power side-channel analysis
• adversarial manipulation
• anomaly detection

Innovation

• adversarial attack
• power side-channel analysis
• IoT malware evasion
• dummy code injection
• Mirai botnet