A threat modeling framework for IoT-Based botnet attacks.

Area of Science:

• Cybersecurity
• Network Security
• Internet of Things (IoT)

Background:

• Internet of Things (IoT) devices are increasingly prevalent and closer to users, posing unique security challenges.
• Existing threat modeling research has not adequately addressed attacks targeting IoT devices within fifth-generation (5G) communication environments.
• Compromised IoT devices are difficult to detect and respond to, necessitating specialized threat modeling approaches.

Purpose of the Study:

• To introduce the IoT Targeting-Threat Modeling (I3TM) framework for analyzing and responding to cyberattacks against IoT devices.
• To identify and categorize tactics and techniques used in IoT-specific botnet attacks.
• To provide an objective method for applying threat modeling to IoT security.

Main Methods:

• Analysis of pre-2021 botnets (e.g., Mirai, Pink) to identify attack patterns.
• Development of the I3TM framework based on identified botnet tactics and techniques.
• Construction of Threat Modeling Framework Keyword-Based Metrics for objective analysis of attack features.

Main Results:

• The I3TM framework successfully identified eight tactics from the Medusa botnet during validation.
• The framework provides a structured approach to analyze IoT botnet attack processes.
• Keyword-based metrics enable objective application of the framework.

Conclusions:

• The I3TM framework offers a novel approach to threat modeling for IoT devices in 5G environments.
• Continuous application of I3TM can build a baseline for understanding and mitigating similar IoT attacks.
• Future work will focus on incorporating attack mitigations into the I3TM framework.