Collaborative device-level botnet detection for internet of things. Issue 129 (June 2023)

• Record Type: Journal Article
• Authors: Nasir, Muhammad Hassan; Arshad, Junaid; Khan, Muhammad Mubashir
• Is Part Of: Computers & security. Issue 129(2023)
• Publication Date: 2023-06
• Subjects: Internet of things -- Botnets -- Intrusion detection -- Device-level security; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2023.103172
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: A review of the state-of-the-art device-level intrusion detection approaches. A detailed analysis of existing botnet datasets and their features to support evaluation of IDS. A novel trustworthy botnet detection framework for efficient and effective detection of IoT botnets. Evaluation of device-level botnet detection using IoT datasets (ISOT, IoT23 and BotIoT) with Snort and Suricata Abstract: Cyber attacks on the Internet of Things (IoT) have seen a significant increase in recent years. This is primarily due to the widespread adoption and prevalence of IoT within domestic and critical national infrastructures, as well as inherent security vulnerabilities within IoT endpoints. Therein, botnets have emerged as a major threat to IoT-based infrastructures targeting firmware vulnerabilities such as weak or default passwords to assemble an army of compromised devices which can serve as a lethal cyber-weapon against target systems, networks, and services. In this paper, we present our efforts to mitigate this challenge through the development of an intrusion detection system that resides within an IoT device to provide enhanced visibility thereby achieving security hardening of such devices. The device-level intrusion detection presented here is part of our research framework BTC _ SIGBDS (Blockchain-powered, Trustworthy, Collaborative, Signature-based Botnet Detection System). We identify the research challenge through a systematic critical review of existing literature and present detailed design of the device-level component of the BTC _ SIGBDS framework. We use a signature-based detection scheme with trusted signature updates to strengthen protection against emerging attacks. We have evaluated the suitability and enhanced the capability through the generation of custom signatures of two of the most famous signature-based IDS with ISOT, IoT23, and BoTIoT datasets to assess the effectiveness with respect to detection of anomalous traffic within a typical resource-constrained IoT network in terms of number of alerts, detection rates, detection time as well as in terms of peak CPU and memory usage.