Toward an approach using graph-theoretic for IoT botnet detection

IoT devices are contributing significantly to increasing utility in life, increasing efficiency, increasing labor productivity as well as reducing costs. However, the fact that many manufacturers aim to speed up production and reduce production costs, most IoT devices have weak security features, easily infected by botnet malware. Static analysis of IoT botnet malware samples is a viable approach to fully understand the behavior of IoT botnet from there to mitigate and prevent. However, current analysis methods based on operation code or function call graphs generally do not work well with diversity in central processing unit (CPU) architecture and are often resource-intensive. In this paper, we propose a solution that uses graph-theoretic to present features that are effective in detecting botnet IoT. The main contribution of the paper is extracting PSI graph from executable files and exploiting a representative set of features from PSI-graph, which has a negligible number of attributes but achieves positive performance for IoT botnet malware detection (94.84% accuracy)