Woodiss-Field Ashley, Johnstone Michael N, Haskell-Dowland Paul
School of Science, Edith Cowan University, Joondalup 6027, Australia.
Security Research Institute, Edith Cowan University, Joondalup 6027, Australia.
Sensors (Basel). 2024 Feb 5;24(3):1027. doi: 10.3390/s24031027.
A botnet is a collection of Internet-connected computers that have been suborned and are controlled externally for malicious purposes. Concomitant with the growth of the Internet of Things (IoT), botnets have been expanding to use IoT devices as their attack vectors. IoT devices utilise specific protocols and network topologies distinct from conventional computers that may render detection techniques ineffective on compromised IoT devices. This paper describes experiments involving the acquisition of several traditional botnet detection techniques, BotMiner, BotProbe, and BotHunter, to evaluate their capabilities when applied to IoT-based botnets. Multiple simulation environments, using internally developed network traffic generation software, were created to test these techniques on traditional and IoT-based networks, with multiple scenarios differentiated by the total number of hosts, the total number of infected hosts, the botnet command and control (CnC) type, and the presence of aberrant activity. Externally acquired datasets were also used to further test and validate the capabilities of each botnet detection technique. The results indicated, contrary to expectations, that BotMiner and BotProbe were able to detect IoT-based botnets-though they exhibited certain limitations specific to their operation. The results show that traditional botnet detection techniques are capable of detecting IoT-based botnets and that the different techniques may offer capabilities that complement one another.
僵尸网络是一组连接到互联网的计算机，这些计算机已被策反并被外部控制以用于恶意目的。随着物联网（IoT）的发展，僵尸网络一直在扩展，将物联网设备用作其攻击载体。物联网设备使用与传统计算机不同的特定协议和网络拓扑，这可能会使检测技术在受感染的物联网设备上失效。本文描述了一系列实验，涉及采用几种传统的僵尸网络检测技术（BotMiner、BotProbe和BotHunter），以评估它们应用于基于物联网的僵尸网络时的能力。使用内部开发的网络流量生成软件创建了多个模拟环境，以便在传统网络和基于物联网的网络上测试这些技术，通过主机总数、受感染主机总数、僵尸网络命令与控制（C&C）类型以及异常活动的存在来区分多种场景。外部获取的数据集也用于进一步测试和验证每种僵尸网络检测技术的能力。结果表明，与预期相反，BotMiner和BotProbe能够检测基于物联网的僵尸网络——尽管它们在操作上表现出某些特定的局限性。结果表明，传统的僵尸网络检测技术能够检测基于物联网的僵尸网络，并且不同的技术可能提供相互补充的能力。
