Research on IoT Anti-malware Technology beyond CPU Architectures

为了增强物联网设备的安全性，我们对恶意软件防护方案进行了研究，这些方案可以有效和高效地保护这些设备，同时独立于CPU架构，对网络攻击具有健壮性。我们在2022财年取得了以下研究成果。(1)针对物联网恶意软件的静态分析，研究了如何使用Graph2vec对函数调用图进行编码，以实现恶意软件家族的分类。我们提出了两种改进特征表示的方法：对统一的用户自定义函数名重新解释操作码序列和在嵌入中集成文字信息。在超过108K恶意软件二进制代码的大规模数据集上进行了测试，结果表明，在不同的体系结构下，该方法具有更高的准确率，从而获得了优越的整体性能。(2)我们探索了使用可解释人工智能(XAI)来识别区分恶意软件家族的独特特征。我们提出了颜色编码属性图(CAG)，它利用分类器模型中的特征重要性得分来创建恶意软件样本的可视化表示。结果表明，CAG在解释基于机器学习的物联网恶意软件分类方法方面是有效的，从而导致更准确的分析。

In order to enhance the security of IoT devices, we conducted research on malware protection schemes that could effectively and efficiently safeguard these devices, while also being independent of the CPU architecture and robust to cyberattacks. We got the following research results in FY 2022.(1) We investigated using graph2vec to encode function call graphs from static analysis of IoT malware for malware family classification. We proposed two methods to improve feature representation: reinterpret opcode sequences for unified user-defined function names and integrate literal information in the embedding. Tested on a large-scale dataset of over 108K malware binaries, the proposed method showed higher accuracy under various architectures, leading to superior overall performance.(2) We explored the use of Explainable Artificial Intelligence (XAI) to identify unique features that distinguish malware families. We propose Color-coded Attribute Graph (CAG), which utilizes feature importance scores from classifier models to create a visual representation of malware samples. Results show the CAG is effective in interpreting machine learning-based methods for IoT malware classification, leading to more accurate analyses.