This section defines the future Internet and discusses the case studies that are currently underway in the United States, Europe, Japan, and other countries.

The future Internet refers to the Internet itself as being one large smart computer. Different service networks are connected to each other to provide services to meet user needs. For convergence, smart services to be provided in an Internet environment; quality improvement of the service environment, such as cloud computing, smart media, personalization, virtual services, convergence of wired and wireless, the Internet of things, and strengthened information security are discussed [7].

This section discusses the technologies for analyzing and detecting malicious codes. Analysis methods can be categorized into static analysis and dynamic analysis. By analyzing malicious codes, the information they seek to acquire, their targets, the operation process within the system, the purpose of these codes, and their dissemination channel can be identified. Later this information can help to better address issues of the same malicious code and its mutants [12].

Static analysis does not implement the program and is used to verify the characteristics of dynamic execution by analyzing the code of the program. That is, by analyzing the correlation or calling relationship of malicious codes’ components, the overall structure and flow of the malicious code are analyzed. Since static analysis does not directly execute the malicious code, it is secure and is not limited to certain execution conditions when analyzing the structure and operation flow. However, automation is difficult and it requires much effort and time. In addition, if binary files are packed by methods such as encryption analysis is difficult [13,14].

Dynamic analysis examines the content that is carried out when the malicious code is actually executed. It is a way to analyze in real time the registry generation and revision in the emulator or the virtual machine, network usage behavior, and Application Programming Interface (API) calling dynamic analysis allows for conducting a relatively accurate analysis of malicious behavior, but when certain environments or conditions are not met, the analysis of the function of malicious codes can be difficult and only a handful of execution pathways among numerous pathways can be analyzed [12,15,16].

The host-behavior-based malicious code detection method observes the behavior occurring within the system to detect files that are suspected of having a malicious code. By monitoring the execution of programs, such as dynamic analysis tools and sandbox, the analysis methods are included in the host-behavior-based detection methods. Unlike the traditional signature-based malicious code detection method, this allows for the detection of a malicious code that is newly emerging and that takes a detour around the detection method. However, there is the possibility of a false-positive where normal files are mistaken for being malicious codes [17].

The network-behavior-based malicious code detection method monitors the network packet and sees traffic that derails from the already defined rule set or normal behavior as an attack. This technology enables real-time packet processing and the detection of transformed attacks in real time. It also learns to distinguish between normal and abnormal behaviors. However, thus far, this detection rate is low, making the false-positive rate very high [18].

This section discusses the various malicious code and authentication issues that pose a threat to the current Internet. However, these issues can also appear as a threat in future Internet. These threats are discussed by each issue.

The most widely used user authentication method is an ID and password system. But as users have an increasing number of IDs and passwords, they experience difficulty in memorizing all of them. Various technical methods are emerging to address this issue even in the existing Internet environment. However, to provide information security that lives up to the standards of the future Internet, such simple authentication methods fall short. A new user authentication mechanism is required. Also, threats from malicious codes will continue to increase in the future. In recent years, hackers have been interested in monetary gain. The attacks that are most commonly used in such crimes rely on malicious codes [19]. Moreover, Internet fraud is also going beyond simply using personal information and is reaching a very sophisticated level by turning to automated mechanisms. By snatching the packet that is transmitted over the network, they pose security threats, such as spam or service denial attacks. Moreover, since the original address of the packet can be disguised, the security threat levels are very high. Mechanisms to address these issues will also be in demand in the future Internet.

One of the most basic Internet services today is Domain Name Service (DNS), but it is still not secure. In the future Internet, a new protocol to replace this or a mechanism that strengthens DNS against security threats would have to be provided. One of the leading devices to be used in the future Internet is the smartphone. In particular, smartphones not only support the basic functions of serving as a phone and access to wireless Internet, they also provide various functions in a mobile environment [20]. However, all of the security threats that can occur on a PC can also occur on smartphones. Moreover, important personal information is stored on smartphones and an open development environment means that the production and dissemination of malicious codes can easily occur [21]. Therefore, in the future Internet environment, mechanisms and security methods to prevent such issues are required.

The future Internet is operated by important systems and networks. The importance of the system is greater than the security threat. Therefore, security threats posed against systems also need to be considered in the future Internet. One of the ways to address security threats in the future Internet is to apply an authentication method to all of the protocols that will be used.

This section describes the threat factors related to the future Internet and security requirements for information protection, as mentioned in Subsection 2.3.

Wang and Wang [22] developed an automatic malware detection system that is based on behavior signatures to use the Support Vector Machine (SVM) categorizer. The cross validation scheme was used to resolve the accuracy issue by using 60 malwares. Their proposed system consists of three modules of system backup, system monitoring, and system recovery. System backup offers backups for important files in the client and server. System monitoring restores the operating system and user data using the previous backup data. The system restoration module uses reversing engineering technology to restore the process infected by malicious software.

Dewan et al. [23] proposed a model that detects malicious email using social information. In this model, various machine-learning algorithms are applied to combine information that can be gained from the profiles of social services or from the title, contents, or attached file of the email. This research concluded that recognizing a malicious email via LinkedIn was not helpful, but it is meaningful in that it was one of the first attempts to detect malicious email by combining characteristics of email and social media.

Mohaisen et al. [24] proposed a labeling system that resolved the existing shortcomings and malware software analysis based on automated behavior called AMAL. AMAL consists of the two sub-systems of AutoMal and MaLabel. AutoMal is a tool that can collect the behavior artifacts of memory, the network, registry, and file system. MaLabel generates a feature using the collected artifact, and based on the learned data categorizes the data.

