The Internet of Things (IoT) devices are widely utilised across various domains such as home automation, healthcare, industrial processes, transportation, energy management and environmental monitoring. It is estimated that by 2030 there will be more than eight billion IoT devices deployed worldwide. Nevertheless, many of these devices have been found to be vulnerable to botnet infection attacks, posing significant threats to the security of the environments they are deployed in. A botnet is a network of devices compromised by malware and controlled by a remote commander, the botmaster. Once compromised, the devices, or bots, can be commanded to do virtually anything, from sending spam, stealing credentials, infecting other devices, performing Distributed Denial-of-Service (DDoS) attacks, to mining cryptocurrencies. IoT botnets are particularly risky and they impose significant threats because they can grow very large rapidly and can execute powerful attacks. For instance, a DDoS attack launched by a Mirai IoT botnet against the dynamic DNS provider Dyn in 2016 caused a few hours of downtime of the popular websites Twitter, Netflix, and Reddit. The aim of the thesis is to find an effective countermeasure to IoT botnets by (1) investigating the operation and characteristics of IoT botnets, the challenges in countering IoT botnets, the knowledge gaps, and the limitations of existing solutions, and (2) designing and evaluating effective anti-botnet solutions in an IoT context which address the knowledge gaps and overcome the limitations of existing solutions. To this end, the thesis has made three novel contributions. The first is the design, implementation, and evaluation of a novel framework, Bot-CA, for automated, real-time capturing and analysis of IoT botnet samples. The analysis of the captured botnet samples identifies indicators of compromise and attack, along with anti-analysis, persistence, and anti-forensics techniques. These features can make botnet detection and analysis, as well as infection remedy more effective. To facilitate botnet suspension and tracking, the framework reports the findings to a blacklist and abuse service and threat intelligence platforms. The experimental evaluation of the framework has shown that it can effectively capture and analyse a wide range of IoT botnet samples. In the first experiment, the framework was exposed to attacks from real IoT botnets for seven months. During this period, Bot-CA captured 4168 unique samples from IoT botnets propagating on the Internet, and successfully analysed and reported 98% of the captured samples, or 4077. In the second experiment, concerned with the sample capturing capability, the framework successfully captured samples from all infection attacks executed against it in a controlled environment. Despite the automated analysis of botnet samples, the analysis results still need to be interpreted manually for new botnet variants to be identified. The large quantity of unique botnet samples discovered daily makes this task infeasible for malware analysts. To overcome this challenge, as the second novel contribution of this thesis, we have designed, implemented, and evaluated a novel method, Bot-BC, for automated behaviour based clustering of IoT botnet samples. The method is aimed to enable the identification of IoT botnet variants equipped with new capabilities. Bot-BC abstracts the behaviour of the botnet samples as behaviour profiles that describe the actions performed by the samples, vectorises the behaviour profiles using the Term Frequency-Inverse Document Frequency (TF-IDF) technique, and clusters the TF-IDF vectors using the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm. The proposed method has been evaluated using a collection of samples captured from IoT botnets propagating on the Internet. The evaluation has shown that Bot-BC can automatically identify IoT botnet variants equipped with new capabilities, allowing security researchers to investigate the new capabilities, and to apply the investigation findings to enhance the solutions for detecting IoT botnets. Although the findings of the botnet sample analysis can be applied to blacklists and malware signatures to make the botnet detection more effective, the Bot-CA framework may not capture all IoT botnet samples, and thus not all infection vectors may be identified. To overcome this limitation, as the third novel contribution of this thesis, we have designed, implemented and evaluated a novel system, Bot-DwP, for detecting and preventing IoT botnet attacks in unmonitored small local networks, such as smart home networks. Bot-DwP profiles the benign behaviour of IoT devices as a whitelist of trusted endpoints and blocks connections to non-whitelisted endpoints to prevent botnet infections. Bot-DwP also identifies and reports the bots, botnet servers, and botnet samples involved in the prevented infection attacks to facilitate tracking, suspension, and wide-scale detection of IoT botnets. The effectiveness of Bot-DwP was evaluated experimentally using a testbed comprised of consumer IoT devices. The evaluation results have shown that Bot-DwP successfully detected, prevented, and reported the infection attacks, without affecting the Quality of Service (QoS) of the IoT devices. The efficiency of Bot-DwP was also evaluated, and the results have shown that the overhead imposed by the system is insignificant.
| Date of Award | 6 Dec 2022 |
|---|
| Original language | English |
|---|
| Awarding Institution | - The University of Manchester
|
|---|
| Supervisor | Ning Zhang (Main Supervisor) & Lucas Cordeiro (Co Supervisor) |
|---|