Inter
national
J
our
nal
of
Electrical
and
Computer
Engineering
(IJECE)
V
ol.
10,
No.
2,
April
2020,
pp.
2182
2191
ISSN:
2088-8708,
DOI:
10.11591/ijece.v10i2.pp2182-2191
r
2182
SIEM-based
detection
and
mitigation
of
IoT
-botnet
DDoS
attacks
Basheer
Al-Duwairi,
W
afaa
Al-Kahla,
Mhd
Ammar
AlRefai,
Y
azid
Abdelqader
,
Abdullah
Rawash,
Rana
F
ahmawi
Department
of
Netw
ork
Engineering
and
Security
,
Jordan
Uni
v
ersity
of
Science
and
T
echnology
,
Irbid,
Jordan
Article
Inf
o
Article
history:
Recei
v
ed
Aug
10,
2019
Re
vised
Oct
9,
2019
Accepted
Oct
30,
2019
K
eyw
ords:
IoT
botnets
Netw
ork
security
SIEM
ABSTRA
CT
The
Internet
of
Things
(IoT)
is
becoming
an
inte
gral
part
of
our
daily
life
including
health,
en
vironment,
homes,
military
,
etc.
The
enormous
gro
wth
of
IoT
in
recent
years
has
attracted
hack
ers
to
tak
e
adv
antage
of
their
computation
and
communication
capabilities
to
perform
dif
ferent
types
of
attacks.
The
major
concern
is
that
IoT
de
vices
ha
v
e
se
v
eral
vulnerabilities
that
can
be
easily
e
xploited
to
form
IoT
botnets
consisting
of
millions
of
IoT
de
vices
and
posing
si
gnificant
threats
to
Internet
security
.
In
this
conte
xt,
DDoS
attacks
origi
nating
from
IoT
botnets
is
a
major
problem
in
today’
s
Internet
that
requires
immediate
attention.
In
this
paper
,
we
propose
a
Security
Information
and
Ev
ent
Management-based
IoT
botnet
DDoS
attack
detection
and
mitig
ation
system.
This
system
detects
and
blocks
DDoS
attack
traf
fic
from
compromised
IoT
de
vices
by
monitoring
specific
pack
et
types
including
TCP
SYN,
ICMP
and
DNS
pack
ets
originating
from
these
de
vices.
W
e
discuss
a
prototype
implementation
of
the
proposed
syst
em
and
we
demonstrate
that
SIEM
based
solutions
can
be
configured
to
accurately
identify
and
block
malicious
traf
fic
originating
from
compromised
IoT
de
vices.
Copyright
c
2020
Insitute
of
Advanced
Engineeering
and
Science
.
All
rights
r
eserved.
Corresponding
A
uthor:
Basheer
Al-Duw
airi,
Jordan
Uni
v
ersity
of
Science
and
T
echnology
,
Irbid
22110,
Jordan.
T
el:
+962-02-7201000
(Ext.
24000)
Email:
basheer@just.edu.jo
1.
INTR
ODUCTION
Internet
of
things
(IoT)
ha
v
e
witnessed
enormous
gro
wth
in
recent
years.
This
gro
wth
is
due
to
the
significant
de
v
elopment
in
semiconductor
indus
try
,
wireless
communication
technologies
and
the
emer
gence
of
IoT
applications
in
dif
ferent
fields
in
our
daily
life
including:
smart
homes
[1],
health
care
sector
[2],
industrial
control
systems
[3]
and
military
applications
[4].
According
to
Statista
[5],
the
number
of
IoT
de
vices
is
estimated
to
be
about
23
:
4
billion
and
is
e
xpected
to
increase
to
31
billion
de
vices
in
2020.
Moti
v
ated
by
the
significant
gro
wth
of
IoT
,
hack
ers
are
eager
to
tak
e
adv
antage
of
the
computation
and
communication
capabilities
of
IoT
de
vices
to
perform
dif
ferent
types
of
attacks.
Botnets
represent
the
primary
source
of
man
y
attacks
tar
geting
the
Internet.
A
bot
net
is
a
netw
ork
of
compromised
machines
(e.g.
computers,
smartphones,
IoT
de
vices,
etc.)
which
are
control
led
by
an
attack
er
(botmaster)
and
used
to
perform
a
v
ariety
of
acti
vities
such
as
distrib
uted
denial
of
service
(DDoS)
attacks,
spamming,
click
fraud,
and
phishing
attack.
