Build a Learning Model to detect IOT malware Detection
Budget: ₹600 – ₹1,500 INR
Task 3: CDMC2021 IoT Malware Detection
Based on the control flow graphs (CFGs) generated by a static-analysis tool, Radare2, and labels that indicating whether the samples are malware programs, the participants are required to perform an IoT malware detection task to predict whether the samples in the test set are malware or not. The dataset consists of 54,829 samples, which are generated from the following procedure: (1) a collection of malicious and benign Linux programs in ELF format were collected from various sources; (2) each of these programs are fed to Radare2 to extract the CFG information; and (3) JSON output from Radare2 that can be interpreted as a list of directed-graph components are then reformulate as a single line in a text file. Please see the “File Format” section for more detail.
Label (1: malware, 0: benign ware) of the ELF files are determined by the state-of-art anti-virus engines.
List of Files
The CDMC2021_IoTMalware_Train.data file contains feature information of 16,521files in the training set.
The CDMC2021_IoTMalware_Train.label file contains label information of 16,521files in the training set.
The CDMC2021_IoTMalware_Test.data file contains information of 38,550 files in the testing set.
File Format
Steps to formulate the features.
Radare2 outputs its analysis result for an ELF sample program as a JSON object looks like the following.
[{"name": "sym.__uClibc_main", "imports": ["sym.memset", "sym.__GI_memcpy", "sym._dl_aux_init", "sym.__uClibc_init"]}, {"name": "sym._fp_out_narrow", "imports": ["sym.__GI_strlen ", "sym._charpad", "sym.__stdio_fwrite"]}, …]
Then, each node in the list is represented as a list of function calls with the “name” field placed at first, followed by the function calls in the “import” field. The components in the list are separated by white spaces. The JSON object above is changed to a list of nodes as follows.
Node 1: "sym.__uClibc_main" "sym.memset" "sym.__GI_memcpy" "sym._dl_aux_init" "sym.__uClibc_init"
Node 2: "sym._fp_out_narrow" "sym.__GI_strlen" "sym._charpad" "sym.__stdio_fwrite"
Nodes 3~: …
All nodes in the JSON list are sequentially joined by semicolons to form a single line in a .data file. Now, each line in the .data file corresponds to a single file in the dataset.
Line 1: "sym.__uClibc_main" "sym.memset" "sym.__GI_memcpy" "sym._dl_aux_init" "sym.__uClibc_init";"sym._fp_out_narrow" "sym.__GI_strlen" "sym._charpad" "sym.__stdio_fwrite";…
Task
The participants are required to provide the prediction of labels of the test samples based on information provided in the task.
Based on the control flow graphs (CFGs) generated by a static-analysis tool, Radare2, and labels that indicating whether the samples are malware programs, the participants are required to perform an IoT malware detection task to predict whether the samples in the test set are malware or not. The dataset consists of 54,829 samples, which are generated from the following procedure: (1) a collection of malicious and benign Linux programs in ELF format were collected from various sources; (2) each of these programs are fed to Radare2 to extract the CFG information; and (3) JSON output from Radare2 that can be interpreted as a list of directed-graph components are then reformulate as a single line in a text file. Please see the “File Format” section for more detail.
Label (1: malware, 0: benign ware) of the ELF files are determined by the state-of-art anti-virus engines.
List of Files
The CDMC2021_IoTMalware_Train.data file contains feature information of 16,521files in the training set.
The CDMC2021_IoTMalware_Train.label file contains label information of 16,521files in the training set.
The CDMC2021_IoTMalware_Test.data file contains information of 38,550 files in the testing set.
File Format
Steps to formulate the features.
Radare2 outputs its analysis result for an ELF sample program as a JSON object looks like the following.
[{"name": "sym.__uClibc_main", "imports": ["sym.memset", "sym.__GI_memcpy", "sym._dl_aux_init", "sym.__uClibc_init"]}, {"name": "sym._fp_out_narrow", "imports": ["sym.__GI_strlen ", "sym._charpad", "sym.__stdio_fwrite"]}, …]
Then, each node in the list is represented as a list of function calls with the “name” field placed at first, followed by the function calls in the “import” field. The components in the list are separated by white spaces. The JSON object above is changed to a list of nodes as follows.
Node 1: "sym.__uClibc_main" "sym.memset" "sym.__GI_memcpy" "sym._dl_aux_init" "sym.__uClibc_init"
Node 2: "sym._fp_out_narrow" "sym.__GI_strlen" "sym._charpad" "sym.__stdio_fwrite"
Nodes 3~: …
All nodes in the JSON list are sequentially joined by semicolons to form a single line in a .data file. Now, each line in the .data file corresponds to a single file in the dataset.
Line 1: "sym.__uClibc_main" "sym.memset" "sym.__GI_memcpy" "sym._dl_aux_init" "sym.__uClibc_init";"sym._fp_out_narrow" "sym.__GI_strlen" "sym._charpad" "sym.__stdio_fwrite";…
Task
The participants are required to provide the prediction of labels of the test samples based on information provided in the task.