Research on IoT Anti-malware Technology beyond CPU Architectures

为了增强物联网设备的安全性，我们对恶意软件保护方案进行了研究，这些方案可以有效地保护这些设备，同时独立于CPU架构，并对网络攻击具有鲁棒性。我们在2022财年取得了以下研究成果。(1)我们研究了使用graph2vec对IoT恶意软件静态分析的函数调用图进行编码，以进行恶意软件家族分类。我们提出了两种改进特征表示的方法：重新解释操作码序列以获得统一的用户定义函数名和在嵌入中集成文字信息。在超过108K恶意软件二进制文件的大规模数据集上进行测试，所提出的方法在各种架构下显示出更高的准确性，从而获得上级的整体性能。(2)我们探索了使用可解释人工智能（XAI）来识别区分恶意软件家族的独特功能。我们提出了颜色编码属性图（CAG），它利用分类器模型的特征重要性分数来创建恶意软件样本的可视化表示。结果表明，CAG在解释基于机器学习的物联网恶意软件分类方法方面是有效的，从而实现更准确的分析。

In order to enhance the security of IoT devices, we conducted research on malware protection schemes that could effectively and efficiently safeguard these devices, while also being independent of the CPU architecture and robust to cyberattacks. We got the following research results in FY 2022.(1) We investigated using graph2vec to encode function call graphs from static analysis of IoT malware for malware family classification. We proposed two methods to improve feature representation: reinterpret opcode sequences for unified user-defined function names and integrate literal information in the embedding. Tested on a large-scale dataset of over 108K malware binaries, the proposed method showed higher accuracy under various architectures, leading to superior overall performance.(2) We explored the use of Explainable Artificial Intelligence (XAI) to identify unique features that distinguish malware families. We propose Color-coded Attribute Graph (CAG), which utilizes feature importance scores from classifier models to create a visual representation of malware samples. Results show the CAG is effective in interpreting machine learning-based methods for IoT malware classification, leading to more accurate analyses.