IoT
de
vices
are
creating
a
huge
risk
to
security
compared
to
the
ordinary
Internet
connected
de
vices
because
of
their
lar
ge
number
,
resource
limitation
and
protocol
di
v
ersity
,
which
mak
es
IoT
a
v
aluable
tar
get
for
attack
ers
to
create
IoT
botnet.
F
or
e
xample,
an
attack
er
can
compromise
victim’
s
IoT
smart
home
de
vices
[1]
to
obtain
sensiti
v
e
information,
or
to
use
IoT
de
vices
as
IoT
Botnets
[6]
in
order
to
e
x
ecute
a
distrib
uted
denial-of-
J
ournal
homepage:
http://ijece
.iaescor
e
.com/inde
x.php/IJECE
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Elec
&
Comp
Eng
ISSN:
2088-8708
r
2183
service
attacks
(DDos)
ag
ainst
critical
c
yber
-ph
ysical
systems.
On
October
21,
2016,
Attack
ers
launched
a
DDoS
att
ack
ag
ainst
Dyn
DNS
service
[7]
by
utilizing
Mirari
IoT
botnet
causing
man
y
services
and
internet
platforms
to
be
una
v
ailable
in
Europe
and
North
America.
Pre
vious
research
ef
forts
ha
v
e
focused
on
de
vising
mechanisms
to
detect
vulnerable
or
comprom
ised
IoT
de
vices
or
to
secure
IoT
de
vices
despite
of
their
computing,
storage
and
po
wer
limitations.
IoT
de
vices
usually
e
xchange
dif
ferent
types
of
messages
and
generate
huge
amount
of
data
making
it
dif
ficult
to
monitor
and
correlate
e
v
ents
and
detect
malicious
acti
vities
originating
from
them.
In
this
paper
,
we
address
the
problem
of
DDoS
attacks
origi
nating
from
IoT
botnets
by
using
Se
curity
Information
and
Ev
ent
Managem
ent
(SIEM)
solution
in
such
a
w
ay
to
detect
and
block
attack
traf
fic.
The
main
contrib
utions
of
this
paper
are
as
follo
ws:
(a)
A
SIEM-based
IoT
botnet
detection
system.
The
proposed
system
adopts
Splunk
SIEM
solution
[8]
to
identify
and
block
traf
fic
from
compromised
IoT
de
vic
es
by
monitoring
specific
pack
et
types
including
TCP
SYN,
ICMP
and
DNS
flooding.
(b)
The
implementation
of
a
prototype
of
an
IoT
botnet
detection
system
based
on
the
proposed
Security
Information
and
Ev
ent
Management
(SIEM)
solution,
and
application
of
the
proposed
system
to
detect
three
common
DDoS
attack
types.
(c)
Re
vie
w
of
dif
ferent
aspects
of
IoT
botnets
focusing
mainly
on
IoT
botnet
architectures,
main
types,
countermeasures,
and
discusses
recent
research
ef
forts
in
this
field.
The
rest
of
this
paper
is
or
g
anized
as
follo
ws:
background
information
about
IoT
botnets
and
presents
main
features
and
limitations
of
IoT
de
vices
are
presented
in
Section
2.
Related
w
ork
is
discussed
in
Section
3.
The
proposed
system
and
the
prototype
implementation
of
the
SIEM-based
IoT
Botnet
DDoS
attack
detection
and
mitig
ation
is
discussed
in
Section
4.
Ev
aluation
of
the
proposed
system
is
presented
in
Section
5.
Finally
,
conclusions
are
presented
in
Section
6.
2.
B
A
CKGR
OUND
ABOUT
IO
T
BO
TNETS
Recently
,
IoT
botnets
ha
v
e
emer
ged
as
a
ne
w
type
of
botnets
where
hack
ers
control
millions
of
compromised
IoT
de
vices
and
utili
ze
them
in
their
malicious
attacks.
Generally
,
an
IoT
botnet
consists
of
the
follo
wing
components:
(a)
Bots:
compromised
IoT
de
vices
used
to
perform
the
dif
ferent
types
of
attacks
(e.g.,
denial
of
service).
(b)
Command
and
Control
Serv
er:
Serv
er
used
to
control
the
Bots.
