Towards Situational Awareness of Botnet Activity in the Internet of Things

Abstract

An IoT botnet detection model is designed to detect anomalous attack traffic utilised by the mirai botnet malware. The model uses a novel application of Deep Bidirectional Long Short Term Memory based Recurrent Neural Network (BLSTM-RNN), in conjunction with Word Embedding, to convert string data found in captured packets, into a format usable by the BLSTM-RNN. In doing so, this paper presents a solution to the problem of detecting and making consumers situationally aware when their IoT devices are infected, and forms part of a botnet. The proposed model addresses the issue of detection, and returns high accuracy and low loss metrics for four attack vectors used by the mirai botnet malware, with only one attack vector shown to be difficult to detect and predict. A labelled dataset was generated and used for all experiments, to test and validate the accuracy and data loss in the detection model. This dataset is available upon request.

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

“…The proposed model is compared with simple LSTM approach and the results shows that both achieves good accuracy and performed well for mirai, udp, and dns attacks. In [576], a bi-directional LSTM based botnet detection system is proposed where the model is trained using a generated labeled dataset which contains botnet activities and DDoS attacks. The detection model extracts the useful features using word embedding and learns to detect model and inform the user in case if there is an infection.…”