Data-driven Curation, Learning and Analysis for Inferring Evolving IoT Botnets in the Wild

Abstract

The insecurity of the Internet-of-Things (IoT) paradigm continues to wreak havoc in consumer and critical infrastructure realms. Several challenges impede addressing IoT security at large, including, the lack of IoT-centric data that can be collected, analyzed and correlated, due to the highly heterogeneous nature of such devices and their widespread deployments in Internet-wide environments. To this end, this paper explores macroscopic, passive empirical data to shed light on this evolving threat phenomena. This not only aims at classifying and inferring Internet-scale compromised IoT devices by solely observing such one-way network traffic, but also endeavors to uncover, track and report on orchestrated "in the wild" IoT botnets. Initially, to prepare the effective utilization of such data, a novel probabilistic model is designed and developed to cleanse such traffic from noise samples (i.e., misconfiguration traffic). Subsequently, several shallow and deep learning models are evaluated to ultimately design and develop a multi-window convolution neural network trained on active and passive measurements to accurately identify compromised IoT devices. Consequently, to infer orchestrated and unsolicited activities that have been generated by well-coordinated IoT botnets, hierarchical agglomerative clustering is deployed by scrutinizing a set of innovative and efficient network feature sets. By analyzing 3.6 TB of recent darknet traffic, the proposed approach uncovers a momentous 440,000 compromised IoT devices and generates evidence-based artifacts related to 350 IoT botnets. While some of these detected botnets refer to previously documented campaigns such as the Hide and Seek, Hajime and Fbot, other events illustrate evolving threats such as those with cryptojacking capabilities and those that are targeting industrial control system communication and control services. CCS CONCEPTS • Security and privacy → Embedded systems security; Network security; • Computing methodologies → Classification and regression trees; Neural networks.

The Impact of Health Information Privacy Concerns on Engagement and Payment Behaviors in Online Health Communities

“…Inevitably, this is associated with an increased risk of privacy violations (Crossler and Bélanger, 2019;Gerhart and Koohikamali, 2019). Thus, the lack of basic security regulations on online platforms (Pour et al, 2019) fuels privacy concerns, as users' private information may become exposed (Malm, 2018) and their anonymity could become compromised-only 15 demographic features are needed to correctly identify an individual based on online data (Rocher et al, 2019).…”

COVID-19 Paradox: The Role of Privacy Concerns and Ad Intrusiveness on Consumer’s Attitude Toward App Usage Behavior

“…The important thing about data is that 90% of data are generated after 2016, and 50% of these data are produced by Mobile and Internet of Things (IoT) devices ( Marr, 2018 ). Since these devices lack security protocols, so these devices are mainly involved in privacy breaches and violations ( Pour et al, 2019 ). The critical development in data collection is that it is no longer dependent on direct interactions as third-party data collection and secondary data usage have seen a significant rise ( King and Forder, 2016 ).…”

Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research

“…The original probabilistic model in [68] was designed to clean irrelevant flow by eliminating noise samples, such as misconfigured traffic. Then, multiple low and deep learning models were tested in an endeavor to create an efficient multi-window convolutional neural network.…”