KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

Malware

★ 62 Open GitHub ↗

IoT Security Reading List

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Malware

This is a reading list for those interested in studying Malware. If you have any suggestions, please send a pull request.

## Linux Malware

* 2019, IEEE S&P, [LBM: A Security Framework for Peripherals within the Linux Kernel](https://www.computer.org/csdl/proceedings-article/sp/2019/666000a678/17D45W1Oa3N)
* 2018, IEEE S&P, [Understanding Linux Malware](https://rud.is/dl/ieee-sp-2018/435301a870.pdf)
* 2018, [Class 9: Adversarial Malware Detection](https://secml.github.io/class9/)
* 2017, USENIX Security, [Understanding the Mirai Botnet](https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf?_gclid=5b024b3b7304f5.75584304-5b024b3b730553.60141230&_utm_source=xakep&_utm_campaign=mention135460&_utm_medium=inline&_utm_content=lnk681856874400)
* 2016, Github, [Mirai-Source-Code](https://github.com/jgamblin/Mirai-Source-Code/blob/master/ForumPost.md)
* 2016, Blog, [MMD-0056-2016 - Linux/Mirai, how an old ELF malcode is recycled](http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html)

## IoT Malware
* 2020, S&P, [Security Update Labels: Establishing Economic Incentives for Security Patching of IoT Consumer Products](https://www.computer.org/csdl/pds/api/csdl/proceedings/download-article/349700a346/pdf?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJjc2RsX2FwaSIsImF1ZCI6ImNzZGxfYXBpX2Rvd25sb2FkX3Rva2VuIiwic3ViIjoiYW5vbnltb3VzQGNvbXB1dGVyLm9yZyIsImVtYWlsIjoiYW5vbnltb3VzQGNvbXB1dGVyLm9yZyIsImV4cCI6MTU4NjEzNTY0Nn0.ER0j42gk6oF-wct_7CKqaBwG0zp_b2FhKUAJzxVHnGs)
* 2019, arXiv, [HADES-IoT: A Practical Host-Based Anomaly Detection System
* 2019, DSC, [Honor Among Thieves: Towards Understanding the Dynamics and Interdependencies in IoT Botnets](https://www.cs.ucf.edu/~mohaisen/doc/dsc19iot.pdf)
* 2019, USENIX CSET, [IDAPro for IoT Malware analysis?](https://www.usenix.org/system/files/cset19-paper_g.pdf)
for IoT Devices (Extended Version)](https://arxiv.org/pdf/1905.01027.pdf)
* 2019, AsiaCCS, [HADES-IoT: A Practical Host-Based Anomaly Detection Systemfor IoT Devices](https://dl.acm.org/doi/pdf/10.1145/3321705.3329847)
* 2019, NDSS, [Measurement and Analysis of Hajime, a Peer-to-peer IoT Botnet](https://www.cs.umd.edu/~dml/papers/hajime_ndss19.pdf)
* 2019, NDSS, [Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai](https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_02B-2_Cetin_paper.pdf)
* 2018, USENIX, [Acquisitional Rule-based Engine for Discovering Internet-of-Thing Devices](https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-feng.pdf) 
* 2018, arXiv, [A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security](https://arxiv.org/abs/1807.11023) 
* 2018, RAID, [Before Toasters Rise Up: A View into the Emerging IoT Threat Landscape](https://link.springer.com/content/pdf/10.1007%2F978-3-030-00470-5_26.pdf)
* 2018, BlackHat, [IoT Malware: Comprehensive Survey, Analysis Framework and Case Studies](https://i.blackhat.com/us-18/Thu-August-9/us-18-Costin-Zaddach-IoT-Malware-Comprehensive-Survey-Analysis-Framework-and-Case-Studies-wp.pdf)
* 2018 arXiv [AutoBotCatcher: Blockchain-based P2P Botnet Detection for the Internet of Things](https://arxiv.org/pdf/1809.10775.pdf)
* 2017 Milcom [The Mirai Botnet and the IoT Zombie Armies](https://cs.gmu.edu/~astavrou/research/TheMiraiBotnetandtheIoTZombieArmies.pdf)
* 2016 RapidityNetworks, [Hajime: Analysis of a decentralized internet worm for IoT devices](https://security.rapiditynetworks.com/publications/2016-10-16/hajime.pdf) 
* [Analyzing the Propagation of IoT Botnets from DNS Leakage](http://www.cs.umd.edu/projects/droot/botnet.pdf)

