Detecting Internet-of-Things Malware on Evidence Generation

Malware has been a real threat to Internet-of-Things (IoT). Although commercial antivirus solutions can detect malware files and provide label information indicating malware types or families, no clear evidence explaining the detection is provided. Therefore, even security experts using antivirus solutions do not know why some files are reported malicious and they hesitate to take an immediate action. In this paper, we study this problem from the viewpoint of antivirus solution users instead of product developers or sellers. We present a new data-driven scheme that can automatically generate a set of readable common strings from IoT malware files as a detection evidence. These generated string signatures not only provide a clear detection evidence for suspicious files but can also be used as unique high-precision detection criteria. The new data-driven scheme divides any long evasive string embedded in malware files into short n-grams to mitigate detection evasion, and a limited number of n-grams are selected as representative n-grams on a bipartite graph that improves the efficiency and accuracy of clustering. A set of n-grams per cluster, which plays the role of a unique detection evidence, is generated. Through experiments with real malware datasets, including public datasets for experimental reproducibility, we confirm that the new data-driven scheme not only detects malware files as accurately as the current state-of-the-art(SOTA), especially no benign files mistakenly considered as malicious, but also provides readable strings as a detection evidence, which has not been achieved by previous work.