分析物联网恶意软件中的端点
Analyzing Endpoints in the Internet of Things Malware
摘要：
物联网（IoT）设备缺乏安全措施及其持续的在线连接，使攻击者有机会将其作为目标或滥用它们作为更大攻击的中间目标，例如分布式拒绝服务（DDoS）活动。在本文中，我们分析了物联网恶意软件，重点是端点，以了解dropzone与其目标IP地址之间的亲和力，并了解它们之间的不同模式。为了实现这一目标，我们对2，423个物联网恶意软件样本进行了反向工程，以获取IP地址。我们进一步从互联网范围的扫描仪（包括Shodan和Censys）中增加有关端点的更多信息。然后，我们对dropzone及其目标IP地址进行深入的数据驱动分析，并进一步检查目标设备空间的攻击面。
英文摘要：
The lack of security measures in the Internet of Things (IoT) devices and their persistent online connectivity give adversaries an opportunity to target them or abuse them as intermediary targets for larger attacks such as distributed denial-of-service (DDoS) campaigns. In this paper, we analyze IoT malware with a focus on endpoints to understand the affinity between the dropzones and their target IP addresses, and to understand the different patterns among them. Towards this goal, we reverse-engineer 2,423 IoT malware samples to obtain IP addresses. We further augment additional information about the endpoints from Internet-wide scanners, including Shodan and Censys. We then perform a deep data-driven analysis of the dropzones and their target IP addresses and further examine the attack surface of the target device space.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
