{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,24]],"date-time":"2025-08-24T01:51:29Z","timestamp":1756000289787,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":72,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,11,23]],"date-time":"2020-11-23T00:00:00Z","timestamp":1606089600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"UC Multicampus National Lab Collaborative Research and Training","award":["LFR-18-548554"],"award-info":[{"award-number":["LFR-18-548554"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,11,23]]},"DOI":"10.1145\/3386367.3431317","type":"proceedings-article","created":{"date-parts":[[2020,11,24]],"date-time":"2020-11-24T22:53:05Z","timestamp":1606258385000},"page":"169-182","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["RIoTMAN"],"prefix":"10.1145","author":[{"given":"Ahmad","family":"Darki","sequence":"first","affiliation":[{"name":"University of California Riverside"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michalis","family":"Faloutsos","sequence":"additional","affiliation":[{"name":"University of California Riverside"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2020,11,24]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"Permanent denial-of-service attack: Brickerbot. https:\/\/ics-cert.us-cert.gov\/alerts\/ICS-ALERT-17-102-01A (2017-04).  Permanent denial-of-service attack: Brickerbot. https:\/\/ics-cert.us-cert.gov\/alerts\/ICS-ALERT-17-102-01A (2017-04)."},{"key":"e_1_3_2_2_2_1","unstructured":"Openwrt linux distribution for embedded devices | soho routers. https:\/\/openwrt.org\/ (2019-02).  Openwrt linux distribution for embedded devices | soho routers. https:\/\/openwrt.org\/ (2019-02)."},{"key":"e_1_3_2_2_3_1","unstructured":"Iot inspector. https:\/\/iotinspector.org\/ (2020-06).  Iot inspector. https:\/\/iotinspector.org\/ (2020-06)."},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"crossref","unstructured":"Padawan. https:\/\/padawan.s3.eurecom.fr (2020-06).  Padawan. https:\/\/padawan.s3.eurecom.fr (2020-06).","DOI":"10.35965\/jae.v3i1.269"},{"volume-title":"An Analysis of Godlua Backdoor","year":"2019","author":"Alex","key":"e_1_3_2_2_5_1"},{"key":"e_1_3_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00013"},{"key":"e_1_3_2_2_7_1","first-page":"4","volume":"7","author":"Anderson B.","year":"2011","journal-title":"Virology"},{"volume-title":"Turning internet of things (iot) into internet of vulnerabilities (iov): Iot botnets. arXiv preprint arXiv:1702.03681","year":"2017","author":"Angrishi K.","key":"e_1_3_2_2_8_1"},{"key":"e_1_3_2_2_9_1","unstructured":"Anna-senpai. [free] world's largest net:mirai botnet client echo loader cnc source code release. https:\/\/hackforums.net\/showthread.php?tid=5420472. (2016).  Anna-senpai. [free] world's largest net:mirai botnet client echo loader cnc source code release. https:\/\/hackforums.net\/showthread.php?tid=5420472. (2016)."},{"volume-title":"26th USENIX Security Symposium (USENIX Security 17)","year":"2017","author":"Antonakakis M.","key":"e_1_3_2_2_10_1"},{"volume-title":"Domain generation algorithm. https:\/\/www.johannesbader.ch\/2015\/05\/the-dga-of-ranbyus\/","year":"2015","author":"Bader J.","key":"e_1_3_2_2_11_1"},{"key":"e_1_3_2_2_12_1","first-page":"41","volume-title":"USENIX Annual Technical Conference, FREENIX Track","author":"Bellard F.","year":"2005"},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359992.3366641"},{"key":"e_1_3_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354230"},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653737"},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315286"},{"key":"e_1_3_2_2_17_1","unstructured":"Cetin F. Hernandez Ganan C. Altena E. Kasama T. Inoue D. Tamiya K. Tie Y. Yoshioka K. and van Eeten M. Cleaning up the internet of evil things: Real-world evidence on isp and consumer efforts to remove mirai.  Cetin F. Hernandez Ganan C. Altena E. Kasama T. Inoue D. Tamiya K. Tie Y. Yoshioka K. and van Eeten M. Cleaning up the internet of evil things: Real-world evidence on isp and consumer efforts to remove mirai."},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23159"},{"volume-title":"Wisconsin Univ-Madison Dept of Computer Sciences","year":"2006","author":"Christodorescu M.","key":"e_1_3_2_2_20_1"},{"key":"e_1_3_2_2_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1342211.1342215"},{"key":"e_1_3_2_2_22_1","first-page":"95","volume-title":"USENIX Security Symposium","author":"Costin A.","year":"2014"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897900"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00054"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455820"},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-76481-8_5"},{"volume-title":"May 13","year":"2015","author":"Detux","key":"e_1_3_2_2_27_1"},{"volume-title":"Iot threat landscap:e old hacks, new devices. https:\/\/bit.ly\/2VmIFSL","year":"2019","author":"SECURE.","key":"e_1_3_2_2_28_1"},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.48"},{"volume-title":"https:\/\/www.ic3.gov\/media\/2018\/180802.aspx","year":"2018","author":"Cyber","key":"e_1_3_2_2_30_1"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978370"},{"volume-title":"https:\/\/www.gnu.org\/software\/binutils\/","year":"2019","author":"Gnu","key":"e_1_3_2_2_32_1"},{"volume-title":"Gartner