MalwSpecSys: A Dataset Containing Syscalls of an IoT Spectrum Sensor Affected by Heterogeneous Malware

This dataset accurately models the internal behavior of an IoT spectrum sensor (belonging to the ElectroSense platform and consisting of a Raspberry Pi 3 with a software-defined radio kit) when it is functioning normally and under attack. To accomplish it, the system calls of the IoT sensor are monitored under normal behavior, gathered, cleaned, and stored in a centralized directory. Then, the device is infected with current malware affecting IoT devices, such as the Bashlite botnet, Thetick backdoor, Bdvl rootkit, and a Ransomware proof of concept. The monitoring process is repeated for each malware, and infections are sequential, meaning that the device is not infected with more than one malware at a time.本数据集精准建模了物联网频谱传感器（IoT spectrum sensor）在正常运行与受攻击状态下的内部行为。该传感器隶属于ElectroSense平台，由搭载软件定义无线电套件（software-defined radio kit）的树莓派3（Raspberry Pi 3）组成。为构建该数据集，研究人员首先对该物联网传感器在正常运行状态下的系统调用进行监测、采集、清洗，并存储至集中式目录中。随后，使该设备感染当前针对物联网设备的主流恶意软件，包括Bashlite僵尸网络（Bashlite botnet）、Thetick后门（Thetick backdoor）、Bdvl Rootkit（Bdvl rootkit）及一款勒索软件概念验证（Ransomware proof of concept）样本。针对每一款恶意软件均重复上述监测流程，且感染操作均为串行执行，即设备不会同时被多款恶意软件感染。

搜集汇总

背景与挑战

背景概述

MalwSpecSys数据集专注于物联网频谱传感器的系统调用数据，用于建模设备在正常和受攻击状态下的内部行为。该数据集通过顺序感染多种异构恶意软件（如Bashlite僵尸网络、Thetick后门等），收集并清理系统调用信息，为安全研究提供了真实且结构化的行为数据源，适用于恶意软件检测和分析。