Abstract:

The Internet of Things (IoT) is transforming across the globe with its emerging applications in diverse aspects of life, namely healthcare, automated remote monitoring, smart wearables, sensing, etc. The IoT environment enriches the experience of its users by providing a platform to connect a large number of smart devices, such as smartphones, tablets, watches, etc., as well as share information worldwide. The increased popularity of IoT and smart devices has resulted in a menace as most users’ data is stored on these devices, making them a potential target for network attacks. Thus, it becomes extremely imperative to address malware threats in IoT devices. To combat this problem, the paper presents a detailed investigation to analyze the behavior of IoT malware using network forensics of six IoT botnets. We performed modeling on 55 IoT botnet samples from Twitter Honeypot. We performed botnet analysis in two dimensions: Activities and Networks. We examined botnet activities in terms of vulnerable ports, popular geolocations, protocols, and attack vectors. In terms of its topological features, severity, and packet length. To detect the botnet category, we applied six machine learning classifiers. Neural networks attained the best precision.

Key words: behavioral analysis, IoT botnet, IoT malware, network forensic