Modelling the Spread of Botnet Malware in IoT-Based Wireless Sensor Networks

Acarali, Dilara; Rajarajan, Muttukrishnan; Komninos, Nikos; Zarpelão, Bruno Bogaz

doi:10.1155/2019/3745619

Cited by 54 publications

(60 citation statements)

References 13 publications

(36 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In view of the above three aspects, there are many studies. The principles of epidemic modelling were applied to IoT networks composed of wireless sensor nodes to describe the uncertain propagation trajectory, where the most commonly are model SI, SIR and SIS [21][22][23]. The game theory was introduced into IoT network to obtain allocated resources for the defenders and the attackers [11,16,[24][25][26].…”

Section: The Dynamics Of Scheduling Strategymentioning

confidence: 99%

A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

Chen

Wang

et al. 2020

Sensors

View full text Add to dashboard Cite

With limited computing resources and a lack of physical lines of defense, the Internet of Things (IoT) has become a focus of cyberattacks. In recent years, outbreak propagation attacks against the IoT have occurred frequently, and these attacks are often strategical. In order to detect the outbreak propagation as soon as possible, t embedded Intrusion Detection Systems (IDSs) are widely deployed in the IoT. This paper tackles the problem of outbreak detection in adversarial environment in the IoT. A dynamic scheduling strategy based on specific IDSs monitoring of IoT devices is proposed to avoid strategic attacks. Firstly, we formulate the interaction between the defender and attacker as a Stackelberg game in which the defender first chooses a set of device nodes to activate, and then the attacker selects one seed (one device node) to spread the worms. This yields an extremely complex bilevel optimization problem. Our approach is to build a modified Column Generation framework for computing the optimal strategy effectively. The optimal response of the defender's problem is expressed as mixed-integer linear programming (MILPs). It is proved that the solution of the defender's optimal response is a NP-hard problem. Moreover, the optimal response of defenders is improved by an approximate algorithm-a greedy algorithm. Finally, the proposed scheme is tested on some randomly generated instances. The experimental results show that the scheme is effective for monitoring optimal scheduling.Sensors 2020, 20, 804 2 of 20 with IoT devices, such as the medical systems [7]. To detect the worm outbreak propagation as soon as possible, we can collect potential threat data by deploying specific embedded Intrusion Detection Systems (IDSs) in the IoT [8,9]. Therefore, the rapid detection of the worm outbreak propagation in the IoT with limited resources by IDS has become an urgent problem to be solved. Herein, such IoT devices with embedded IDS are collectively referred to as "sensors". The "scheduling strategy" mentioned in the following chapters of this paper is mainly aimed at methods of "sensor" combination opening. MotivationGenerally, the initiator of outbreak propagation is a malicious party, and our goal is to detect the outbreak propagation as soon as possible. For example, in a water network, the problem is where should we place a limited number of sensors to quickly detect contaminants [10][11][12][13][14], while in smart power grids, what is concerned about is finding the failure node in a short time [15]. It is natural in these scenarios to consider the problem of adversarial outbreak detection (AOD), where the defender can first select a set of nodes to deploy sensors, and subsequently the attacker can choose the source of infection to spread malicious information. Although there have been many studies on the AOD problem [11,15], the scenario setting of these works (e.g., a water network setting) is different from our scenario and assumptions (e.g., cybersecurity settings and parameters). A common assumption in the e...

show abstract

Section: The Dynamics Of Scheduling Strategymentioning

confidence: 99%

A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

Chen

Wang

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…The penetration and adoption of IoT application into various aspects of humanity is becoming alarming. The network of IoT is growing to be the next digital landscape [1]. By utilizing the capabilities of the wireless sensor network (WSN), IoT penetration is not only restricted to scientific research but has great potentials in civil and military applications.…”

Section: Introductionmentioning

confidence: 99%

“…The sensor nodes in the IoT platform are made to sense, observe and transmit the observable data from an environment to the processing or control center [2]. The sensed data is to be utilize in improving efficiency, learning about customers and increases services [1]. However, sensor nodes are attributed to low power and radio communication capabilities [2].…”

Section: Introductionmentioning

confidence: 99%

“…Furthermore, new technology like IoT and IPv6 remain strange in the sight of the users, understanding their operations and the mode of malware propagation is still at immature stages. As such, users are aware of the attack only when an existing infection is identified [1]. This necessitates the development of exclusive models for such wireless IoT networks which can capture the spatial distribution of the devices and the dynamic processes of malware infiltration, control command propagation, and device patching by the defender [5].…”

Section: Introductionmentioning

confidence: 99%

“…Contrary to the existing approaches our model focused on the constraint nature of nodes functionality like memory availability alongside command and control propagation behavior in IoT botnet formation. Also, to mitigate the botnet formation, recovered nodes are obtained through patching or vaccination in the existing approaches, however, recovered nodes are liable to the same malware reinfections since bots ofttimes tides with new exploits [1]. Thus, it is pragmatic to conceive the recovered nodes as an object of forensic interest that can be subjected to forensic analysis.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Modelling and Mitigation Strategy of IoT Botnet Propagation

Ibrahim¹,

Abdullah²,

Abdullah³

et al. 2019

Preprint

View full text Add to dashboard Cite

Nodes in wireless sensor networks (WSN) are characterized particularly by their limited power and memory capabilities. Limited memory is an important parameter as it defines the size of the operating system and the processing code. As established previously, energy and memory efficiency is the most important evaluation factors of WSNs as they are directly related to data loss and network lifetime. However, based on our simulation results, memory efficiency determines the selection or abandon of nodes by the botmaster for the propagation of bots in an IoT infrastructure. Consequently, the node’s memory efficiency determined the spread of bots in the network and provides defense actors with an insight of the botmaster behavior for mitigation of the attack. Conventional botnet propagation and mitigation models did not consider the impact of node’s memory efficiency in the IoT platform. To address this gap, we build IoT-SIEF, a novel propagation model with forensic capability that will analyze command and control propagation behavior based on the perspective of the node’s memory efficiency. IoT-SIEF model used to explore the dynamics of propagation using numerical simulation with more than 50% outperform other models in mitigating the number of secondary bots. Consequently, it can serve as a basis for assisting the planning, design, and defense of such networks from the investigator's point of view.

show abstract

A botnets control strategy based on variable forgetting rate of control commands

Wang

Elahi

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Botnets take advantage of the vulnerabilities in the device-to-device (D2D) communication in the Internet of Things (IoT) systems. The infect devices may become part of the command and control mechanism of Botnets. These infected devices may forget control commands to remain undetected. State-of-the-art control models for botnets based on how devices are infected and patched in IoT systems while dealing with Botnets assume that the rate at which IoT devices forget the control commands (forgetting rate) is constant and known. These control models ignore the possible variability of the forgetting rate, which may enable bots to operate without being detected. This research fills this gap by proposing a modeling-based strategy that considers the changes in equipment states and repair speed when the forgetting rate is variable. In this regard, first, based on the state-of-the-art botnets control model, the effect of variation in the forgetting rate is analyzed. After that, an improved strategy is proposed for the botnets control model when the forgetting rate is unknown. Finally, the experimental evaluation of the proposed strategy is performed that proves the correctness of the proposed control strategy.

show abstract

Modelling the Spread of Botnet Malware in IoT-Based Wireless Sensor Networks

Cited by 54 publications

References 13 publications

A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

A Stackelberg Security Game for Adversarial Outbreak Detection in the Internet of Things

Modelling and Mitigation Strategy of IoT Botnet Propagation

A botnets control strategy based on variable forgetting rate of control commands

Contact Info

Product

Resources

About