Poster: Flexible Function Estimation of IoT Malware Using Graph Embedding Technique
K Oshio, S Takada, C Han, A Tanaka… - … IEEE Symposium on …, 2022 - ieeexplore.ieee.org
K Oshio, S Takada, C Han, A Tanaka, J Takeuchi
2022 IEEE Symposium on Computers and Communications (ISCC), 2022•ieeexplore.ieee.orgMost IoT malware is variants generated by editing and reusing parts of the functions based
on publicly available source codes. In our previous study, we proposed a method to estimate
the functions of a specimen using the Function Call Sequence Graph (FCSG), which is a
directed graph of execution sequence of function calls. In the FCSG-based method, the
subgraph corresponding to a malware functionality is manually created and called a
signature-FSCG. The specimens with the signature-FSCG are expected to have the …
on publicly available source codes. In our previous study, we proposed a method to estimate
the functions of a specimen using the Function Call Sequence Graph (FCSG), which is a
directed graph of execution sequence of function calls. In the FCSG-based method, the
subgraph corresponding to a malware functionality is manually created and called a
signature-FSCG. The specimens with the signature-FSCG are expected to have the …
Most IoT malware is variants generated by editing and reusing parts of the functions based on publicly available source codes. In our previous study, we proposed a method to estimate the functions of a specimen using the Function Call Sequence Graph (FCSG), which is a directed graph of execution sequence of function calls. In the FCSG-based method, the subgraph corresponding to a malware functionality is manually created and called a signature-FSCG. The specimens with the signature-FSCG are expected to have the corresponding functionality. However, this method cannot detect the specimens with a slightly different subgraph from the signature-FSCG. This paper found that these specimens were supposed to have the same functionality for a signature-FSCG. These specimens need more flexible signature matching, and we propose a graph embedding technique to realize it.
ieeexplore.ieee.org