Lightweight ELF header analysis model for IoT malwares detection based on machine learning

Abstract The Internet of Things (IoT) has emerged as one of the fastest-growing areas in technology, but this growth also increases the risk of cyber-attacks on IoT devices, particularly through malware infections. In this paper, we present a novel, lightweight approach to detect IoT malware by focusing on the ELF header information, with data sizes varying from 64 to 1024 bytes. This approach aims to improve the overall precision of the results. The motivation behind this approach is to enhance security while minimizing resource usage, crucial for IoT devices with limited computational power. The ELF header is used exclusively because it provides essential metadata, enabling efficient feature extraction without the need for resource-intensive analysis of entire files. We utilize entropy and string methods, including WEM, BEM, 2-gram, and 2-gram matrix, to derive features from the ELF header, while increasing the data size. These features are then classified using machine learning algorithms such as random forest, extra trees, adaboost, and xgboost. Our method, tested on real-world datasets of malware samples targeting ARM architectures, achieves a detection accuracy of 99.98% and F1-score of 99,99% for a processing data length of 512 bytes. This fast and effective approach can be seamlessly deployed in IoT environments, enhancing security and resilience against malware infections, and contributing to the overall protection of IoT devices and networks.