Internet of Things Malware Dataset

Published 2018. Internet of Things devices often lack adequate security protections. Where prior approaches focused on energy consumption patterns and OpCode, this dataset was developed to enable deep learning applications in IoT malware detection.

Introduction

The benign samples originate from the Linux Debian package repository (pkgs.org), featuring applications compatible with the Raspberry Pi II, which uses ARM processors commonly found in IoT cloud edge devices.

Dataset details

The collection includes samples from ARM Cortex-M and Cortex-R processor families. Malware samples were sourced from VirusTotal’s threat intelligence platform as of September 30, 2017. It comprises 280 malware samples and 271 benign files.

Files were unpacked using the Debian installer bundle, then decompiled using the Object-Dump tool. A bash script performed the following steps:

• Extracted Debian package files
• Searched for ELF files
• Decompiled ELF files using object-dump
• Extracted OpCode sequences

Cortex-A processors, used in the Raspberry Pi II, provide the most comprehensive instruction sets, enabling more complete OpCode extraction.

Citation

Haddad Pajouh, H., Dehghantanha, A., Khayami, R., & Choo, K. (2018). A deep Recurrent Neural Network based approach for Internet of Things malware threat hunting. Future Generation Computer Systems, 85, 88–96.

Download

The dataset is available on GitHub.