# EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques

arXiv: https://arxiv.org/abs/1906.09715 · HTML: https://mlsanity.com/paper/1906.09715/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Jun 2019.

## Built on by (most cited first, 8 of 8)

- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Studying the Robustness of Anti-adversarial Federated Learning Models Detecting Cyberattacks in IoT Spectrum Sensors](https://mlsanity.com/paper/2202.00137/) (2022)
- [Tight Rates in Supervised Outlier Transfer Learning](https://mlsanity.com/paper/2310.04686/) (2023)
- [Distribution-Free Rates in Neyman-Pearson Classification](https://mlsanity.com/paper/2402.09560/) (2024)
- [Neyman-Pearson Classification under Both Null and Alternative Distributions Shift](https://mlsanity.com/paper/2511.06641/) (2025)
- [Is this IoT Device Likely to be Secure? Risk Score Prediction for IoT Devices Using Gradient Boosting Machines](https://mlsanity.com/paper/2111.11874/) (2021)
- [Unsupervised anomalies detection in IIoT edge devices networks using federated learning](https://mlsanity.com/paper/2308.12175/) (2023)
- [Spatially-resolved hyperlocal weather prediction and anomaly detection using IoT sensor networks and machine learning techniques](https://mlsanity.com/paper/2310.11001/) (2023)

## Abstract (arXiv)

The widespread adoption of Internet of Things has led to many security issues. Post the Mirai-based DDoS attack in 2016 which compromised IoT devices, a host of new malware using Mirai's leaked source code and targeting IoT devices have cropped up, e.g. Satori, Reaper, Amnesia, Masuta etc. These malware exploit software vulnerabilities to infect IoT devices instead of open TELNET ports (like Mirai) making them more difficult to block using existing solutions such as firewalls. In this research, we present EDIMA, a distributed modular solution which can be used towards the detection of IoT malware network activity in large-scale networks (e.g. ISP, enterprise networks) during the scanning/infecting phase rather than during an attack. EDIMA employs machine learning algorithms for edge devices' traffic classification, a packet traffic feature vector database, a policy module and an optional packet sub-sampling module. We evaluate the classification performance of EDIMA through testbed experiments and present the results obtained.