Graph-Based Classification of IoT Malware Families Enhanced by Fuzzy Hashing
摘要
The proliferation of Internet of Things (IoT) devices has led to an increase in IoT malware, posing a significant cybersecurity threat. Detecting and mitigating this threat is challenging due to the diverse CPU architectures in IoT malware families and the limited resources of IoT devices. Specialized detection methods are needed to identify malware across different platforms, while lightweight mechanisms are required to minimize resource strain. This paper introduces a novel graph-based framework, Aggregated Weighted Graph of Hashes (AWGH), to tackle the CPU diversity challenge. The framework leverages Function Call Graphs (FCGs) and fuzzy hashing to capture the structural and code characteristics of IoT malware. By utilizing static analysis techniques, the framework can efficiently group new malware samples and identify similarities with existing families, even in the case of unknown malware to mitigate potential risks before they cause significant damage. FCGs are generated using IDA Pro [1], and fuzzy hashes are calculated using ssdeep [2]. The framework is implemented in Python and evaluated using a dataset from VirusTotal [3] through 10-fold cross-validation. The experimental results demonstrate the effectiveness of the proposed framework in accurately classifying the IoT malware into IoT malware families across various CPU architectures (MIPS, ARM, i386, PowerPC, and AMD64).