Malware

This is a reading list for those interested in studying Malware. If you have any suggestions, please send a pull request.

Linux Malware

• 2019, IEEE S&P, LBM: A Security Framework for Peripherals within the Linux Kernel
• 2018, IEEE S&P, Understanding Linux Malware
• 2018, Class 9: Adversarial Malware Detection
• 2017, USENIX Security, Understanding the Mirai Botnet
• 2016, Github, Mirai-Source-Code
• 2016, Blog, MMD-0056-2016 - Linux/Mirai, how an old ELF malcode is recycled

IoT Malware

• 2020, S&P, Security Update Labels: Establishing Economic Incentives for Security Patching of IoT Consumer Products
• 2019, arXiv, [HADES-IoT: A Practical Host-Based Anomaly Detection System
• 2019, DSC, Honor Among Thieves: Towards Understanding the Dynamics and Interdependencies in IoT Botnets
• 2019, USENIX CSET, IDAPro for IoT Malware analysis? for IoT Devices (Extended Version)](https://arxiv.org/pdf/1905.01027.pdf)
• 2019, AsiaCCS, HADES-IoT: A Practical Host-Based Anomaly Detection Systemfor IoT Devices
• 2019, NDSS, Measurement and Analysis of Hajime, a Peer-to-peer IoT Botnet
• 2019, NDSS, Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai
• 2018, USENIX, Acquisitional Rule-based Engine for Discovering Internet-of-Thing Devices
• 2018, arXiv, A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security
• 2018, RAID, Before Toasters Rise Up: A View into the Emerging IoT Threat Landscape
• 2018, BlackHat, IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies
• 2018 arXiv AutoBotCatcher: Blockchain-based P2P Botnet Detection for the Internet of Things
• 2017 Milcom The Mirai Botnet and the IoT Zombie Armies
• 2016 RapidityNetworks, Hajime: Analysis of a decentralized internet worm for IoT devices
• Analyzing the Propagation of IoT Botnets from DNS Leakage

Honey Pot

• 2019, MobiSys, Understanding Fileless Attacks on Linux-based IoT Devices with HoneyCloud
• 2018, arXiv, ThingPot: an interactive Internet-of-Things honeypot
• 2017, BlackHat, IoTCandyJar: Towards an Intelligent-Interaction Honeypot for IoT Devices
• 2017, CPSS, SIPHON: Towards Scalable High-Interaction Physical Honeypots
• 2015, WOOT, IoTPOT: Analysing the Rise of IoT Compromises

SandBox

• 2020, S&P, PMP: Cost-effective Forced Execution with Probabilistic Memory Pre-planning
• 2019, LiSa – Multiplatform Linux Sandbox for Analyzing IoT Malware
• 2018, Thesis, Evaluating Open Source Malware Sandboxes with Linux Malware

Attack Graphs

• 2018, TIFS, Using Bayesian Networks for Probabilistic Identification of Zero-Day Attack Paths
• 2018, DBSec, Assessing Attack Impact on Business Processes by Interconnecting Attack Graphs and Entity Dependency Graphs
• 2016, CNS, Towards Probabilistic Identification of Zero-day Attack Paths
• 2013, Journal of Computer Security, Aggregating vulnerability metrics in enterprise networks using attack graphs
• 2013, ESORICS, Patrol: Revealing Zero-Day Attack Paths through Network-Wide System Object Dependencies

Malware Detection

• 2018, arXiv, Malicious Software Detection and Classification utilizing Temporal-Graphs of System-call Group Relations
• 2018, IoT S&P, Combining MUD Policies with SDN for IoT Intrusion Detection
• 2018, IoT S&P, Clear as MUD: Generating, Validating and Applying IoT Behavioral Profiles
• 2018, arXiv, Device-Type-Specific Anomaly detection, DIoT: A Self-learning System for Detecting Compromised IoT Devices
• 2018, IEEE Transactions on Industrial Informatics, Detection of Malicious Code Variants Based on Deep Learning
• 2018, IEEE ACCESS, Malware Visualization for Fine-Grained Classification
• 2015, International Journal of Information Security, Malware analysis using visualized images and entropy graphs
• 2013, ICASSP, LARGE-SCALE MALWARE CLASSIFICATION USING RANDOM PROJECTIONS AND NEURAL NETWORKS

Network Level Detection

• 2018, arXiv, IoT-KEEPER: Securing IoT Communications in Edge Networks

Systems Security

• 2019, S&P, HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows
• 2018, CCS, Tiresias: Predicting Security Events Through Deep Learning
• 2018, CCS, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost
• 2018, NDSS, Towards a Timely Causality Analysis for Enterprise Security
• 2017, Anatomy of an IoT malware attack
• 2014, TIFS, Data-Centric OS Kernel Malware Characterization

Software and Application Security

• 2018, CCS, LEMNA: Explaining Deep Learning based Security Applications
• 2018, CCS, HoMonit: Monitoring Smart Home Apps from Encrypted Traffic
• 2018, IoT S&P, Web-based Attacks to Discover and Control Local IoT Devices

Android Malware

• 2017, RAID, Android malware clustering through malicious payload mining
• 2014, CCS, Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs

Patches

• Automated patch management and the challenges from IoT -- patch challenges.
• Securing the IoT Update Process -- overall update process.
• 7 Patch Command Examples to Apply Diff Patch Files in Linux -- useful patch commands.
• Patch Management is the Catalyst for Growth in the IoT Industry -- software cloud management suite.
• Fixing, upgrading and patching IoT devices can be a real nightmare -- some IoT devices are hard to update.
• Fundamentals of IoT device management -- update time matters.
• The Connected World: ‘With Great Power Comes Great Responsibility’ -- Things are not smart enough to be managed easily.
• Comparison of open-source configuration management software

CVEs

• 2017, Unauthorized FLIR (Lorex) Cloud Access
• 2016, Security Vulnerabilities Published In 2016 (CVSS score >= 7)
• 2016, Trane IoT Vulnerabilities -- vulnerability in Trane thermostats.
• 2013, Dahua DVR Authentication Bypass - CVE-2013-6117
• 2018, OWASP IoT Vulnerabilities Project
• 2018, OWASP IoT Attack Surface Areas Project
• 2018, Vulnogram

Firmware Analysis

• 2018, NDSS, What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices
• 2018, USENIX Security, Inception: System-Wide Security Testing of Real-World Embedded Systems Software
• 2017, IFIP SEC, Towards Automated Classification of Firmware Images and Identification of Embedded Devices
• 2014, USENIX Security, A Large-Scale Analysis of the Security of Embedded Firmwares

Binary Analysis

• 2017, CCS, Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection

Adversarial Examples for Malware Detection

• 2018, arXiv, Adversarial Examples: Attacks on Machine Learning-based Malware Visualization Detection Methods