Modeling, Analysis, and Mitigation of Dynamic Botnet Formation in Wireless IoT Networks

Farooq, Muhammad Junaid; Zhu, Quanyan

doi:10.1109/tifs.2019.2898817

Cited by 78 publications

(55 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Game-theoretic models are natural frameworks to capture the multistage interaction between attackers and defenders. Recently, game theory has been applied to different sets of security problems, e.g., Stackelberg and signaling games for deception and proactive defenses [21,6,22,23,24,16,25,26,27], network games for cyber-physical security [28,29,30,31,32,33,34,35,36,37], dynamic games for adaptive defense [38,39,40,41,3,42,43,44,45,46], and mechanism design theory for security [47,48,49,50,51,52,53,54,55].…”

Section: Literaturementioning

confidence: 99%

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

Huang

Zhu

2020

Adaptive Autonomous Secure Cyber Systems

Self Cite

View full text Add to dashboard Cite

The increasing instances of advanced attacks call for a new defense paradigm that is active, autonomous, and adaptive, named as the '3A' defense paradigm. This chapter introduces three defense schemes that actively interact with attackers to increase the attack cost and gather threat information, i.e., defensive deception for detection and counter-deception, feedback-driven Moving Target Defense (MTD), and adaptive honeypot engagement. Due to the cyber deception, external noise, and the absent knowledge of the other players' behaviors and goals, these schemes possess three progressive levels of information restrictions, i.e., from the parameter uncertainty, the payoff uncertainty, to the environmental uncertainty. To estimate the unknown and reduce the uncertainty, we adopt three different strategic learning schemes that fit the associated information restrictions. All three learning schemes share the same feedback structure of sensation, estimation, and actions so that the most rewarding policies get reinforced and converge to the optimal ones in autonomous and adaptive fashions. This work aims to shed lights on proactive defense strategies, lay a solid foundation for strategic learning under incomplete information, and quantify the tradeoff between the security and costs.Recent instances of WannaCry ransomware, Petya cyberattack, and Stuxnet malware have demonstrated the trends of modern attacks and the corresponding new security challenges as follows.

show abstract

Section: Literaturementioning

confidence: 99%

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

Huang

Zhu

2020

Adaptive Autonomous Secure Cyber Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…The collection of real-time data and information dissemination rely on the connectivity of the network, which is vital in allowing the IoBT network to unleash its full potential [ 8 ]. However, most of the connections within the IoBT are wireless in nature [ 9 , 10 , 11 ]. Attackers can selectively destroy specific channels and data packets, causing communication links in IoBT networks to be removed [ 1 , 12 ].…”

Section: Introductionmentioning

confidence: 99%

“…Farooq et al also proposed a cognitive connectivity framework, which can cognitively adapt to the changes in the network to interconnect spatially dispersed smart devices thus making it possible to remotely deploy mobile Internet of Things [ 3 ]. In order to model and analyze malware infection in wireless IoT networks, Farooq and Zhu proposed a variation of the mean field population process model based on a customized state space that allows us to analyze the formation of botnets in wireless IoT networks and helps in making corresponding network defense decisions [ 9 ]. Most of the aforementioned studies are carried out from the perspective of network security design, and there is no research to analyze the robustness of the Internet of Battlefield Things under the optimal attack strategy from the opponent (namely, the ability of the network to maintain connectivity in the worst case).…”

Section: Introductionmentioning

confidence: 99%

Robustness of Internet of Battlefield Things (IoBT): A Directed Network Perspective

Feng,

Li,

Zeng

et al. 2020

Entropy

View full text Add to dashboard Cite

Through the combination of various intelligent devices and the Internet to form a large-scale network, the Internet of Things (IoT) realizes real-time information exchange and communication between devices. IoT technology is expected to play an essential role in improving the combat effectiveness and situation awareness ability of armies. The interconnection between combat equipment and other battlefield resources is referred to as the Internet of Battlefield Things (IoBT). Battlefield real-time data sharing and the cooperative decision-making among commanders are highly dependent on the connectivity between different combat units in the network. However, due to the wireless characteristics of communication, a large number of communication links are directly exposed in the complex battlefield environment, and various cyber or physical attacks threaten network connectivity. Therefore, the ability to maintain network connectivity under adversary attacks is a critical property for the IoBT. In this work, we propose a directed network model and connectivity measurement of the IoBT network. Then, we develop an optimal attack strategy optimization model to simulate the optimal attack behavior of the enemy. By comparing with the disintegration effect of some benchmark strategies, we verify the optimality of the model solution and find that the robustness of the IoBT network decreases rapidly with an increase of the unidirectional communication links in the network. The results show that the adversary will change the attack mode according to the parameter settings of attack resources and network communication link density. In order to enhance the network robustness, we need to adjust the defense strategy in time to deal with this change. Finally, we validated the model and theoretical analysis proposed in this paper through experiments on a real military network.

show abstract

“…As such, users are aware of the attack only when an existing infection is identified [1]. This necessitates the development of exclusive models for such wireless IoT networks which can capture the spatial distribution of the devices and the dynamic processes of malware infiltration, control command propagation, and device patching by the defender [5].…”

Section: Introductionmentioning

confidence: 99%

“…remaining free memory of each node and m i is the initially available memory, Hence, the probability of abandoning node τ depends on the size of the malware packet installed on the infected node by the botmaster and the fraction of the remaining free memory of the infected node (bot) during propagation. The processing of malware packet and the abandon probability rate can be mathematically expressed in equation(4)and(5) respectively below:…”

mentioning

confidence: 99%

Modelling and Mitigation Strategy of IoT Botnet Propagation

Ibrahim¹,

Abdullah²,

Abdullah³

et al. 2019

Preprint

View full text Add to dashboard Cite

Nodes in wireless sensor networks (WSN) are characterized particularly by their limited power and memory capabilities. Limited memory is an important parameter as it defines the size of the operating system and the processing code. As established previously, energy and memory efficiency is the most important evaluation factors of WSNs as they are directly related to data loss and network lifetime. However, based on our simulation results, memory efficiency determines the selection or abandon of nodes by the botmaster for the propagation of bots in an IoT infrastructure. Consequently, the node’s memory efficiency determined the spread of bots in the network and provides defense actors with an insight of the botmaster behavior for mitigation of the attack. Conventional botnet propagation and mitigation models did not consider the impact of node’s memory efficiency in the IoT platform. To address this gap, we build IoT-SIEF, a novel propagation model with forensic capability that will analyze command and control propagation behavior based on the perspective of the node’s memory efficiency. IoT-SIEF model used to explore the dynamics of propagation using numerical simulation with more than 50% outperform other models in mitigating the number of secondary bots. Consequently, it can serve as a basis for assisting the planning, design, and defense of such networks from the investigator's point of view.

show abstract

Modeling, Analysis, and Mitigation of Dynamic Botnet Formation in Wireless IoT Networks

Cited by 78 publications

References 37 publications

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense

Robustness of Internet of Battlefield Things (IoBT): A Directed Network Perspective

Modelling and Mitigation Strategy of IoT Botnet Propagation

Contact Info

Product

Resources

About