Poster Abstract: Operational Similarity in IoT Malware Development Life Cycle

Due to hardware limitations and low cost, manufacturers often overlook security in widely deployed IoT devices, making them susceptible to attacks. Malware is one such attack that can cause extensive damage. In this work, we analyze a large corpus of IoT malware to extract features that emerge from the shared development and logistics in the malware development life cycle (MDLC), which we name operational features. We use these features to formulate a novel operational similarity concept for malware families and variants that complements existing code and behavior analysis.