(c)
Scanners:
used
to
scan
for
vulnerable
IoT
de
vices.
(d)
Reporting
Serv
er:
Serv
er
used
to
collect
scanning
reports
from
scanner
or
Bots.
(e)
Loader:
instruct
IoT
de
vices
to
do
wnload
the
mal
w
are
code
after
logging
at
the
vulnerable
IoT
de
vices.
(f)
Mal
w
are
Distrib
ution
Serv
er:
A
serv
er
responsible
for
mal
w
are
distrib
ution.
IoT
de
vices
ha
v
e
been
widely
utilized
in
man
y
lar
ge-scale
DDoS
attacks.
In
these
attacks,
IoT
de
vices
are
instructed
by
the
botmaster
to
flood
a
tar
get
system
with
huge
amount
of
pack
ets
(e.g.
SYN,
DNS,
ICMP
,
etc.).
Zhou
et
al
[9],
d
i
scussed
se
v
eral
features
of
IoT
de
vices
that
contrib
utes
to
the
problem
of
IoT
botnet
s.
These
features
include:
(a)
Constrained
Compared
to
traditional
PCs
and
mobile
de
vices,
IoT
de
vices
usually
ha
v
e
limited
computational
capabilities
and
limited
storage
resources
in
order
reduce
manuf
acturing
costs
and
to
sa
v
e
battery
po
wer
as
much
as
possible.
F
or
e
xample,
IoT
de
vices
deplo
yed
in
a
military
battle
field
or
an
earth
quick
area
are
required
to
w
ork
for
a
long
duration.
Therefore,
po
wer
consumption
of
these
de
vices
should
be
managed
ef
fecti
v
ely
and
po
wer
-consuming
applications
can
not
run
on
such
de
vices
in
o
r
der
to
i
ncrease
battery
life
time.
On
the
other
hand,
IoT
de
vices
used
in
the
medical
sector
are
time-
constrained.
Therefore,
time-consuming
applications
can
not
run
on
such
de
vices
in
order
to
a
v
oid
delay
in
the
response.
Because
of
such
limitations,
we
cannot
deplo
y
the
required
defense
systems
on
these
de
vices
such
as
comple
x
encryption
and
authentication
techniques
that
consume
computing
and
storage
resources,
and
thus
create
man
y
vulnerabilities
that
can
be
e
xploited
by
hack
ers.
(b)
Di
v
ersity
IoT
technology
is
increasingly
used
in
man
y
real
life
applications.
As
a
result,
there
are
man
y
IoT
v
endors
with
lar
ge
number
of
heterogeneous
IoT
products
that
ha
v
e
their
o
wn
netw
ork
and
commu-
nication
protocol
implementations.
In
most
cases,
man
y
of
these
products
do
not
ha
v
e
security
included
in
their
design
.
According
to
a
recent
HP
report
[10],
there
are
se
v
eral
problems
with
IoT
de
vices
deplo
yed
in
today’
s
Internet.
This
includes
lack
of
encryption,
f
ailing
to
change
def
ault
passw
ords,
SIEM-based
detection
and
mitigation
of
...
(Basheer
Al-Duwairi)
Evaluation Warning : The document was created with Spire.PDF for Python.
2184
r
ISSN:
2088-8708
and
lack
of
softw
are
updates.
The
heterogeneity
and
di
v
ersity
of
IoT
netw
orking
and
communication
protocols
mak
es
it
dif
ficult
to
secure
IoT
de
vices
manuf
actured
by
dif
ferent
v
endors
or
to
eliminate
their
vulnerabilities.
(c)
Myriad
This
feature
is
related
to
the
substantial
increase
of
IoT
de
vices
and
the
proliferation
of
data
generated
by
them.
This
feature
combined
with
the
lack
of
security
protection
on
IoT
de
vices
and
their
limited
computational
po
wer
allo
wed
attack
ers
to
c
ompromise
these
de
vices
easily
and
to
create
armyies
of
IoT
zombies
that
could
be
used
to
conduct
se
v
eral
attack
types.
Y
in
et
al
[11]
found
that
most
recent
lar
ge-scale
DDoS
attacks
are
mainly
caused
by
IoT
botnets.
(d)
Unattended
In
man
y
cases,
IoT
de
vices
are
deplo
yed
in
harsh
en
vironments
and
remain
unattended
for
long
period
of
time.
