Machine Learning-based Detection of IoT Malware using System Call Data

The popularity of IoT has raised many security concerns. Multiple devices with new and improved features are introduced into the market every year, expanding the IoT attack surface. The number of emerging malware variants are also increasing along with the use of anti-detection mechanisms such as packing and obfuscation. The cyber security community has proposed multiple solutions, but the platform heterogeneity of IoT devices poses a unique challenge. Most studies use a static analysis approach for malware detection. However, this approach is not effective for the detection of packed and obfuscated malware. A few studies use a dynamic analysis approach, but they do not address the multi-architecture nature of IoT devices. The main contribution of this research is to present a machine learning model that can detect rapidly evolving, packed or obfuscated malware that targets MIPS, ARM, and x86 IoT devices. We compile our own dataset by dynamically analysing 524 malware samples and 524 benign samples for various IoT architectures. The extracted system call data is pre-processed and used to evaluate the performance of five machine learning models through cross validation. The best results are achieved using Multi-Layer Perceptron (MLP) with a detection accuracy of 98.57% and a training time of 1.34 s.