Using honeypots to model botnet attacks on the internet of medical things

Area of Science:

• Cybersecurity
• Network Security
• Botnet Analysis

Background:

• The COVID-19 pandemic has seen a rise in attacks on smart devices, leading to complex botnet activities.
• Current botnet detection methods struggle to accurately classify attack patterns due to mixed attack records and sequential/simultaneous botnet participation.
• A lack of publicly available solutions for classifying botnet attack patterns based on control periods hinders effective security analysis.

Purpose of the Study:

• To propose a novel data-driven method for classifying botnet attack patterns based on their control periods.
• To address the inaccuracy in security reports caused by mixed attack records from multiple botnets.
• To provide a foundational solution for understanding and combating botnet attacks more effectively.

Main Methods:

• Deployment of 462 honeypots across 22 countries to capture real-world botnet attack data.
• Development of a new algorithm designed to identify distinct botnet control periods.
• Utilizing a data-driven approach based on the hypothesis that bots exhibit time-related patterns within control periods.

Main Results:

• Experimental validation demonstrating the efficacy of the proposed method in classifying attack patterns.
• Successful identification of botnet control periods using the developed algorithm.
• Gathering eight significant findings to enhance the security community's understanding of botnet behavior.

Conclusions:

• The proposed method effectively classifies botnet attack patterns by control periods, enhancing accuracy in security analysis.
• The findings provide valuable insights for the security community to better understand and combat evolving botnet threats.
• This research contributes a novel data-driven solution to a critical gap in current botnet detection and analysis.