Usually
,
there
is
no
mechani
sm
to
remotely
access
these
de
vices
and
check
their
security
le
v
el
or
perform
re
gular
updates
on
them.
This
has
pro
vided
adv
ersaries
with
additional
reason
to
tar
get
these
de
vices
and
control
them
with
minimal
ef
fort.
F
or
e
xample,
Ronen
et
al
[12]
implemented
an
attack
on
Philips’
s
smart
light
b
ulb
by
e
xploiting
vulnerability
in
the
communication
protocol
and
sho
wed
ho
w
f
ast
the
de
v
eloped
w
orm
can
spread
to
other
b
ulbs.
(e)
Mobility
W
earable
de
vices
and
smartphones
are
e
xamples
of
a
mobile
IoT
de
vices
that
join
and
lea
v
e
netw
orks
dynamically
according
to
the
human
mo
v
ement.
The
mobility
of
IoT
de
vices
imposes
additional
security
threats
because
the
chances
of
mal
w
are
infection
increase
whene
v
er
a
de
vice
becomes
within
the
vicinity
of
another
malicious
de
vice.
Also,
it
increase
hack
ers’
chances
to
compromise
IoT
de
vices.
3.
RELA
TED
W
ORK
There
ha
v
e
been
substantial
amount
of
w
ork
in
the
area
of
IoT
security
.
In
this
section,
we
pro
vide
a
re
vie
w
of
the
recent
adv
ances
in
this
field
focusing
on
detecting
IoT
de
vices’
vulnerabilities,
detecting
IoT
netw
ork
vulnerabilities,
and
detecting
IoT
botnets.
3.1.
Detecting
IoT
de
vices’
vulnerabilities
Static
analysis
of
IoT
de
vices’
frame
w
orks
is
one
of
the
techniques
used
to
detect
IoT
de
vices’
vulner
-
abilities.
F
ore
e
xample,
Costin
et
al.
[13]
performed
a
lar
ge-scale
security
analysis
of
32
thousand
of
firmw
are
images
of
embedded
de
vices,
and
found
38
unkno
wn
vulnerabilities
in
more
than
693
firmw
are
images
which
e
xtend
in
123
dif
ferent
products.
Fernandes
et
al.
[14]
performed
static
source
code
analysis
and
crafted
tests
on
123
smart
Home
platforms
and
499
smart
things
applications.
The
y
disco
v
ered
tw
o
fla
ws
in
the
design
of
these
platforms.
These
design
fla
ws
lead
to
grant
Smart
Things
Application
o
v
er
pri
vile
ged
rather
than
a
separated
pri
vile
ge
as
designed,
beside
the
full
access
of
these
applications
to
the
Smart
Home
De
vice
rather
than
the
limited
access
as
designed.
The
y
also
pro
v
ed
that
the
asynchronous
communication
(e
v
ent
subsystem)
between
de
vices
and
Smart
Applications
is
not
secure
and
could
leak
sensiti
v
e
information.
In
[12],
Ronen
et
al.
described
ho
w
to
e
xploit
a
vulnerability
in
the
implementation
part
of
Zigbee
light
protocol
of
Philips
Hue
smart
lamps
to
perform
a
remote
firm-w
are
update.
Once
the
vulnerability
is
e
xploited,
the
k
e
y
used
by
P
hilips
smart
lamps
w
as
e
xtracted
by
performing
side
channel
attack.
This
k
e
y
is
used
to
encrypt
and
authenticate
the
update.
After
that,
the
w
orm
rapidly
spread
from
the
infected
lamp
to
the
other
lamps
using
their
ZigBee
wireless
connecti
vity
.
Such
attack
enables
an
attack
er
to
control
city
lighting
or
to
e
xploit
the
lamps
to
perform
DDoS
attacks.
Se
v
eral
research
ef
forts
ha
v
e
been
made
to
de
v
elop
Internet
W
ide
Scan
technologies
to
search
for
vulnerable
IoT
de
vices.
Kim
et
al
[15]
proposed
a
model
to
impro
v
e
the
performance
of
the
Internet
W
ide
Scanner
Zmap
[16].
3.2.
Detecting
IoT
netw
ork
vulnerabilities
There
are
se
v
eral
approaches
for
detecting
IoT
netw
ork
vulnerabilities.
F
or
e
xample,
IoT
netw
ork
protocol
vulnerabilities
can
be
detected
using
Fuzzing-based
approach.
