An Integrated Architecture for IoT Malware Analysis and Detection

Zhongjin Liu; Le Zhang; Qiuying Ni; Juntai Chen; Ru Wang; Ye Li; Yueying He

IoT as a Service. 4th EAI International Conference, IoTaaS 2018, Xi’an, China, November 17–18, 2018, Proceedings

Research Article

An Integrated Architecture for IoT Malware Analysis and Detection

Download

534 downloads

Cite: BibTeX Plain Text

@INPROCEEDINGS{10.1007/978-3-030-14657-3_14,
    author={Zhongjin Liu and Le Zhang and Qiuying Ni and Juntai Chen and Ru Wang and Ye Li and Yueying He},
    title={An Integrated Architecture for IoT Malware Analysis and Detection},
    proceedings={IoT as a Service. 4th EAI International Conference, IoTaaS 2018, Xi’an, China, November 17--18, 2018, Proceedings},
    proceedings_a={IOTAAS},
    year={2019},
    month={3},
    keywords={IoT malware Behavior analysis Mirai Architecture},
    doi={10.1007/978-3-030-14657-3_14}
}

Zhongjin Liu
Le Zhang
Qiuying Ni
Juntai Chen
Ru Wang
Ye Li
Yueying He
Year: 2019
An Integrated Architecture for IoT Malware Analysis and Detection
IOTAAS
Springer
DOI: 10.1007/978-3-030-14657-3_14

Zhongjin Liu¹^,*, Le Zhang², Qiuying Ni², Juntai Chen², Ru Wang², Ye Li³, Yueying He¹

1: National Computer Network Emergency Response Technical Team/Coordination Center of China
2: Beijing University of Posts and Telecommunications
3: Beihang University

*Contact email: lzj@cert.org.cn

Abstract

Along with the rapid development of the IoT, the security issue of the IoT devices has also been greatly challenged. The variants of the IoT malware are constantly emerging. However, there is lacking of an IoT malware analysis architecture to extract and detect the malware behaviors. This paper addresses the problem and propose an IoT behavior analysis and detection architecture. We integrate the static and dynamic behavior analysis and network traffic analysis to understand and evaluate the IoT malware’s behaviors and spread range. The experiment on Mirai malware and several variants shows that the architecture is comprehensive and effective for the IoT malware behavior analysis as well as spread range monitoring.

Keywords: IoT malware Behavior analysis Mirai Architecture

Published: 2019-03-07
Appears in: SpringerLink

: http://dx.doi.org/10.1007/978-3-030-14657-3_14