The Tangled Genealogy of IoT Malware - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

The Tangled Genealogy of IoT Malware

Pierre-Antoine Vervier
  • Fonction : Auteur
Matteo Dell'Amico
  • Fonction : Auteur
Yun Shen
  • Fonction : Auteur
Leyla Bilge
  • Fonction : Auteur

Résumé

The recent emergence of consumer off-the-shelf embedded (IoT) devices and the rise of large-scale IoT botnets has dramatically increased the volume and sophistication of Linux malware observed in the wild. The security community has put a lot of effort to document these threats but analysts mostly rely on manual work, which makes it difficult to scale and hard to regularly maintain. Moreover, the vast amount of code reuse that characterizes IoT malware calls for an automated approach to detect similarities and identify the phylogenetic tree of each family. In this paper we present the largest measurement of IoT malware to date. We systematically reconstruct-through the use of binary code similarity-the lineage of IoT malware families, and track their relationships, evolution, and variants. We apply our technique on a dataset of more than 93k samples submitted to VirusTotal over a period of 3.5 years. We discuss the findings of our analysis and present several case studies to highlight the tangled relationships of IoT malware. CCS CONCEPTS • Security and privacy → Software and application security; Malware and its mitigation.
Fichier non déposé

Dates et versions

hal-04093093 , version 1 (01-06-2023)

Identifiants

Citer

Emanuele Cozzi, Pierre-Antoine Vervier, Matteo Dell'Amico, Yun Shen, Leyla Bilge, et al.. The Tangled Genealogy of IoT Malware. ACSAC 2020, Annual Computer Security Applications Conference, 7-11 December 2020, Dec 2020, Austin, United States. pp.1-16, ⟨10.1145/3427228.3427256⟩. ⟨hal-04093093⟩

Collections

EURECOM
11 Consultations
3 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More