A Formal Analysis of the Efficacy of Rebooting as a Countermeasure Against IoT Botnets

The Mirai botnet revolutionized the idea of IoT botnets by infecting numerous vulnerable IoT devices in 2016, leading to the rise of many Mirai variants and imitators that plague the current IoT ecosystem. Studying the botnet infection process can greatly aid us in understanding IoT botnet capabilities and the efficacy of currently available countermeasures. However, analyzing IoT botnets is difficult due to their massive scale and the numerous existing heterogeneous IoT devices that can be targeted for infection. In this paper, we model and simulate the dynamic behavior of a Mirai-like botnet infrastructure and various IoT device categories as a network of timed automata in UPPAAL-SMC. To determine the feasibility of rebooting as a countermeasure against botnets, we examine the effectiveness of rebooting on various IoT device networks. The resulting analysis provides a solid understanding of the efficacy and feasibility of rebooting on active and dormant botnet propagation processes.

• Publication year

  2022

• Venue

  ICC 2022 - IEEE International Conference on Communications

• Publication date

  2022-05-16

• Fields of study

  Computer Science, Engineering

• Identifiers
  DOI 10.1109/ICC45855.2022.9838865
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Analyzing the Impact of Cyberattacks on Industrial Control Systems using Timed Automata

  2021cited by this paper
• Quantitative Evaluation of Hajime with Secondary Infectivity in Response to Mirai's Infection Situation

  2019cited by this paper
• Measurement and Analysis of Hajime, a Peer-to-peer IoT Botnet

  2019cited by this paper
• An Analysis of Botnet Models

  2019cited by this paper
• Bot Net of Things – A Survey

  2018cited by this paper
• Mitigating IoT insecurity with inoculation epidemics

  2018cited by this paper
• DDoS in the IoT: Mirai and Other Botnets

  2017influential reference
• Understanding the Mirai Botnet

  2017influential reference
• The Mirai botnet and the IoT Zombie Armies

  2017influential reference
• On modeling and simulation of the behavior of IoT malwares Mirai and Hajime

  2017cited by this paper
• Survey of approaches and features for the identification of HTTP-based botnet traffic

  2016cited by this paper
• A Survey on Botnet Architectures, Detection and Defences

  2015cited by this paper
• Terminology for Constrained-Node Networks

  2014cited by this paper
• Botnets: A survey

  2013cited by this paper
• Lessons from Stuxnet

  2011cited by this paper
• A Survey of Botnet and Botnet Detection

  2009cited by this paper
• Computer Security: Principles and Practice

  2007cited by this paper
• A Tutorial on Uppaal

  2004influential reference
• Computer Virus Propagation Models

  2003cited by this paper
• Formal verification of a TDMA protocol start-up mechanism

  1997cited by this paper
• The Bounded Retransmission Protocol Must Be on Time!

  1997cited by this paper
• A Theory of Timed Automata

  1994cited by this paper
• Measuring and modeling computer virus prevalence

  1993cited by this paper

• A Systematic Review on the Applications of Uppaal

  2025cites this paper
• A comprehensive survey of UPPAAL‐assisted formal modeling and verification

  2024influential citation
• Requirements for Applying SCIA: A Structured Cyberattack Impact Analysis Approach for ICS

  2024cites this paper
• Interplay of Attacker Behaviors and Dependability Attributes in Industrial Control System Impact Analysis

  2024cites this paper
• Single and Combined Cyberattack Impact on Industrial Wastewater Systems

  2023cites this paper
• W-Sec: A Model-Based Formal Method for Assessing the Impacts of Security Countermeasures

  2022cites this paper