Detection of DNS based botnets using traffic analysis in IoT

Document Type : Original Article

Authors

1 Master's degree, Imam Hussein (AS) University, Tehran, Iran

2 Assistant Professor, Imam Hossein (AS) University, Tehran, Iran

Abstract

Application of IOT based equipment using different technologies are increasing on a day-to-day basis. On the other hand, due to light protocols, versatility of applications, and geographic prevalence, and management by non-specialists, a thorough, secure configuration, and proper update of these equipment is not handled properly. Thus, such equipment are easy targets for various hackers' attacks.
Moreover, crafting bot networks for destructive activities is available more than ever. Using IOT equipment with such weaknesses and shortcomings, detecting bot networks remains as a serious challenge.
In this work, after surveying relevant works, different attack vectors in IOT networks were studied. Then DNS attack vectors that may be leveraged by bots were identified. Finally, Miraka, a method for detecting DNS attacks in IP layer of IOT networks was proposed. For practical purposes, Mirai, a notorious IP based bot common to IOT as well as TCP/IP networks was studied, and different results were obtained using comprehensive traffic generation patterns and scenarios.
The advantage of the proposed methos relies on faster detection of contaminated traffic due to lexical domain name analysis, and less reliance on domain name attributes. Empirical results show a success rate of %99.5 and precision of %99.7 in Mirai based bot detection in IP based IOT networks which is superior to other competing methods.

Keywords

Main Subjects

Smiley face

 

References

[1] A.Al-Fuqaha,M.Guizani,M.Mohammadi,M. Aledhari, M.Ayyash, "Internet of Things: A Survey on Enabling Technologies, Protocols and Applications," IEEE Communications Surveys & Tutorials, vol. 17, pp. 2347-2376, 2015.
[2] M. A. R. Jalaei, "Detecting Botnets with Timing-Based Covert Command and Control," Journal of Electronical & Cyber Defence, vol. 7, no. 4, pp. 1-15, 2020.
[3] G.Doyen,M.Charalambides,S.Latré,B.Stiller, "Towards Incentivizing ISPs to Mitigate Botnets," in International Conference on Autonomous Infrastructure, Brno, 2014.
[4] M.Litoussi,N.Kannouf,K.El Makkaoui, A.Ezzatia, M.Fartitchou, "IoT security: challenges and countermeasures , " Published by Elsevier B.V, vol. 177, p. 503–508, 2020.
[5] I. Elzen,J.Heugten, "Techniques for detecting compromised," University of Amsterdam, Amsterdam, February 12, 2017.
[6] T.Hyun Kim,D.Reeves, "A survey of domain name system vulnerabilities and attacks," Journal of Surveillance,Security and Safety, pp. 34-60, 2020.
[7] L.Fang,H.Wu,K.Qian,W.Wang,L.Han, "A Comprehensive Analysis of DDoS attacks based on DNS," in International Conference on Computer Vision and Data Mining (ICVDM 2021), 2021.
[8] K.Alieyan,A.ALmomani,A.Manasrah,M.Kadhum, "A survey of botnet detection based on DNS," springer, 2015.
[9] I.Ghafir ,V.Prenosil, "DNS Traffic Analysis for Malicious Domains Detection," in 2nd International Conference on Signal Processing and Integrated Networks (SPIN), 2015.
[10] J.Selvi a,J.Ricardo,b.Rodríguez,E.Soria-Olivas , "Detection of algorithmically generated malicious domain names using masked N-grams," Expert Systems With Applications, p. 156–163, 2019.
[11] J.Lee, H.Lee, "Graph-based Malware Activity Detection by DNS traffic analysis," Computer Communications, p. 33–47, 2014.
[12] L.Bilge, S.Sen,D.Balzarotti ,E.Kirda ,C.Kruegel, "A passive DNS analysis service to detect and report malicious," Article in ACM Transactions on Information and System Security, 2014.
[13] A.Prokofiev,Y.Smirnova,V.Surov, "A Method to Detect Internet of Things Botnets," National Research Nuclear University MEPhI (Moscow Engineering Physics Institute), 2018.
[14] Y. Meidan, M.Bohadana , Y. Mathov . Y. Mirsky , A. Shabtai , D. Breitenbacher , Y. Elovici, "N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders," IEEE Pervasive Computing, pp. 12-22, July–September 2018.
[15] Radware, " A Quick History of IoT Botnets," Radware, 1 March 2018. [Online]. Available: https://blog.radware.com/uncategorized/2018/03/history-of-iot-botnets/.
[16] S.Daniel, "IoT Botnets on the Rise," Radware, 2 October 2018. [Online]. Available: https://blog.radware.com/security/2018/10/iot-botnets-on-the-rise/.
[17] P.Danny, "This aggressive IoT malware is forcing Wi-Fi routers to join its botnet army," ZDNET, 31 October 2019. [Online]. Available: https://www.zdnet.com/article/this-aggressive-iot-malware-is-forcing-wi-fi-routers-to-join-its-botnet-army/.
[18] R.Winward, "IoT Attack Handbook," Radware, U.S, 2018.
[19] C.Kolias,G.Kambourakis,A.Stavrou,J.Voas, "Mirai and Other Botnets," IEEE Computer Sceurity, 2 0 1 7 I EEE.
[20] Z.Zorz, "Linux/IRCTelnet creates new, powerful IoT DDoS botnet," Help Net Security, 2 November 2016. [Online]. Available: https://www.helpnetsecurity.com/2016/11/02/linuxirctelnet-iot-ddos-botnet/.
[21] S.Edwards, I.Profetis, "Hajime – Friend or Foe?," ERT Threat Advisory -Radware, USA, April 26, 2017.
[22] F.Bagheri,M.Rezvani,M.Fateh,E.Tahanian, "Malicious Domain Detection Using DNS Records," Journal of Electronical & Cyber Defence, vol. 9, pp. 83-97, 2021. (in persian).https://dor.isc.ac/dor/20.1001.1.23224347.1400.9.3.7.8
[23] A.Jafar Gholi Beik,M.E.Shiri Ahmad Abadi,A.Rezakhani, "The Presentation of a Hybrid Anomaly Detection Model Using Inverse Weight Clustering and Machine Learning in Cloud Environments," Journal of Electronical & Cyber Defence, vol. 9, pp. 21-29, 2022. (in persian).https://dor.isc.ac/dor/20.1001.1.23224347.1400.9.4.2.5
[24] B. Wójcicki, R.Dąbrowski, "Applying Machine Learning to Software Fault Prediction," e-Informatica Software Engineering Journal, vol. vol. 12, no. 1, p. 199–216, 2018.
[25] M.Singh,M.Singh,S.Kaur, "Detecting bot-infected machines using DNS fingerprinting," Digital Investigation, pp. 14-33, 24 December 2018.
[26] M.Aldwairi,F.Belqasmi, "Malware Detection using DNS Records and Domain Name Features," in International Conference on Future Networks and Distributed Systems, June 26-27,2018, Amman, Jordan. ACM, NewYork, NY, USA, June 2018.

Files

History

  • Receive Date: 20 May 2024
  • Revise Date: 12 September 2024
  • Accept Date: 07 October 2024
  • Publish Date: 22 October 2024

Share

How to cite

Statistics