No abstract

The simple implementation and monotonous operation features make Internet of Things (IoT) vulnerable to malware attacks. In order to understand the behavior of IoT malware for further mitigation and prevention, static analysis on executable files of IoT malware is a feasible approach. However, current analysis approaches based on opcode or call-graph usually do not work well with the diversity in CPU architectures and are often resource demanding. In this paper, we propose an efficient scheme to detect and classify IoT malware programs leveraging machine learning methods. We show that reliable and efficient detection and classification can be implemented by exploring the essential discriminant information stored in the byte sequences at the entry points of executable programs. We demonstrate the performance of the proposed scheme using a large scale dataset composed of 111K benignware and 111K malware programs from 7 CPU architectures. The proposed scheme achieves near optimal generalization performance for malware detection (99.9% in accuracy) and for malware family classification (98.4% in accuracy). Moreover, when the CPU architecture information is considered in the learning, the proposed scheme combined with SVM classifiers can yield even higher generalization performance using fewer bytes from the executable files. The findings in this paper is promising for implementing a lightweight malware protection solution on IoT devices with limited resources.

No abstract