Comparative Behavioral Profiling of ARM based IoT Malware Families: A Statistical Characterization of Dynamic System Activity Reports

Abstract

The rapid expansion of the Internet of Things (IoT) has increased the digital attack surface, making resource-constrained devices vulnerable to malware exploitation. Although dynamic analysis effectively captures malware behavior during execution, existing approaches often rely on diverse, high-dimensional features that complicate cross-architecture detection and limit straightforward statistical profiling. This study presents a quantitative descriptive-comparative analysis of behavioral profiles among ARM-based IoT malware families. A multi-stage Extract, Transform, Load (ETL) pipeline was employed to process dynamic System Activity Report (SAR) data from the CIC-YNU-IoTMal dataset. A 10% systematic random sample was analyzed using 14 key features representing CPU utilization, process activity, memory/I/O, and network throughput. Results revealed distinct behavioral signatures and hardware stress patterns across malware families. Tsunami exhibited elevated CPU utilization, Mirai demonstrated sustained runtime activity, Gafgyt showed greater memory and network dependence, while Agent maintained low resource consumption. The findings establish a statistical foundation for lightweight, behavior-driven anomaly detection tailored to ARM-based IoT environments.