Improving IoT Botnet Investigation Using an Adaptive Network Layer.

Area of Science:

• Cybersecurity
• Network Security
• Malware Analysis

Background:

• Internet of Things (IoT) botnets pose significant threats via Distributed Denial-of-Service (DDoS) attacks.
• Existing malware analysis tools struggle with IoT network containment and traffic manipulation.
• Understanding IoT botnet behavior is crucial for enhancing Internet security.

Purpose of the Study:

• To present a novel approach for handling and analyzing network traffic generated by IoT malware.
• To improve security mechanisms against IoT botnet threats.
• To characterize the behavior and intents of IoT botnets.

Main Methods:

• Developed a solution to modify network layer traffic within an analysis environment.
• Implemented traffic manipulation based on observed malware actions.
• Investigated the Mirai and Bashlite botnet families as case studies.

Main Results:

• Successfully blocked attacks launched by IoT botnets.
• Identified specific attack targets of botnet activities.
• Modified botnet commands sent from controllers to infected devices.
• Demonstrated effective network traffic manipulation for security analysis.

Conclusions:

• The proposed approach enhances the analysis of IoT botnet traffic.
• It provides capabilities for mitigating and understanding DDoS attacks originating from IoT devices.
• This method offers a more robust solution for IoT malware analysis compared to existing tools.