Analysis of Botnet Domain Names for IoT Cybersecurity

Abstract

Botnets are widespread nowadays with the expansion of the Internet and commonly occur in many cyber-attacks, resulting in serious threats to network services and users' properties. With the rapid development of the Internet of Things (IoT) applications, the botnet can easily make use of IoT devices for larger-scale attacks. Domain name system (DNS) is widely used by the botnet to establish the connection between bots and their corresponding command-and-control (C&C). In order to avoid the track of the C&C through the DNS information, some sophisticated schemes are used by the botnet and fast-flux is a typical one. In this paper, the activities of Rustock botnet domain names which just use the fast-flux as the connection method between bots and C&C, are deeply analyzed from multiple aspects. Besides, we extract 32 special features of Rustock domain named querying traffic. Then multiple popular classifiers are adopted in order to pick the malicious domain names out from the DNS traffic using those 32 features. The work of this paper aims to provide guidance for future botnet detection based on real statics and experiments.

Detecting Internet of Things Bots: A Comparative Study

“…( [71]) • Whether developing revamped software architectures such as the pluggable and dynamic model presented by Maroof et al [58] should be prioritised for the next generation of IoT devices? • Whether traditional domain-based detection and filtering of bots can be effectively imported for IoT bot detection and mitigation (e.g., [72], [73])? • How technological advancements through Fog and Edge computing can be used to develop more efficient IoT botnet detection and mitigation solutions?…”

Systematic Literature Review on IoT-Based Botnet Attack

“…The authors further discussed database servers, command and control servers, forensic artefacts on the attacker's terminal and the network packet for the attacks [39]. The authors outlined how a forensic expert can remotely obtain some of these artefacts without physical access to botnet servers.An analysis of Rustock botnet domain names was conducted on multiple aspects by Li et al [41].The authors attempted to understand botnet detection in these domain names. The results of an experiment guides future botnet detection.…”

Efficient Detection of Botnet Traffic by Features Selection and Decision Trees

“…In 2019, the FBI's Internet Crime Complaint Center (IC3) recorded more than $3.5 B in individual, and companies losses related to cybercrime [4]. Moreover, the 2020 report on botnets from the European Union Agency for Cybersecurity (ENISA) [5] counted that 7.7 million IoT devices are connected every day to the Internet, increasing the attack surface for malware infections [6], [7]. Besides, it informed on an increase on botnet controlling servers of 71.5% concerning the previous year, which raises the need to develop specific countermeasures against botnets.…”