Paper Abstract and Keywords |
Presentation |
2018-11-22 14:20
Part II: Calculating Similarity between IoT Malware over CPU Architectures Ryoichi Isawa, Tao Ban (NICT), Katsunari Yoshioka (YNU/NICT), Daisuke Inoue (NICT) ICSS2018-66 |
Abstract |
(in Japanese) |
(See Japanese page) |
(in English) |
At the ICSS workshop held in June, 2018, we proposed a method for calculating
similarity between IoT malware samples over CPU architectures, based on their
binaries. The binaries whose CPU architectures differ from each other consist of different types of instructions, which means it is difficult to calculate their similarity scores based on their binaries. To tackle this problem, our method first converts the binaries into instructions of IR (Intermediate Representation), and then it calculates the similarity based on those converted instructions of binaries. Our method can be effective; however, we evaluated effectiveness of our method with just 12 malware samples. In this paper, we show experiments using 945 IoT malware samples, which were categorized into three malware families. The experiments confirmed that our method produced an accuracy of 0.70 against 945 IoT malware samples, and we sense our method captures some features shared between IoT malware samples for good classification of malware. |
Keyword |
(in Japanese) |
(See Japanese page) |
(in English) |
Internet of Things / Malware analysis / Intermediate representation / N-gram / Jaccard similarity / / / |
Reference Info. |
IEICE Tech. Rep., vol. 118, no. 315, ICSS2018-66, pp. 73-78, Nov. 2018. |
Paper # |
ICSS2018-66 |
Date of Issue |
2018-11-14 (ICSS) |
ISSN |
Online edition: ISSN 2432-6380 |
Copyright and reproduction |
All rights are reserved and no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher. Notwithstanding, instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. (License No.: 10GA0019/12GB0052/13GB0056/17GB0034/18GB0034) |
Download PDF |
ICSS2018-66 |
|