Examination of Traditional Botnet Detection on IoT-Based Bots

Ashley Woodiss-Field,Michael N. Johnstone,Paul Haskell-Dowland

DOI: https://doi.org/10.3390/s24031027

IF: 3.9

2024-02-06

Sensors

Abstract:A botnet is a collection of Internet-connected computers that have been suborned and are controlled externally for malicious purposes. Concomitant with the growth of the Internet of Things (IoT), botnets have been expanding to use IoT devices as their attack vectors. IoT devices utilise specific protocols and network topologies distinct from conventional computers that may render detection techniques ineffective on compromised IoT devices. This paper describes experiments involving the acquisition of several traditional botnet detection techniques, BotMiner, BotProbe, and BotHunter, to evaluate their capabilities when applied to IoT-based botnets. Multiple simulation environments, using internally developed network traffic generation software, were created to test these techniques on traditional and IoT-based networks, with multiple scenarios differentiated by the total number of hosts, the total number of infected hosts, the botnet command and control (CnC) type, and the presence of aberrant activity. Externally acquired datasets were also used to further test and validate the capabilities of each botnet detection technique. The results indicated, contrary to expectations, that BotMiner and BotProbe were able to detect IoT-based botnets—though they exhibited certain limitations specific to their operation. The results show that traditional botnet detection techniques are capable of detecting IoT-based botnets and that the different techniques may offer capabilities that complement one another.

engineering, electrical & electronic,chemistry, analytical,instruments & instrumentation

What problem does this paper attempt to address?

The paper primarily explores the applicability and efficacy of traditional botnet detection techniques on Internet of Things (IoT) devices. The core issue of the research is to evaluate the effectiveness of several existing botnet detection methods—BotMiner, BotProbe, and BotHunter—in detecting IoT-based botnets.

Specifically, the paper attempts to address the following key questions:

1. **Can traditional botnet detection techniques effectively detect IoT-based botnets?** The paper verifies through experiments whether these techniques can identify infected devices in an IoT environment.

2. **How do traditional botnet detection techniques perform in conventional network environments?** The paper also assesses the performance of these techniques in the scenarios for which they were originally designed.

3. **Can these techniques identify all devices infected by traditional botnets?** The paper further analyzes whether these techniques can completely identify all devices controlled by traditional botnets.

4. **Can these techniques identify all devices not infected by traditional botnets?** The paper also examines the efficacy of these techniques in avoiding false positives.

5. **Can these techniques identify all devices infected by IoT-based botnets?** The paper similarly tests whether these techniques can comprehensively identify infected devices in an IoT environment.

6. **Can these techniques identify all devices not infected by IoT-based botnets?** Finally, the paper explores the ability of these techniques to avoid false positives in an IoT environment.

To answer these questions, researchers created a series of simulated environments to test these detection techniques and used internally developed network traffic generation software. In addition, they also utilized externally acquired datasets to further validate the efficacy of these techniques. The experimental results show that, despite some limitations, both BotMiner and BotProbe are still capable of detecting IoT-based botnets to a certain extent. This indicates that traditional botnet detection techniques still have some application value in certain situations.