A survey of IoT malware and detection methods based on static features

Ngo, Quoc-Dung; Nguyen, Huy-Trung; Le, Van-Hoang; Nguyen, Doan-Hieu

doi:10.1016/j.icte.2020.04.005

Cited by 162 publications

(55 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Ngo et al [22] claimed that the static analysis method has more ability than dynamic methods in analyzing malware structure without the need to consider processor architecture. Figure 4 provides a sample basic information that can be obtained using Linux 'file' command.…”

Section: E Malware Threat Hunting Approachesmentioning

confidence: 99%

“…Content may change prior to final publication. the dataset they released publicly had been used by various studies such as [18], [22], [40], [36], [30], [78]. Some studies focus on a specific IoT malware family for dissection and analysis [28], such as Antonakakis et al [96], where they performed analysis on the advent of the Mirai botnet over seven months period, the evolution of variants of Mirai, and the DDoS affected victim devices.…”

Section: Related Workmentioning

confidence: 99%

“…The survey work by Ngo et al [22] is the closest work, where the main theme of their survey was to cover static features-based ML approaches for IoT malware detection, including only three cross-architectural works, whereas we cover more than fifteen recent cross-architectural works. They employed a dataset with 7K malwares and 4K benign files to compare the approaches studied.…”

Section: B Surveys On Cross-architectural Iot Malware Threat Huntingmentioning

confidence: 99%

“…There are few valuable survey works that exist on IoT malwares, such as [22] for static analysis and [23] for dynamic analysis. The purpose of this survey is to complement the existing works as well as provide insights into the critical crossarchitectural dimension covering the latest developments.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Survey on Cross-Architectural IoT Malware Threat Hunting

et al. 2021

View full text Add to dashboard Cite

In recent years, the increase in non-Windows malware threats had turned the focus of the cybersecurity community. Research works on hunting Windows PE-based malwares are maturing, whereas the developments on Linux malware threat hunting are relatively scarce. With the advent of the Internet of Things (IoT) era, smart devices that are getting integrated into human life have become a hackers' highway for their malicious activities. The IoT devices employ various Unix-based architectures that follow ELF (Executable and Linkable Format) as their standard binary file specification. This study aims at providing a comprehensive survey on the latest developments in cross-architectural IoT malware detection and classification approaches. Aided by a modern taxonomy, we discuss the feature representations, feature extraction techniques, and machine learning models employed in the surveyed works. We further provide more insights on the practical challenges involved in cross-architectural IoT malware threat hunting and discuss various avenues to instill potential future research.

show abstract

Section: E Malware Threat Hunting Approachesmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: B Surveys On Cross-architectural Iot Malware Threat Huntingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Survey on Cross-Architectural IoT Malware Threat Hunting

et al. 2021

View full text Add to dashboard Cite

show abstract

“…As a result, assorted existing researches put focus on more efficient approaches based on static analysis, e.g., reverse engineering the binary programs of IoT malware [9]. In related work [10,11,12], experiment results with high detection rates are obtained by exploring the operation codes (opcodes) and control flow graphs (CFG) of the IoT malware.…”

Section: Introductionmentioning

confidence: 99%

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

Wan

Ban

Cheng

et al. 2020

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

The simple implementation and monotonous operation features make Internet of Things (IoT) vulnerable to malware attacks. In order to understand the behavior of IoT malware for further mitigation and prevention, static analysis on executable files of IoT malware is a feasible approach. However, current analysis approaches based on opcode or call-graph usually do not work well with the diversity in CPU architectures and are often resource demanding. In this paper, we propose an efficient scheme to detect and classify IoT malware programs leveraging machine learning methods. We show that reliable and efficient detection and classification can be implemented by exploring the essential discriminant information stored in the byte sequences at the entry points of executable programs. We demonstrate the performance of the proposed scheme using a large scale dataset composed of 111K benignware and 111K malware programs from 7 CPU architectures. The proposed scheme achieves near optimal generalization performance for malware detection (99.9% in accuracy) and for malware family classification (98.4% in accuracy). Moreover, when the CPU architecture information is considered in the learning, the proposed scheme combined with SVM classifiers can yield even higher generalization performance using fewer bytes from the executable files. The findings in this paper is promising for implementing a lightweight malware protection solution on IoT devices with limited resources.

show abstract

A comprehensive survey on secure software‐defined network for the Internet of Things

Mohamed

Alofe

Azad

et al. 2021

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The Internet of Things (IoT) is the network of smart devices, sensors, and machines that continuously monitored the surrounding environment and execute meaningful decisions on the data or information it receives. The Internet-enabled devices could facilitate computer-mediated strategies for various tasks, for example, smart health care, managing the cities or smart factories, smart manufacturing, automating the home and business, etc. IoT commonly uses Internet technology for establishing communication among devices, thus inherits all the security threats that are currently affecting Internet users along with other security threats that are specific to IoTs due to resources constrained nature of the smart devices and sensors. The greater footprint, the distributed nature of the network and the existence of a huge number of IoT devices has also attracted criminals, fraudsters, and attackers to utilize this medium for spreading malicious content or making devices unavailable for legitimate use.It is imperative to ensure that the Confidentiality, Integrity, Security, and Privacy of information and users should remain intact while using these devices and thus they require an effective security system. Software-defined Networks (SDN) and Network Function are the way to control and configure devices from a centralized location and have been proven to offer scalability and versatility to their deployed ecosystems. In this paper, we systematically review the adoption of SDN and Network Function Virtualization (NFV) for securing the IoT network from emerging threats. To this extent, we provide a comprehensive survey on security solutions based on SDN, Blockchain, NFV, and SDN/NFV proposed for the security of the IoT network. We have also identified open challenges in this domain which includes lack of standardization, low cost, and effective machine learning systems for identifying malicious traffic and handling great attack surface and different attack vectors. The deployed technologies exhibit positive strides in their usage for the provision of security in IoT environments offering security enhancements, scalability, and versatility.

show abstract

A survey of IoT malware and detection methods based on static features

Cited by 162 publications

References 11 publications

A Survey on Cross-Architectural IoT Malware Threat Hunting

A Survey on Cross-Architectural IoT Malware Threat Hunting

Efficient Detection and Classification of Internet-of-Things Malware Based on Byte Sequences from Executable Files

A comprehensive survey on secure software‐defined network for the Internet of Things

Contact Info

Product

Resources

About