Abstract:Simple implementation and autonomous operation features make the Internet-of-Things (IoT) vulnerable to malware attacks. Static analysis of IoT malware executable files is a feasible approach to understanding the behavior of IoT malware for mitigation and prevention. However, current analytic approaches based on opcodes or call graphs typically do not work well with diversity in central processing unit (CPU) architectures and are often resource intensive. In this paper, we propose an efficient method for leveraging machine learning methods to detect and classify IoT malware programs. We show that reliable and efficient detection and classification can be achieved by exploring the essential discriminating information stored in the byte sequences at the entry points of executable programs. We demonstrate the performance of the proposed method using a large-scale dataset consisting of 111K benignware and 111K malware programs from seven CPU architectures. The proposed method achieves near optimal generalization performance for malware detection (99.96 accuracy) and for malware family classification (98.47 accuracy). Moreover, when CPU architecture information is considered in learning, the proposed method combined with support vector machine classifiers can yield even higher generalization performance using fewer bytes from the executable files. The findings in this paper are promising for implementing light-weight malware protection on IoT devices with limited resources.

Detecting Encryption Functions Via Process Emulation and IL-based Program Analysis

Automatic Detection And Analysis Of Encrypted Messages In Malware

FMDiv: Functional Module Division on Binary Malware for Accurate Malicious Code Localization.

Eliminate Evading Analysis Tricks In Malware Using Dynamic Slicing

Dynamic Analysis of Malicious Code

Detection And Analysis Of Cryptographic Data Inside Software

Detective: Automatically Identify and Analyze Malware Processes in Forensic Scenarios Via DLLs

Malicious cryptography techniques for unreversable (malicious or not) binaries

Dynamic Emulation Based Modeling and Detection of Polymorphic Shellcode at the Network Level.

Dynamic Detection of Unknown Malicious Executables Base on API Interception

Identification Method of Malicious Software Hidden Function Based on Siamese Architecture

Detecting Malware Variants Via Function-Call Graph Similarity

A Novel Approach to Detect Malware Based on API Call Sequence Analysis

Component Similarity Based Methods for Automatic Analysis of Malicious Executables

Method of Malware Behavior Analysis in Disassembly Level

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

ENDMal: An anti-obfuscation and collaborative malware detection system using syscall sequences.

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

Precise system-wide concatic malware unpacking

An Automatic Approach to Detect Anti-debugging in Malware Analysis

APPROACH FOR DETECTING ANTI-ANALYSIS MALWARE