A dataset of Linux-based IoT malware

Le résumé fourni par la source

How to reconstruct the dataset before use: The archive iot_malware_dataset.tar.gz is split into 9 parts (iot_malware_dataset.tar.gz.part001 to iot_malware_dataset.tar.gz.part009). Download all 9 parts into the same directory, then join them: cat iot_malware_dataset.tar.gz.part* > iot_malware_dataset.tar.gz Check the reassembled file before extracting it: sha256sum iot_malware_dataset.tar.gz# expected: 77c7cce2c6e1cf12a6318b3b6c800240c54471c5255949b46a0e160db45848ff Then extract normally: tar xzf iot_malware_dataset.tar.gz A dataset of Linux-based IoT malware This dataset provides execution traces and static analysis features for Linux-based IoT malware samples collected from the VirusShare repository between 2021 and 2025. It complements existing IoT malware datasets, most of which focus on samples collected prior to 2020, by capturing more recent threats across a wide range of CPU architectures, including ARM, MIPS (little- and big-endian), x86, x86-64, PowerPC, SPARC, Renesas SH, and Motorola m68k. Each sample was analyzed using a combination of static and dynamic techniques: - Static analysis (performed with radare2): executable sections, imported libraries and functions, opcode sequences per function, cyclomatic complexity, entropy, packer detection (via Detect It Easy), and exploit indicators (CVEs inferred from YARA rules).- Dynamic analysis: each sample was executed for 60 seconds in a QEMU-based sandbox built with Buildroot (supporting uClibc, glibc, and musl runtimes), with system interactions monitored using strace to capture process-level system call traces, including syscall names, parameters, and return values.- Labeling: malware family labels were assigned using AVClass based on VirusTotal reports. The dataset consists of 47,248 JSON files, distributed as a compressed .tar.gz archive (~22.8 GB compressed; 149.9 GB uncompressed for the JSON files and 135.1 GB for the raw execution traces), organized into two directories: one containing the analysis JSON files and one containing the raw execution traces. Each JSON file includes:- Sample metadata (filename, architecture, endianness, bitness, binary format, compiler, MD5/SHA-1 hashes, analysis date)- Static features (sections, imports, libraries, cyclomatic complexity, opcode sequences, entropy, detected packer, detected exploits)- Process-level execution traces (system calls, parameters, and return values per process)- Malware family label (AVClass) Related research article: J. Carrillo-Mondéjar, G. Suárez-Tangil, A. Costin, R. J. Rodríguez, "Exploring shifting patterns in recent IoT malware," Proceedings of the European Conference on Cyber Warfare and Security, Vol. 23(1), 2024. https://doi.org/10.34190/eccws.23.1.2280

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.