## Honey Pot
* 2019, MobiSys, [Understanding Fileless Attacks on Linux-based IoT Devices with HoneyCloud](https://dl.acm.org/doi/pdf/10.1145/3307334.3326083)
* 2018, arXiv, [ThingPot: an interactive Internet-of-Things honeypot](https://arxiv.org/pdf/1807.04114.pdf)
* 2017, BlackHat, [IoTCandyJar: Towards an Intelligent-Interaction Honeypot for IoT Devices](https://www.blackhat.com/docs/us-17/thursday/us-17-Luo-Iotcandyjar-Towards-An-Intelligent-Interaction-Honeypot-For-IoT-Devices-wp.pdf)
* 2017, CPSS, [SIPHON: Towards Scalable High-Interaction Physical Honeypots](https://dl.acm.org/citation.cfm?id=3055192)
* 2015, WOOT, [IoTPOT: Analysing the Rise of IoT Compromises](https://www.usenix.org/system/files/conference/woot15/woot15-paper-pa.pdf)

## SandBox
* 2020, S&P, [PMP: Cost-effective Forced Execution with Probabilistic Memory Pre-planning](https://www.cs.purdue.edu/homes/zhan3299/res/SP20.pdf)
* 2019, [LiSa – Multiplatform Linux Sandbox for Analyzing IoT Malware](http://excel.fit.vutbr.cz/submissions/2019/058/58.pdf)
* 2018, Thesis, [Evaluating Open Source Malware Sandboxes with Linux Malware](https://pdfs.semanticscholar.org/a0c5/f13e0313011b771b80fcc2346af73a127895.pdf?_ga=2.133957646.1445457844.1586099900-1317523662.1585860204)

## Attack Graphs

* 2018, TIFS, [Using Bayesian Networks for Probabilistic Identification of Zero-Day Attack Paths](https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8327913)
* 2018, DBSec, [Assessing Attack Impact on Business Processes by Interconnecting Attack Graphs and Entity Dependency Graphs](https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=925926)
* 2016, CNS, [Towards Probabilistic Identification of Zero-day Attack Paths](http://athena.ecs.csus.edu/~sun/paper/zepro.pdf)
* 2013, Journal of Computer Security, [Aggregating vulnerability metrics in enterprise networks using attack graphs](http://www.cse.usf.edu/~xou/publications/jcs13.pdf)
* 2013, ESORICS, [Patrol: Revealing Zero-Day Attack Paths through Network-Wide System Object Dependencies](https://s2.ist.psu.edu/paper/ESORICS2013-Patrol.pdf)

## Malware Detection

* 2018, arXiv, [Malicious Software Detection and Classification utilizing Temporal-Graphs of System-call Group Relations](https://arxiv.org/pdf/1812.10748.pdf)
* 2018, IoT S&P, [Combining MUD Policies with SDN for IoT Intrusion Detection](https://dl.acm.org/citation.cfm?doid=3229565.3229571)
* 2018, IoT S&P, [Clear as MUD: Generating, Validating and Applying IoT Behavioral Profiles](https://dl.acm.org/citation.cfm?id=3229566)
* 2018, arXiv, Device-Type-Specific Anomaly detection, [DIoT: A Self-learning System for Detecting Compromised IoT Devices](https://arxiv.org/abs/1804.07474)
* 2018, IEEE Transactions on Industrial Informatics, [Detection of Malicious Code Variants Based on Deep Learning](https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8330042)
* 2018, IEEE ACCESS, [Malware Visualization for Fine-Grained Classification](https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=8290767)
* 2015, International Journal of Information Security, [Malware analysis using visualized images and entropy graphs](https://www.eecis.udel.edu/~cavazos/cisc850-spring2017/papers/entropy-graphs.pdf) 
* 2013, ICASSP, [LARGE-SCALE MALWARE CLASSIFICATION USING RANDOM PROJECTIONS AND NEURAL NETWORKS](https://www.cs.toronto.edu/~gdahl/papers/malwareRandomProjections_icassp2013.pdf)

## Network Level Detection

* 2018, arXiv, [IoT-KEEPER: Securing IoT Communications in Edge Networks](https://arxiv.org/abs/1810.08415)

## Systems Security

* 2019, S&P, [HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows](https://csdl.computer.org/csdl/proceedings/sp/2019/6660/00/666000a430.pdf)
* 2018, CCS, [Tiresias: Predicting Security Events Through Deep Learning](https://seclab.bu.edu/people/gianluca/papers/tiresias-ccs2018.pdf)
* 2018, CCS, [Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost](https://dl.acm.org/citation.cfm?id=3243771)
* 2018, NDSS, [Towards a Timely Causality Analysis for Enterprise Security](https://www.princeton.edu/~yushan/priotracker-ndss18.pdf)
* 2017, [Anatomy of an IoT malware attack](https://developer.ibm.com/articles/iot-anatomy-iot-malware-attack/)
* 2014, TIFS, [Data-Centric OS Kernel Malware Characterization](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.708.4911&rep=rep1&type=pdf)

