# VPNFilter Malware Analysis on Cyber Threat in Smart Home Network
## Open Issues, Challenges, and Solutions
### Proposed Solution  
The proposed Intrusion Detection System (IDS) by [PERSON] et al. analyzes packets and detects DDoS attacks in SDN switches using machine learning to predict the incoming traffic on the network [76]. The proposed IDS categorizes the network traffic, and it can be integrated into the IoT network. For anomaly detection using deep learning [77], none of them focus on Intrusion Detection aand Prevention System (IDPS) for protecting the edge router on smart home devices. Therefore, we propose a solution that will help handle not only VNPfilter, but also other different types of malware attacks such as DOS and DDoS on the edge router. Specifically, we design a framework for IDPS for a secure smart home system-based machine learning environment, which is presented in this section. Considering the malware attack challenges, in addition to the abovementioned cyber threats, we believe that, in future smart homes, threats related to the VPNfilter can pose dangers on the life of the inhabitants. If the devices are infected, it is important to defend against this malware attack through the following: first, reset the router to its original factory settings, and it is also important to upgrade the router's firmware, which can be found on the manufacturer's website and is also known as one of the critical weak points on smart home devices; disable remote management and change the router login and password data for security because many devices come shipped with a default set password. Smart home technology is applied in many fields. Therefore, we propose a strong framework, illustrated in Figure 6, which can help handle this VPNfilter malware for security system using network-based intrusion detection system (IDS) that allows monitoring traffic for attacks and intrusion prevention system (IPS) for securing the smart home using a machine learning algorithm to detect abnormal behaviors and attacks as early as possible and mitigate them as appropriate. Our proposed idea involves securing many core aspects of the smart home architecture by avoiding anomalies; therefore, we propose an IDPS-based machine learning algorithm to predict and detect the anomaly. * The intrusion detection system is known as a device or a software application that automates the process of monitoring the event over the network or activities system for malicious activities. It helps analyze them for security problems. In case of a network attack, security has to be increased [78]. IDS will help detect possible intrusions, especially malware attacks on the network, such as VPNfilter, DOS, DDoS, and others. IDS is helpful for network operators in taking appropriate actions before an attack is launched on the system. Figure 6: Smart home architecture with IDPS-based machine learning. * Intrusion prevention system is a passive system that scans incoming traffic. Once IDS identifies suspicious traffic, it can send an alert to IPS because it has the ability to block or prevent intrusions actively. IPS uses a preexisting database for signature recognition, and it can be programmed to detect attacks based on traffic and behavioral anomalies. IDPS is a combination of two system forms, intrusion detection and intrusion prevention, for a more robust mechanism. Below are the key components of the IDPS framework:
* Data collection is one of the important tools for designing machine learning and is considered to be the process of gathering information and measuring from countless different sources over the network. Data gathering within the network system will allow capturing a record of a past event if a hacker sends a malware packet and using data analysis to find recurring patterns by using machine learning algorithms organized in the form of dataset. As an example, we can use knowledge discovery databases (KDD), CSV, and others. * Data processing is a data mining technique that involves transforming raw data into an understandable format before feeding it to the algorithm. The preprocessing phase starts as soon as data is collected over the network.