In
this
approach,
softw
are
implementa-
tion
of
a
gi
v
en
protocol
is
tested
by
observing
an
y
resulting
e
xception
when
f
alse
data
is
submit
ted
intentionally
to
test
the
softw
are.
Fuzzing-based
approach
includes
tw
o
main
Fuzzing
techniques:
(i)
Mutation-based:
In
this
technique,
f
alse
data
is
injected
randomly
i
n
testing
messages
(ii)
Generating-based:
test
files
are
mainly
generated
by
constructing
messages
that
adhere
to
the
protocol
specifications.
Ho
we
v
er
,
it
contains
random
and
f
alse
data.
The
main
problem
of
this
method
is
that
it
requires
l
ar
g
e
number
of
test
files,
especially
that
each
protocol
has
its
o
wn
message
format.
Therefore,
consuming
considerable
amount
of
time.
Luo
et
al
[17],
proposed
a
technique
that
performs
re
v
erse
engineering
of
IoT
protocols,
to
identify
the
message
format
of
Int
J
Elec
&
Comp
Eng,
V
ol.
10,
No.
2,
April
2020
:
2182
–
2191
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Elec
&
Comp
Eng
ISSN:
2088-8708
r
2185
protocols
and
create
test
file
messages
with
certain
f
aults
according
to
the
message
format.
This
method
reduces
the
size
of
test
files
used
in
the
Fuzzing
approach.
Jia
et
al
[18]
v
erified
the
ef
fecti
v
eness
graph-based
analysis
on
a
smart
home
system
prototype.
The
prototype
consisted
of
a
smartphone
controlling
a
smart
light
pulp
and
a
Google
home
speak
er
.
The
main
idea
of
their
approach
is
to
construct
a
traf
fic
graph
based
on
certain
input
files,
and
to
identify
correlated
sub-graphs.
This
allo
wed
them
to
identify
the
vulnerabilities
based
on
the
sensiti
vity
le
v
el
of
dif
ferent
k
e
yw
ords.
The
y
also
demonstrated
ho
w
to
e
xploit
the
vulnerable
sup-graphs
to
conduct
dif
ferent
attacks.
Li1
et
al
[19]
analyzed
the
traf
fic
of
encrypted
video
stream
for
V
ideo
Surv
eillance
Systems
and
observ
ed
that
the
traf
fic
pattern
is
dif
ferent
for
dif
ferent
user
acti
vity
.
This
means
that
it
is
possible
for
an
attack
er
to
infer
user’
s
information
by
analyzing
t
h
e
traf
fic
s
ize
and
rat
e
e
v
en
in
case
the
traf
fic
is
encrypted.
Apthorpe
et
al
[20]
e
xamined
the
netw
ork
traf
fic
rate
of
se
v
eral
IoT
de
vices
and
found
that
passi
v
e
netw
ork
observ
ers,
could
analyze
the
netw
ork
traf
fic
and
infer
sensiti
v
e
information.
3.3.
Detecting
IoT
botnets
Pre
vious
w
ork
on
the
detection
of
IoT
botnets
can
be
cate
gorized
into:
anomaly-based,
s
ignature-
based,
specification-based,
and
h
ybrid-based
detection.
What
follo
ws
is
a
discussion
of
each
approach.
3.3.1.
Anomaly-based
This
approach
detects
IoT
botnet
by
recognizing
abnormal
beha
vior
in
the
netw
ork.
T
o
achie
v
e
this
goal,
it
is
required
to
profile
the
normal
beha
vior
of
the
IoT
netw
ork
in
adv
ance.
S
ummerville
et
al,
[21]
de
v
eloped
an
ultralight
pack
et
anomaly-based
method
to
detect
abnormal
payload
in
the
pack
et,
using
ef
ficient
matching
technique
for
bit
pattern
requires
only
ADD
operation
follo
wed
by
incremental
counter
,
and
imple-
mented
as
a
look
up
table
for
f
ast
and
fle
xible
pack
et
e
v
aluation.
Sagirlar
et
al,
[22]
proposed
AutoBotCatcher
,
which
utilizes
Block
chain
concept
to
detect
decentralized
P2P
Botnets.
