A Survey on Cross-Architectural IoT Malware Threat Hunting

Abstract

In recent years, the increase in non-Windows malware threats had turned the focus of the cybersecurity community. Research works on hunting Windows PE-based malwares are maturing, whereas the developments on Linux malware threat hunting are relatively scarce. With the advent of the Internet of Things (IoT) era, smart devices that are getting integrated into human life have become a hackers highway for their malicious activities. The IoT devices employ various Unix-based architectures that follow ELF (Executable and Linkable Format) as their standard binary file specification. This study aims at providing a comprehensive survey on the latest developments in cross-architectural IoT malware detection and classification approaches. Aided by a modern taxonomy, we discuss the feature representations, feature extraction techniques, and machine learning models employed in the surveyed works. We further provide more insights on the practical challenges involved in cross-architectural IoT malware threat hunting and discuss various avenues to instill potential future research.

arXiv commenthttps://ieeexplore.ieee.org/abstract/document/9462110

References in corpus (7)

• Survey of Machine Learning Techniques for Malware Analysis
• EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models
• SOREL-20M: A Large Scale Benchmark Dataset for Malicious PE Detection
• AST-Based Deep Learning for Detecting Malicious PowerShell
• Virus-MNIST: A Benchmark Malware Dataset
• Learning from Context: Exploiting and Interpreting File Path Information for Better Malware Detection
• Echelon: Two-Tier Malware Detection for Raw Executables to Reduce False Alarms