Poster: Obfuscation Revealed - Using Electromagnetic Emanation to Identify and Classify Malware

Abstract

In this poster we present a novel approach of using side channel information to identify the kinds of malware threats that are targeting IoT devices. Although in the presence of obfuscation techniques that can prevent static or symbolic binary analysis, a malware researcher may obtain detailed information about malware type and identification using our method. It operates by leveraging side channel by electromagnetism rather than software-layer malware analysis. By capturing 96,000 measurement traces from an IoT system infected with different malware samples, we can obtain this information without altering the actual hardware. As a result, it can be implemented without any overhead, regardless of the resources available. Furthermore, our method has the advantage of non-trivial for malware writers to avoid. By collecting EM traces and later analyzing them for patterns, we were able to extract information from IoT devices. We were able to distinguish malware families based on side-channel knowledge without being able to see what exact hardware was involved. We were able to predict three generic malware forms (and one benign class) with a 99.89% percent accuracy in our tests. Even more, our results show that we are able to classify altered malware samples with unseen obfuscation techniques during the training phase, and to determine what kind of obfuscations were applied to the binary, which makes our approach particularly useful for malware analysts.

MDABP: A Novel Approach to Detect Cross-Architecture IoT Malware Based on PaaS

“…Based on the experimental results, they achieved 99.86% detection accuracy. Pham et al [ 41 ] introduced a method to identify malware threats against IoT devices using electromagnetic information from side-channel analysis techniques. Their method detected malware with 99.89% accuracy.…”