A Proposed Framework for Early Detection IoT Botnet

Mashaleh, Ashraf S.; Ibrahim, Noor Farizah; Alauthman, Mohammad; Almomani, Ammar

doi:10.1109/acit57182.2022.9994166

Cited by 3 publications

(6 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Based on literature [14], there are three major methods of botnet detection such as host-based detection, honeynet detection and network-based detection. Recently, machine learning based detection has become the most widely used for detecting botnets methods as proven by previous literature [15], [16], [4], [5]. In addition, the number and complexity of IoT devices is also growing, it has become important to develop effective botnet detection methods.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Botnet Detection and Incident Response in Security Operation Center (SOC): A Proposed Framework

Muhammad,

Ismail,

Hassan

2024

IJACSA

View full text Add to dashboard Cite

In the dynamic landscape of evolving cyber threats, Security Operations Centers (SOCs) play an important role in protecting digital assets. Among these threats, botnets are particularly challenging due to their ability to take over many devices and launch coordinated attacks. Through comparative analysis, the research gaps in existing frameworks have been identified. Based on these insights, a botnet detection and incident response framework aligned with SOC practices has been proposed. This proposed framework emphasizes proactive measures by integrating threat intelligence, detection and monitoring tools to detect botnet attack and facilitate rapid response. Future research will focus on conducting evaluation and validation studies to assess the effectiveness and performance of the framework in controlled environments. This effort will contribute to develop the framework and ensuring it aligns with practical cybersecurity needs.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Botmasters generate revenue by renting and leasing botnets on the darknet market. Attackers frequently modify and update the structures and methodologies of botnets to evade detection [5]. This makes botnets difficult to detect.…”

Section: Introductionmentioning

confidence: 99%

Botnet Detection and Incident Response in Security Operation Center (SOC): A Proposed Framework

Muhammad,

Ismail,

Hassan

2024

IJACSA

View full text Add to dashboard Cite

show abstract

“…Specific machine learning models for payload-based detection include multilayer perceptrons for general pattern recognition, convolutional neural networks for identifying spatial patterns in packet data, and recurrent neural networks for sequence modelling of network streams. For example, Mashaleh et al [8] developed an IoT botnet detection system using convolutional and recurrent neural networks trained on fused packet payload and flow data, achieving 97.3% accuracy. Alsarhan et al [4] proposed an intrusion detection framework for vehicular networks using SVMs optimized with genetic algorithms (GAs) and particle swarm optimization (PSO).…”

Section: Traffic Payload-based Detectionmentioning

confidence: 99%

“…Alieyan et al [16] evaluated a hybrid model merging DNS and flow features using various classifiers, including SVMs, Naive Bayes, and decision trees. Mashaleh et al [8] proposed an early IoT botnet detection framework fusing packet and flow features classified with SVMs, attaining 97.3% accuracy.…”

Section: Hybrid Detectionmentioning

confidence: 99%

“…Key machine learning algorithms applied for botnet detection include:  Support Vector Machines (SVMs): SVMs are widely used for botnet classification given their ability to handle high-dimensional data and learn complex decision boundaries, especially using kernel functions [4,8,9,15,16]. Due to the adversarial nature of botnets, models require continual retraining to detect modified botnet behaviors.…”

Section: Machine Learning Algorithmsmentioning

confidence: 99%

See 1 more Smart Citation

Botnet Detection Techniques: A Comparative Study

Alauthman

2023

Preprint

View full text Add to dashboard Cite

Botnets pose a grave cybersecurity threat, enabling widescale malicious activities through networks of compromised devices. Detecting botnets is challenging given their frequent use of evasion techniques like encryption. Traditional signature-based methods fail against modern botnets capable of zero-day attacks. This paper surveys recent advances applying machine learning for botnet detection based on analysis of network traffic payloads, flows, DNS data, and hybrid feature fusion. Core machine learning models include support vector machines, neural networks, random forests, and deep learning architectures, which extract patterns to separate benign and botnet behaviors automatically. Results demonstrate machine learning's capabilities in identifying heterogeneous botnets using artefacts in network streams. However, challenges remain around limited labeled data, real-time streaming, adversarial evasion, and model interpretability. Promising directions involve semi-supervised learning, adversarial training, scalable analytics, and explainable AI to address these gaps. Beyond the technical aspects, responsible development and deployment of botnet detection systems raise ethical considerations around privacy, transparency, and accountability. With diligent cross-disciplinary collaboration, machine learning promises enhanced, generalizable, and trustworthy techniques to combat the serious threat posed by continuously evolving botnets across the digital ecosystem.

show abstract

Design the IoT Botnet Defense Process for Cybersecurity in Smart City

Kim,

Jeon,

Shin

et al. 2023

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

The smart city comprises various infrastructures, including healthcare, transportation, manufacturing, and energy. A smart city's Internet of Things (IoT) environment constitutes a massive IoT environment encompassing numerous devices. As many devices are installed, managing security for the entire IoT device ecosystem becomes challenging, and attack vectors accessible to attackers increase. However, these devices often have low power and specifications, lacking the same security features as general Information Technology (IT) systems, making them susceptible to cyberattacks. This vulnerability is particularly concerning in smart cities, where IoT devices are connected to essential support systems such as healthcare and transportation. Disruptions can lead to significant human and property damage. One representative attack that exploits IoT device vulnerabilities is the Distributed Denial of Service (DDoS) attack by forming an IoT botnet. In a smart city environment, the formation of IoT botnets can lead to extensive denial-ofservice attacks, compromising the availability of services rendered by the city. Moreover, the same IoT devices are typically employed across various infrastructures within a smart city, making them potentially vulnerable to similar attacks. This paper addresses this problem by designing a defense process to effectively respond to IoT botnet attacks in smart city environments. The proposed defense process leverages the defense techniques of the MITRE D3FEND framework to mitigate the propagation of IoT botnets and support rapid and integrated decision-making by security personnel, enabling an immediate response.

show abstract

A Proposed Framework for Early Detection IoT Botnet

Cited by 3 publications

References 26 publications

Botnet Detection and Incident Response in Security Operation Center (SOC): A Proposed Framework

Botnet Detection and Incident Response in Security Operation Center (SOC): A Proposed Framework

Botnet Detection Techniques: A Comparative Study

Design the IoT Botnet Defense Process for Cybersecurity in Smart City

Contact Info

Product

Resources

About