The Evolution of Bashlite and Mirai IoT Botnets

Marzano, Artur; Alexander, David; Fonseca, Osvaldo; Fazzion, Elverton; Hoepers, Cristine; Steding-Jessen, Klaus; Chaves, Marcelo H. P. C.; Cunha, Ítalo; Guedes, Dorgival; Meira, Wagner

doi:10.1109/iscc.2018.8538636

Cited by 132 publications

(66 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In this way, it is possible to have the interruption of services or the use of devices as a launching point of attacks for diverse domains, as is the case of the DDoS attack [3], which has been consolidated for several reasons, such as (i) simplicity and facility of execution, not requiring vast technological knowledge on the attacker side, and (ii) variety of platforms and applications for facilitated attack orchestration. Many of these attacks succeeded in disrupting essential Internet services such as DNS, a ecting millions of users around the world [4], and commercial platforms such as the GitHub [5], prompting severe nancial losses to the organizations that depend on those services.…”

Section: Introductionmentioning

confidence: 99%

Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning

Filho

Silveira

Júnior

et al. 2019

Security and Communication Networks

188

View full text Add to dashboard Cite

Users and Internet service providers (ISPs) are constantly affected by denial-of-service (DoS) attacks. This cyber threat continues to grow even with the development of new protection technologies. Developing mechanisms to detect this threat is a current challenge in network security. This article presents a machine learning- (ML-) based DoS detection system. The proposed approach makes inferences based on signatures previously extracted from samples of network traffic. The experiments were performed using four modern benchmark datasets. The results show an online detection rate (DR) of attacks above 96%, with high precision (PREC) and low false alarm rate (FAR) using a sampling rate (SR) of 20% of network traffic.

show abstract

Section: Introductionmentioning

confidence: 99%

Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning

Filho

Silveira

Júnior

et al. 2019

Security and Communication Networks

188

View full text Add to dashboard Cite

show abstract

“…The effect Mirai has on devices it has infected has been studied in order to determine its effects on device usability, power consumption, and network bandwidth consumption [13]. On several smart devices the power consumed by Mirai was found to have a negligible effect on the device during normal operations, but when the device participates in an attack the network bandwidth used increases by a considerable amount.…”

Section: B Mirai Botnetmentioning

confidence: 99%

Testing And Hardening IoT Devices Against the Mirai Botnet

Kelly

Pitropakis

McKeown

et al. 2020

2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

View full text Add to dashboard Cite

A large majority of cheap Internet of Things (IoT) devices that arrive brand new, and are configured with out-of-thebox settings, are not being properly secured by the manufactures, and are vulnerable to existing malware lurking on the Internet. Among them is the Mirai botnet which has had its source code leaked to the world, allowing any malicious actor to configure and unleash it. A combination of software assets not being utilised safely and effectively are exposing consumers to a full compromise. We configured and attacked 4 different IoT devices using the Mirai libraries. Our experiments concluded that three out of the four devices were vulnerable to the Mirai malware and became infected when deployed using their default configuration. This demonstrates that the original security configurations are not sufficient to provide acceptable levels of protection for consumers, leaving their devices exposed and vulnerable. By analysing the Mirai libraries and its attack vectors, we were able to determine appropriate device configuration countermeasures to harden the devices against this botnet, which were successfully validated through experimentation.

show abstract

“…Vários trabalhos na literatura estudam o comportamento e a evolução de malwares [Antonakakis et al 2017, Marzano et al 2018. Existe uma constante evolução dos malwares por parte dos atacantes.…”

Section: Trabalhos Relacionadosunclassified

Dilemas Frente Epidemias Estratégicas: Vacinar ou Reiniciar?

Rufino

Menasché

Cunha³

et al. 2019

Anais Do Workshop Em Desempenho De Sistemas Computacionais E De Comunicação (WPerformance)

Self Cite

View full text Add to dashboard Cite

Network epidemics are ubiquitous. As botnets evolve, they compromise additional users to join DDoS attack campaigns. Such users face a dilemma with respect to which countermeasures to take: hard (e.g., vaccination), soft (e.g., rebooting and rejuvenation) or no countermeasures at all. To tackle this dilemma, one option is to leverage insights from analytical models. Our key contribution consists of novel results on the steady state solution of epidemic models wherein the attacker is strategic and has a finite attack budget. To this aim, the most probable states of the model are analyzed, and are used to derive closed form expressions that approximate the steady state probability of infection of a node. Then, model's insights are contrasted against simulations. The simulations qualitatively support the observations of the model and extend the analysis allowing general distributions to the times between the events.Resumo. Epidemias de rede são ubíquas. Todos os dias, sistemas são comprometidos por botnets e participam de campanhas de ataque DDoS. Assim, os usuários enfrentam um dilema com relação a quais contramedidas tomar: duras (por exemplo, vacinação), suaves (por exemplo, reinicialização e rejuvenescimento) ou nenhuma contramedida. Para resolver esse dilema, uma opçãó e tomar proveito de modelos analíticos. Neste artigo, apresentamos novos resultados sobre a solução em estado estacionário de modelos epidêmicos em que o atacanteé estratégico e tem uma capacidade de ataque finita. Para tanto, analisamos os estados mais prováveis do modelo, indicando suas propriedades; apresentamos fórmulas que aproximam a probabilidade de infecção e contrastamos os insights do modelo com simulações. As simulações suportam qualitativamente as observações do modelo e estendem a análise permitindo distribuições gerais para os tempos entre os eventos.

show abstract

The Evolution of Bashlite and Mirai IoT Botnets

Cited by 132 publications

References 7 publications

Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning

Smart Detection: An Online Approach for DoS/DDoS Attack Detection Using Machine Learning

Testing And Hardening IoT Devices Against the Mirai Botnet

Dilemas Frente Epidemias Estratégicas: Vacinar ou Reiniciar?

Contact Info

Product

Resources

About