Abstract:The insecurity of the Internet-of-Things (IoT) paradigm continues to wreak havoc in consumer and critical infrastructures. The highly heterogeneous nature of IoT devices and their widespread deployments has led to the rise of several key security and measurement-based challenges, significantly crippling the process of collecting, analyzing and correlating IoT-centric data. To this end, this paper explores macroscopic, passive empirical data to shed light on this evolving threat phenomena. The proposed work aims to classify and infer Internet-scale compromised IoT devices by solely observing one-way network traffic, while also uncovering, reporting and thoroughly analyzing "in the wild" IoT botnets. To prepare a relevant dataset, a novel probabilistic model is developed to cleanse unrelated traffic by removing noise samples (i.e., misconfigured network traffic). Subsequently, several shallow and deep learning models are evaluated in an effort to train an effective multi-window convolutional neural network. By leveraging active and passing measurements when generating the training dataset, the neural network aims to accurately identify compromised IoT devices. Consequently, to infer orchestrated and unsolicited activities that have been generated by well-coordinated IoT botnets, hierarchical agglomerative clustering is employed by scrutinizing a set of innovative and efficient network feature sets. Analyzing 3.6 TB of recently captured darknet traffic revealed a momentous 440,000 compromised IoT devices and generated evidence-based artifacts related to 350 IoT botnets. Moreover, by conducting thorough analysis of such inferred campaigns, we reveal their scanning behaviors, packet inter-arrival times, employed rates and geo-distributions. Although several campaigns exhibit significant differences in these aspects, some are more distinguishable; by being limited to specific geo-locations or by executing scans on random ports besides their core targets. While many of the inferred botnets belong to previously documented campaigns such as Hide and Seek, Hajime and Fbot, newly discovered events portray the evolving nature of such IoT threat phenomena by demonstrating growing cryptojacking capabilities or by targeting industrial control services. To motivate empirical (and operational) IoT cyber security initiatives as well as aid in reproducibility of the obtained results, we make the source codes of all the developed methods and techniques available to the research community at large.

A threat modeling framework for IoT-Based botnet attacks

Assessing Risks and Modeling Threats in the Internet of Things

A MULTI-LAYER APPROACH TO DETECTING AND PREVENTING IOT-BASED BOTNET ATTACKS

On data-driven curation, learning, and analysis for inferring evolving internet-of-Things (IoT) botnets in the wild

A comprehensive node-based botnet detection framework for IoT network

TMAP: A Threat Modeling and Attack Path Analysis Framework for Industrial IoT Systems (A Case Study of IoM and IoP)

Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques

Modeling and Clustering Attacker Activities in IoT Through Machine Learning Techniques.

AI-Driven Fast and Early Detection of IoT Botnet Threats: A Comprehensive Network Traffic Analysis Approach

Understanding Internet of Things malware by analyzing endpoints in their static artifacts

Threat analysis model to control IoT network routing attacks through deep learning approach

Automated Security Assessment for the Internet of Things

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

Examination of Traditional Botnet Detection on IoT-Based Bots

Security-aware IoT botnet attack detection framework using dilated and cascaded deep learning mechanism with conditional adversarial autoencoder-based features

IoTCMal: Towards A Hybrid IoT Honeypot for Capturing and Analyzing Malware

IoT Security: Botnet detection in IoT using Machine learning

I Still See You: Why Existing IoT Traffic Reshaping Fails

A Malware Distribution Simulator for the Verification of Network Threat Prevention Tools

A Lightweight Energy Consumption Ensemble-Based Botnet Detection Model for IoT/6G Networks

What are Attackers after on IoT Devices? An approach based on a multi-phased multi-faceted IoT honeypot ecosystem and data clustering