PI-BODE: Programmable Intraflow-based IoT Botnet Detection system

Đorđe D. Jovanović1 and Pavle V. Vuletić2

  1. School of Electrical Engineering, Bulevar kralja Aleksandra 73
    11000 Belgrade, Serbia
    {jd185001p}@student.etf.bg.ac.rs
  2. School of Electrical Engineering, Bulevar kralja Aleksandra 73
    11000 Belgrade, Serbia
    {pavle.vuletic}@ etf.bg.ac.rs

Abstract

In this paper, we propose a Programmable Intraflow-based IoT Botnet Detection (PI-BODE) system. PI-BODE is based on the detection of the Command and Control (C&C) communication between infected devices and the botmaster. This approach allows detecting malicious communication before any attacks occur. Unlike the majority of existing work, this detection method is based on the analysis of the traffic intraflow statistical parameters. Such an analysis makes the method more scalable and less hardware demanding in operation, while having a higher or equal level of detection accuracy compared to the packet capture based tools and methods. PI-BODE system leverages programmable network elements and Software Defined Networks (SDN) to extract intraflow features from flow time series in real time, while the flows are active. This procedure was verified on two datasets, whose data were gathered during the time span of more than two years: one captured by the authors of the paper and the other, IoT23.

Key words

Botnet detection, Machine learning, IoT malware, programmable networks

Digital Object Identifier (DOI)

https://doi.org/10.2298/CSIS211116064J

Publication information

Volume 21, Issue 1 (January 2024)
Year of Publication: 2024
ISSN: 2406-1018 (Online)
Publisher: ComSIS Consortium

Full text

DownloadAvailable in PDF
Portable Document Format

How to cite

Jovanović, Đ. D., Vuletić, P. V.: PI-BODE: Programmable Intraflow-based IoT Botnet Detection system. Computer Science and Information Systems, Vol. 21, No. 1, 37–56. (2024), https://doi.org/10.2298/CSIS211116064J