Comparative Behavioral Profiling of ARM based IoT Malware Families: A Statistical Characterization of Dynamic System Activity Reports

Derick Andre Arcenas, Zios Bug-os, Janrey A. Lagunda, Hannah Dalmacio, Jorton A. Tagud, Jose C. Agoylo Jr.

© 2026 Jose C. Agoylo Jr., published by UIKTEN. This work is licensed under the Creative Commons Attribution-NonCommercial 4.0 International. (CC BY-NC 4.0).

Citation Information: SAR Journal. Volume 9, Issue 3, Pages 186-191, ISSN 2619-9955, https://doi.org/10.18421/SAR93-04, September 2026.

Received: 04 August 2026.
Revised: 12 September 2026.
Accepted: 19 September 2026.
Published: 27 September 2026.

Abstract:

The rapid expansion of the Internet of Things (IoT) has increased the digital attack surface, making resource-constrained devices vulnerable to malware exploitation. Although dynamic analysis effectively captures malware behavior during execution, existing approaches often rely on diverse, high-dimensional features that complicate cross-architecture detection and limit straightforward statistical profiling. This study presents a quantitative descriptive-comparative analysis of behavioral profiles among ARM-based IoT malware families. A multi-stage Extract, Transform, Load (ETL) pipeline was employed to process dynamic System Activity Report (SAR) data from the CIC-YNU-IoTMal dataset. A 10% systematic random sample was analyzed using 14 key features representing CPU utilization, process activity, memory/I/O, and network throughput. Results revealed distinct behavioral signatures and hardware stress patterns across malware families. Tsunami exhibited elevated CPU utilization, Mirai demonstrated sustained runtime activity, Gafgyt showed greater memory and network dependence, while Agent maintained low resource consumption. The findings establish a statistical foundation for lightweight, behavior-driven anomaly detection tailored to ARM-based IoT environments.

Keywords – IoT, ARM arch, statistical fingerprinting, resource utilization.

                   

                                                                      Full text PDF