Security analysts face a constant stream of new malicious programs (malware), and a key question is whether a new sample is related to one seen before. Malware authors, like other programmers, reuse code, copying pieces from older malware or building new variants from existing codebase. This reuse is easiest to detect at the level of functions. Compiled programs normally contain symbols that mark where each function starts and ends, but malware is often "stripped" of them, so the function boundaries must be reconstructed from the raw machine code alone. Several open-source reverse engineering tools can do this, but their accuracy on stripped binaries has not been thoroughly compared in the literature. A fair comparison is not trivial either, since the boundaries a tool reports rarely match the real ones exactly, and the scoring must handle partial overlaps and functions with no counterpart.

In this work, the student will compare open-source binary analysis tools on IoT malware. The student will have to strip the samples to use them as ground truth and run each tool on the stripped versions, measuring accuracy and running time. To quantify accuracy, a suitable scoring method must be designed. Based on the results, the student will have to choose the most suitable tool and build an automated function extraction service on top of it. Finally, the student will have to deploy the service on Kubernetes with Helm.

Tasks to be performed by the student will include:

• From a collection of unstripped IoT malware samples, produce stripped samples.
• Define an accuracy measure that matches extracted functions to real ones.
• Run the selected tools on the stripped samples and compare their accuracy and running time.
• Implement an automated function extraction service built on the best-performing tool.
• Deploy the service on Kubernetes.