View : 479 Download: 0
Understanding Internet of Things malware by analyzing endpoints in their static artifacts
- Title
- Understanding Internet of Things malware by analyzing endpoints in their static artifacts
- Authors
- Choi J.; Anwar A.; Alabduljabbar A.; Alasmary H.; Spaulding J.; Wang A.; Chen S.; Nyang D.; Awad A.; Mohaisen D.
- Ewha Authors
- 양대헌
- SCOPUS Author ID
- 양대헌
- Issue Date
- 2022
- Journal Title
- Computer Networks
- ISSN
- 1389-1286
- Citation
- Computer Networks vol. 206
- Keywords
- Endpoints; Internet of Things; Malware
- Publisher
- Elsevier B.V.
- Indexed
- SCIE; SCOPUS
- Document Type
- Article
- Abstract
- The lack of security measures among the Internet of Things (IoT) devices and their persistent online connection gives adversaries a prime opportunity to target them or even abuse them as intermediary targets in larger attacks such as distributed denial-of-service (DDoS) campaigns. In this paper, we analyze IoT malware and focus on the endpoints reachable on the public Internet, that play an essential part in the IoT malware ecosystem. Namely, we analyze endpoints acting as dropzones and their targets to gain insights into the underlying dynamics in this ecosystem, such as the affinity between the dropzones and their target IP addresses, and the different patterns among endpoints. Towards this goal, we reverse-engineer 2423 IoT malware samples and extract strings from them to obtain IP addresses. We further gather information about these endpoints from public Internet-wide scanners, such as Shodan and Censys. Our results, through analysis and visualization expose clear patterns of affinity between sources and targets of attacks, attack exposure by Internet infrastructure, and clear depiction of the ecosystem of IoT malware as a whole, only utilizing static artifacts. Our investigation from four different perspectives provides profound insights into the role of endpoints in IoT malware attacks, which deepens our understanding of IoT malware ecosystems and can assist future defenses. © 2022
- DOI
- 10.1016/j.comnet.2022.108768
- Appears in Collections:
- 인공지능대학 > 사이버보안학과 > Journal papers
- Files in This Item:
There are no files associated with this item.
- Export
- RIS (EndNote)
- XLS (Excel)
- XML