Victor Princy, Lashkari Arash Habibi, Lu Rongxing, Sasi Tinshu, Xiong Pulei, Iqbal Shahrear
Faculty of Computer Science, University of New Brunswick, Fredericton, NB E3B 5A3 Canada.
School of Information Technology, York University, Toronto, ON M3J 1P3 Canada.
Peer Peer Netw Appl. 2023 May 10:1-52. doi: 10.1007/s12083-023-01478-w.
During the past decade, the Internet of Things (IoT) has paved the way for the ongoing digitization of society in unique ways. Its penetration into enterprise and day-to-day lives improved the supply chain in numerous ways. Unfortunately, the profuse diversity of IoT devices has become an attractive target for malware authors who take advantage of its vulnerabilities. Accordingly, enhancing the security of IoT devices has become the primary objective of industrialists and researchers. However, most present studies lack a deep understanding of IoT malware and its various aspects. As understanding IoT malware is the preliminary base of research, in this work, we present an IoT malware taxonomy with 100 attributes based on the IoT malware categories, attack types, attack surfaces, malware distribution architecture, victim devices, victim device architecture, IoT malware characteristics, access mechanisms, programming languages, and protocols. In addition, we have mapped these categories into 77 IoT Malwares identified between 2008 and 2022. Furthermore, To provide insight into the challenges in IoT malware research for future researchers, our study also reviews the existing IoT malware detection works.
在过去十年中，物联网（IoT）以独特的方式为社会的持续数字化铺平了道路。它渗透到企业和日常生活中，在许多方面改善了供应链。不幸的是，物联网设备的大量多样性已成为恶意软件作者利用其漏洞的一个有吸引力的目标。因此，增强物联网设备的安全性已成为实业家和研究人员的主要目标。然而，目前大多数研究对物联网恶意软件及其各个方面缺乏深入了解。由于了解物联网恶意软件是研究的初步基础，在这项工作中，我们基于物联网恶意软件类别、攻击类型、攻击面、恶意软件分发架构、受害设备、受害设备架构、物联网恶意软件特征、访问机制、编程语言和协议，提出了一种具有100个属性的物联网恶意软件分类法。此外，我们已将这些类别映射到2008年至2022年间识别出的77种物联网恶意软件。此外，为了让未来的研究人员深入了解物联网恶意软件研究中的挑战，我们的研究还回顾了现有的物联网恶意软件检测工作。