says 5.8 billion enterprise and automotive iot end-points will be in use","year":"2020","author":"Goasduff L.","key":"e_1_3_2_2_33_1"},{"volume-title":"The cuckoo sandbox","year":"2012","author":"Guarnieri C.","key":"e_1_3_2_2_34_1"},{"key":"e_1_3_2_2_35_1","first-page":"135","volume-title":"22nd International Symposium on Research in Attacks, Intrusions and Defenses ({RAID} 2019)","author":"Gustafson E.","year":"2019"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23488"},{"volume-title":"Idapro disassembler","year":"2008","author":"Hex-Rays S.","key":"e_1_3_2_2_37_1"},{"volume-title":"internet of things' cyber risks tackled during interpol digital security challenge. https:\/\/bit.ly\/2LIeIwR","year":"2018","author":"INTERPOL.","key":"e_1_3_2_2_38_1"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813642"},{"key":"e_1_3_2_2_40_1","first-page":"351","volume-title":"USENIX security symposium","author":"Kolbitsch C.","year":"2009"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.10"},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813724"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866353"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/EDCC-7.2008.15"},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.49"},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.59"},{"volume-title":"May 13","year":"2015","author":"Limon","key":"e_1_3_2_2_47_1"},{"volume-title":"Mitre att&ck. https:\/\/attack.mitre.org\/","year":"2019","author":"MITRE.","key":"e_1_3_2_2_48_1"},{"key":"e_1_3_2_2_49_1","first-page":"421","volume-title":"ACSAC 2007","author":"Moser A.","year":"2007"},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3281411.3281440"},{"volume-title":"Available from MITRE., 25","year":"2017","key":"e_1_3_2_2_51_1"},{"volume-title":"May 3","year":"2018","key":"e_1_3_2_2_52_1"},{"volume-title":"Cowrie ssh\/telnet honeypot. https:\/\/github.com\/cowrie\/cowrie","year":"2014","author":"Oosterhof M.","key":"e_1_3_2_2_53_1"},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355585"},{"volume-title":"Reverse engineering framework and commandline tools. https:\/\/github.com\/radare\/radare2","year":"2019","author":"Radare","key":"e_1_3_2_2_55_1"},{"key":"e_1_3_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355577"},{"volume-title":"Luabot: Malware targeting cable modems","year":"2016","author":"Rodrigues B.","key":"e_1_3_2_2_57_1"},{"volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020)","year":"2020","author":"Rokon M. O. F.","key":"e_1_3_2_2_58_1"},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/1978672.1978682"},{"volume-title":"Idapro for iot malware analysis? In 12th {USENIX} Workshop on Cyber Security Experimentation and Test ({CSET} 19)","year":"2019","author":"Shaila G, S.","key":"e_1_3_2_2_60_1"},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653738"},{"volume-title":"New vpnfilter malware targets at least 500 k networking devices worldwide","year":"2019","author":"Talos C.","key":"e_1_3_2_2_63_1"},{"volume-title":"wifatch. https:\/\/gitlab.com\/rav7teif\/linux.wifatch\/project_members","year":"2019","author":"TheWhiteTeam","key":"e_1_3_2_2_64_1"},{"volume-title":"Virustotal-free online virus, malware and url scanner. Online: https:\/\/www.virustotal.com\/en","year":"2012","author":"Total V.","key":"e_1_3_2_2_65_1"},{"volume-title":"Linksys worm \"themoon\" summary: What we know so far. goo.gl\/giHF7Q","year":"2014","author":"Ullrich J. B.","key":"e_1_3_2_2_66_1"},{"key":"e_1_3_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_26"},{"volume-title":"https:\/\/backreference.org\/2010\/03\/26\/tuntap-interface-tutorial\/","year":"2010","author":"Tun","key":"e_1_3_2_2_68_1"},{"key":"e_1_3_2_2_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/WISTDCS.2008.11"},{"key":"e_1_3_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134018"},{"key":"e_1_3_2_2_71_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23229"},{"key":"e_1_3_2_2_72_1","first-page":"1099","author":"Zheng Y.","year":"2019","journal-title":"Security 19) ("}],"event":{"name":"CoNEXT '20: The 16th International Conference on emerging Networking EXperiments and Technologies","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication"],"location":"Barcelona Spain","acronym":"CoNEXT '20"},"container-title":["Proceedings of the 16th International Conference on emerging Networking EXperiments and Technologies"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3386367.3431317","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3386367.3431317","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:32:04Z","timestamp":1750195924000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3386367.3431317"}},"subtitle":["a systematic analysis of IoT malware behavior"],"short-title":[],"issued":{"date-parts":[[2020,11,23]]},"references-count":72,"alternative-id":["10.1145\/3386367.3431317","10.1145\/3386367"],"URL":"https:\/\/doi.org\/10.1145\/3386367.3431317","relation":{},"subject":[],"published":{"date-parts":[[2020,11,23]]},"assertion":[{"value":"2020-11-24","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}