IJSDIP | International Journal of System Design & Info Processing

Detecting Botnet Traffic in IoT Networks Using Statistical Fingerprinting

Paper ID:

IJSDIP_2020_VOLUME 8_ISSUE 3 _1-6

Author's Name:

Mathy Vanhoef

Volume:

Issue:

Issue 3

Year:

2020

Pages:

01-06

Abstract

The rapid proliferation of Internet of Things (IoT) devices—many of which operate with minimal security controls—has made them prime targets for botnet-based malware such as Mirai and Bashlite. Unlike traditional systems, IoT devices often lack endpoint security capabilities, which necessitates robust, network-level anomaly detection strategies. This paper proposes a lightweight, statistical fingerprinting approach for detecting botnet command-and-control (C2) activity within IoT networks. Our system operates on flow-level metadata—such as packet inter-arrival time, size distribution, and destination entropy—captured from smart home environments emulated over a two-week baseline. By applying anomaly scoring based on deviations from learned temporal and volumetric patterns, the system effectively identifies stealthy botnet behavior, including C2 communications encapsulated in DNS or HTTP. Evaluation against a Snort-based detection baseline demonstrates a 91.8% detection rate with a false positive rate below 5%, validating the method’s effectiveness for embedded edge deployment. Designed for consumer-grade routers, the method avoids payload inspection and heavy computation, making it ideal for distributed defense at the gateway level. We conclude by discussing the integration of these fingerprinting models into smart hubs and mesh network controllers as a scalable defense layer for IoT-rich environments.

Keywords

: botnet detection, IoT security, statistical fingerprinting, flow-level analysis, Mirai, C2 traffic, anomaly detection, smart home networks, edge security

References

1. Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., ... & Savage, S. (2017). Understanding the Mirai botnet. Proceedings of the 26th USENIX Security Symposium, 1093–1110. 2. Jena, J. (2015). Next-Gen Firewalls Enhancing: Protection against Modern Cyber Threats. International Journal of Multidisciplinary and Scientific Energing Research, 3(4), 2015-2019. https://ijmserh.com/admin/pdf/2015/10/46_Next.pdf 3. Gu, G., Perdisci, R., Zhang, J., & Lee, W. (2008). BotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. Proceedings of the 17th USENIX Security Symposium, 139–154. 4. Srikanth, B. (2020). Network Segmentation and MicroSegmentation: Reducing Attack Surfaces in Modern Enterprise Security. 5. Haddadi, F., & Zincir-Heywood, A. N. (2018). Benchmarking the effect of flow exporters and protocol filters on botnet traffic classification. Computer Networks, 136, 122–139. https://doi.org/10.1016/j.comnet.2018.03.004 6. Kolias, C., Kambourakis, G., Stavrou, A., & Voas, J. (2017). DDoS in the IoT: Mirai and other botnets. Computer, 50(7), 80–84. https://doi.org/10.1109/MC.2017.201 7. Vangavolu, S. V. (2019). State Management in Large-Scale Angular Applications. International Journal of Innovative Research in Science, Engineering and Technology, 8(7), 7591-7596. https://www.ijirset.com/upload/2019/july/1_State.pdf 8. Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A.-R., & Tarkoma, S. (2017). IoT Sentinel: Automated device-type identification for security enforcement in IoT. 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), 2177–2184. 9. Perdisci, R., Lanzi, A., & Lee, W. (2010). Behavioral clustering of HTTP-based malware and signature generation using malicious network traces. USENIX Symposium on Networked Systems Design and Implementation (NSDI), 391–404. 10. Rossow, C. (2014). Amplification hell: Revisiting network protocols for DDoS abuse. NDSS Symposium 2014. https://doi.org/10.14722/ndss.2014.23178 11. Sivanathan, A., Gharakheili, H. H., & Sivaraman, V. (2018). Analyzing IoT traffic patterns and characteristics. Computer Communications, 144, 17–26. https://doi.org/10.1016/j.comcom.2019.05.001 12. Snort Project. (2020). Snort 2.9.16.1 User Manual. Cisco Systems. Retrieved from https://www.snort.org 13. Goli, V. R. (2016). Web design revolution: How 2015 redefined modern UI/UX forever. International Journal of Computer Engineering & Technology, 7(2), 66–77 14. Tseng, Y.-T., Lin, C.-Y., & Lin, Y.-D. (2018). Detecting stealthy botnets using a dynamic flow behavioral graph. IEEE Transactions on Information Forensics and Security, 13(9), 2349–2361. https://doi.org/10.1109/TIFS.2018.2816568 15. Yu, F., Zhou, Y., Hao, Y., & Du, X. (2020). IoT behavioral anomaly detection based on deep statistical features and RNN. Sensors, 20(3), 673. https://doi.org/10.3390/s20030673 16. Zarpelão, B. B., Miani, R. S., Kawakani, C. T., & de Alvarenga, S. C. (2017). A survey of intrusion detection in Internet of Things. Journal of Network and Computer Applications, 84, 25–37. https://doi.org/10.1016/j.jnca.2017.02.009 17. Zhao, Q., Qin, Z., Zhang, Y., Liu, Y., & Ren, K. (2019). Privacy-preserving traffic monitoring with encrypted data in edge-assisted IoT. IEEE Internet of Things Journal, 6(3), 4922–4933. https://doi.org/10.1109/JIOT.2018.2875820 18. Zhang, C., Zargar, S. T., & Joshi, J. B. D. (2019). Survey of anomaly detection for smart IoT systems. ACM Computing Surveys (CSUR), 52(6), 1–36. https://doi.org/10.1145/3359625 19. OpenWRT. (2020). OpenWRT device documentation for TP-Link Archer C7. Retrieved from https://openwrt.org/toh/tp-link/archer-c7