## Software and Application Security

* 2018, CCS, [LEMNA: Explaining Deep Learning based Security Applications](http://people.cs.vt.edu/gangwang/ccs18.pdf)
* 2018, CCS, [HoMonit: Monitoring Smart Home Apps from Encrypted Traffic](https://dl.acm.org/citation.cfm?id=3243820)
* 2018, IoT S&P, [Web-based Attacks to Discover and Control Local IoT Devices](http://delivery.acm.org/10.1145/3230000/3229568/p29-Acar.pdf?ip=130.127.49.160&id=3229568&acc=PUBLIC&key=A79D83B43E50B5B8%2EEB6DCC30042720A5%2E4D4702B0C3E38B35%2E4D4702B0C3E38B35&__acm__=1546977217_fd6741302d2616bb42e082b37886c2f7)

## Android Malware

* 2017, RAID, [Android malware clustering through malicious payload mining](https://pdfs.semanticscholar.org/6d4a/eaa2daeb2a0f0a907bf456580bee64800b07.pdf)
* 2014, CCS, [Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs](http://lilicoding.github.io/SA3Repo/papers/2014_zhang2014semantics.pdf)

## Patches

* [Automated patch management and the challenges from IoT](https://searchsecurity.techtarget.com/tip/Automated-patch-management-and-the-challenges-from-IoT) -- patch challenges.
* [Securing the IoT Update Process](https://www.ntia.doc.gov/files/ntia/publications/iot-patching-capabilities-0717.pdf) -- overall update process.
* [7 Patch Command Examples to Apply Diff Patch Files in Linux](https://www.thegeekstuff.com/2014/12/patch-command-examples/) -- useful patch commands.
* [Patch Management is the Catalyst for Growth in the IoT Industry](https://datafloq.com/read/patch-management-catalyst-growth-internet-things/5106) --  software cloud management suite.
* [Fixing, upgrading and patching IoT devices can be a real nightmare](https://www.networkworld.com/article/3222651/internet-of-things/fixing-upgrading-and-patching-iot-devices-can-be-a-real-nightmare.html) -- some IoT devices are hard to update. 
* [Fundamentals of IoT device management](http://iotdesign.embedded-computing.com/articles/fundamentals-of-iot-device-management/) -- update time matters.
* [The Connected World: ‘With Great Power Comes Great Responsibility’](https://www.infosecurity-magazine.com/opinions/the-connected-world-great-power/) -- Things are not smart enough to be managed easily.
* [Comparison of open-source configuration management software](https://en.wikipedia.org/wiki/Comparison_of_open-source_configuration_management_software)

## CVEs

* 2017, [Unauthorized FLIR (Lorex) Cloud Access](https://depthsecurity.com/blog/unauthorized-flir-cloud-access)
* 2016, [Security Vulnerabilities Published In 2016 (CVSS score >= 7)](https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=7&cvssscoremax=0&year=2016&month=0&cweid=0&order=1&trc=85&sha=0916de636a03e97ea8af9cba7dede14c7d7398d7)
* 2016, [Trane IoT Vulnerabilities](https://blog.talosintelligence.com/2016/02/trane-iot.html) -- vulnerability in Trane thermostats.
* 2013, [Dahua DVR Authentication Bypass - CVE-2013-6117](https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117)
* 2018, [OWASP IoT Vulnerabilities Project](https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Vulnerabilities)
* 2018, [OWASP IoT Attack Surface Areas Project](https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Attack_Surface_Areas)
* 2018, [Vulnogram](https://vulnogram.github.io/)

## Firmware Analysis

* 2018, NDSS, [What You Corrupt Is Not What You Crash: Challenges in Fuzzing Embedded Devices](http://s3.eurecom.fr/docs/ndss18_muench.pdf)
* 2018, USENIX Security, [Inception: System-Wide Security Testing of Real-World Embedded Systems Software](https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-corteggiani.pdf)
* 2017, IFIP SEC, [Towards Automated Classification of Firmware Images and Identification of Embedded Devices](http://firmware.re/ifipsec17/)
* 2014, USENIX Security, [A Large-Scale Analysis of the Security of Embedded Firmwares](https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-costin.pdf)

## Binary Analysis

* 2017, CCS, [Neural Network-based Graph Embedding for Cross-Platform Binary Code Similarity Detection](https://arxiv.org/abs/1708.06525)

## Adversarial Examples for Malware Detection

* 2018, arXiv, [Adversarial Examples: Attacks on Machine Learning-based Malware Visualization Detection Methods](https://arxiv.org/pdf/1808.01546.pdf)

Malware

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README