Nissim et al. [25] proposed a new machine learning method designed to acquire a malware framework based on exploitation and combination. It uses a static analysis method to express the benign and malicious execution files by taking the idea from text categorization.

Alam et al. [26] proposed a framework that allows for the real-time generation of a behavior signature and the detection of metamorphic malware. They proposed a new technology called an Annotated Control Flow Graph (ACFG) and Sliding Window of Difference and Control Flow Weight (SWOD-CFWeight). Unlike other technologies, ACFG offers a quick comparison of CFG without changing detection accuracy. SWOD-CFWeight eases current issues related to the changes of the opcodes’ cycle, such as the use of other compilers, the optimization of compilers, and code obfuscation. The proposed framework improves the detection time to optimize the malware detection time.

Our proposed HB-DIPM consists of a future Internet time synchronizer, host-based behavior monitor, network-based behavior monitor, analyzer, inspector, authenticator, audit trailer, logger, and DB, as shown in Fig. 1.

It monitors authority, file, services, registry, process, and network information. The collected information is analyzed statically or dynamically. In addition, the degree of risk is categorized and blocks are carried out based on the analyzed information. At the same time, an alarm is triggered by the user. The proposed HB-DIPM is categorized into three layers of security, core technology, and service.

The service layer creates an environment where various services can be provided, such as data-oriented services, situation recognition services, automated services, service overlay, and service control. Such services can only be used by authorized users.

The security layer is where security technologies for highly reliable and secure future Internet services are used. By linking with human behavior-based technologies, services are provided. The future Internet time synchronizer module synchronizes time with other modules to offer reliability to the log data. The analyzer consists of a behavior analyzer, static analyzer, and dynamic analyzer, in addition to an alert function. Static analysis includes analysis via the file’s signature and hash value, while dynamic analysis include sandbox or hash value analysis. This module is where secondary analysis on the file and traffic takes place. Once analysis is complete, the information is sent to the DB. The host-based behavior monitor includes the following functions: the process monitor manages malicious behavior in the process; the register monitor monitors change by managing malicious behavior on the registry; the file monitor manages malicious behavior to observe changes in the file; and the service monitor manages malicious behavior in the service process and monitors change. The network-based behavior monitor exists in the behavior layer and carries out the following functions: the session monitor manages the sessions generated in the network; the IP monitor manages the information on the departure point and destination point of the IP address; the protocol monitor constantly oversees the information about unknown protocols; and the payload monitor manages the information that is sent out through the network. The inspector monitors the user’s activities and collects the artifacts of authority, files, processes, and network. The collector gathers information on system malware. The analyzer analyzes the file forwarded from sub-components, processes, memory, authentication, and malware information on a comprehensive level. Dynamic analysis analyzes behavior, while static analysis analyzes based on the artifacts of authority, file, processes, and the network. The authenticator is a component that is in charge of the authentication of the file and process. It handles the authentication information and access information and takes care of the authentication of the protocol. The database stores the collected data and the analysis information and results to provide them during monitoring and tracking. The audit trailer is a module that monitors and tracks the system’s activity or issues using the DB information. The logger independently records the information on the execution or stopping of the service model.

Core technology is the layer where various technologies are linked to provide services. Future routing technology, the separation of the ID/locator, wireless transmission technology, the dynamic light pathway, and hybrid switching are such examples.

This section discusses the operation procedure and service scenarios in HB-DIPM. Fig. 2 is a dynamic procedure where the user’s activity is collected and constantly monitored. When malware is detected, a secondary test is conducted through dynamic and static analysis. The inspector does testing and analysis and the findings are stored in the DB. If malware is detected, it is immediately blocked. If it is not malware, authentication is carried out to check whether it has approved access or not. Unauthorized access is blocked, while authorized accesses are offered normal services.

The marking used in the proposed service scenario is as shown in Table 1, and Fig. 3 shows the service scenario.

The DB has the information on all protocols. The analyzer reports the protocol authentication information to the authenticator. It then receives whether the authentication was a success or not. Information on each activity is stored in the DB. Inquiries for auditing and monitoring are sent to the DB, and the response to this is received. LOG exists independently of the DB and stores the activity information of all modules.

In this section, we analyze the HB-DIPM by comparing it with other existing studies based on the major components of security requirements, as discussed in Section 2.

Table 2 shows the comparison among the exiting researches and our HB-DIPM. The method used in [22,26] is a way to detect malware and is excellent in preventing execution, but it falls short in terms of integrity and usability studies [23,24]. If the malware is designed to not operate in a specific environment, that is, in a virtualized environment, it is difficult to acquire quality analysis information, and, thus, reliability is hard to secure. The research in [25,26] are excellent in detecting or preventing the intrusion of malware, malware execution, and redirection, but integrity and usability are not considered and are limited in securing reliability. Only using social information to analyze is not enough to prevent already known intrusions. By preventing a malicious act over an existing static or dynamic analysis detection method, the proposed HB-DIPM provides confidentiality. In addition, accuracy is strong while dealing with host-based behavior-monitoring; monitoring network-based actions; user-selected service; and usage patterns, such as the number of times; and can perform detection and response comparisons. It also includes monitoring and certification management, which can guarantee integrity. It has credibility through audit trails and by logging information independent of management can also ensure the availability of the DB failure in targeted attacks via a separate configuration DB.