AutoBotCatcher: Blockchain-Based P2P Botnet Detection for the Internet of Things

Abstract

In general, a botnet is a collection of compromised internet computers, controlled by attackers for malicious purposes. To increase attacks' success chance and resilience against defence mechanisms, modern botnets have often a decentralized P2P structure. Here, IoT devices are playing a critical role, becoming one of the major tools for malicious parties to perform attacks. Notable examples are DDoS attacks on Krebs on Security 1 and DYN 2 , which have been performed by IoT devices part of botnets.We take a first step towards detecting P2P botnets in IoT, by proposing AutoBotCatcher, whose design is driven by the consideration that bots of the same botnet frequently communicate with each other and form communities. As such, the purpose of AutoBotCatcher is to dynamically analyze communities of IoT devices, formed according to their network traffic flows, to detect botnets. AutoBotCatcher exploits a permissioned Byzantine Fault Tolerant (BFT) blockchain, as a state transition machine that allows collaboration of a set of pre-identified parties without trust, in order to perform collaborative and dynamic botnet detection by collecting and auditing IoT devices' network traffic flows as blockchain transactions.In this paper, we focus on the design of the AutoBotCatcher by first defining the blockchain structure underlying AutoBot-Catcher, then discussing its components.Index Terms-Blockchain, Internet of Things (IoT), Security, P2P Botnets, Botnet Detection.5 For the rest of paper, we use the term botnet to refer malicious botnets.

Survey on Botnet Detection Techniques: Classification, Methods, and Evaluation

“…e basic idea of using blockchain technology for botnet detection is to the use of smart contracts, digital signatures, incentive mechanisms, and other technologies, based on proxy or collaborative detection, to achieve trust information exchange or voting among different detectors. In [109], AutoBotCatcher used BFT (Byzantine Fault Tolerant) to perform dynamic and collaborative botnet detection on large networks and used the community detection algorithm Louvain method to detect communities.…”

Systematic Literature Review on IoT-Based Botnet Attack

“…With regard to System proposal, we identify six studies that proposed it, which amount to 17.65% of the primary studies. A system named AutoBotCatcher was proposed by Sagirlar et al [27] . The system aims to detect P2P botnets in IoT.…”

Towards Blockchain-Based Software-Defined Networking: Security Challenges and Solutions

“…We figure out that the trend of combining SDN and blockchain seems positive and will continue. Thanks to many benefits like management flexibility, scalability and data flow verification, blockchainbased SDN can have a broad application in various domains like intrusion detection [21], [37], healthcare industry [30], [35], vehicular [36], etc. Meanwhile, we advocate that more future efforts could be made on exploring how to improve the security and performance of blockchain-based SDN.…”