Based
on
the
f
act
that
IoT
bots
within
the
same
botnet
usually
communicate
with
each
other
,
AutoBotCatcher
is
designed
to
detect
botnet
de
vices
and
label
them
as
one
community
by
analysing
netw
ork
traf
fic
e
xchanges
between
dif
ferent
de
vices.
AutoBot-
Catcher
uses
Agents
to
monitor
traf
fic
e
xchanged
between
IoT
de
vices.
These
agents
report
the
information
the
y
collect
as
a
block
chain
transaction
to
a
big
trusted
entity
in
the
netw
ork
called
the
block
generator
,
which
models
mutual
contact
information
of
IoT
de
vice
as
a
mutual
contact
graph.
Then
it
uses
Louv
ain
method
[23]
to
detect
botnet
community
based
on
the
graph.
3.3.2.
Signatur
e-based
P
.
Ioulianou
et
al
[24]
proposed
a
signature-based
IoT
botnet
detection
system
that
utilizes
Intrusion
Detection
Syst
em
(IDS)
technology
that
is
typically
used
to
monit
or
netw
orks
for
kno
wn
malicious
acti
vities
and
polic
y
violations
based
on
matching
attack
signatures.
In
their
system,
the
IDS
modules
are
configured
to
w
ork
in
a
h
ybrid
mode.
The
detection
and
fire
w
all
module
called
Router
IDS
and
the
monitoring
lightweight
module
called
Detector
IDS.
These
modules
are
distrib
uted
in
the
netw
ork
close
to
IoT
de
vices
which
does
not
require
an
y
softw
are
modification
on
sensors
or
de
vices.
Detector
IDS
logs
netw
ork
traf
fic
and
sends
it
to
the
Router
IDS
that
will
detect
malicious
node
beha
vior
if
i
t
resembles
to
a
kno
wn
attack.
Khoshhalpour
et
al,
[25]
proposed
a
host-based
approach
called
BotRe
v
ealer
to
detect
IoT
botnet
in
the
early
infection
step,
using
botnet
life
c
ycle
as
a
general
signature
for
detection.
The
y
analyze
the
running
process
and
netw
ork
acti
vities
on
the
host
based
on
statistical
features
of
pack
et
sequence
and
compare
it
with
the
beha
vior
pattern
of
botnet
traf
fic.
3.3.3.
Specification-based
This
approach
is
similar
to
anomaly-based
approach
b
ut
it
tak
es
into
account
system
specific
ations.
Carli
et
al,
[26]
proposed
an
automatic
interference
technique
for
the
specifications
of
mal
w
are
netw
ork
protocol
using
samples
of
mal
w
are
communication
and
mal
w
are
binaries.
Since
each
mal
w
are
has
its
o
wn
custom
binary
format
and
each
C&C
protocol
has
its
o
wn
mal
w
are
f
amily
,
this
will
pro
vide
a
fingerprint
for
the
mal
w
are
structure
and
intent.
The
y
proposed
a
type
system
field
of
the
message
that
describes
all
field
types
in
the
message,
and
then
use
type
interference
algorithm
to
interfere
message
structure.
Ho
we
v
er
,
most
C&C
netw
ork
traf
fic
is
encrypted
so
the
y
apply
dynamic
traf
fic
analysis
to
e
xtract
C&C
system
k
e
ys.
Prok
ofie
v
et
al
[27]
proposed
a
detection
technique
for
IoT
botnets
during
mal
w
are
propag
ation
stage
where
infected
de
vices
starts
to
e
xploit
other
de
vices
in
the
netw
ork
using
brute
force
attack
strate
gy
.
SIEM-based
detection
and
mitigation
of
...
(Basheer
Al-Duwairi)
Evaluation Warning : The document was created with Spire.PDF for Python.
2186
r
ISSN:
2088-8708
3.3.4.
Hybrid-based
Hybrid-based
IoT
botnet
detection
usually
emplo
ys
tw
o
detection
approaches.
F
or
e
xampe,
signature-
based
IoT
botnet
detection
can
be
combined
with
anaomaly-based
IoT
botnet
detection
or
with
specification-
based
approach.
This
has
the
adv
antage
of
minimizing
f
alse
positi
v
e
and
f
alse
ne
g
ati
v
e
rates
of
the
detection
system.
Sedjelmaci
et
al
[28]
proposed
a
lo
w
ener
gy
consumption
anomaly
and
signature
based
IoT
botnet
detection
system
and
using
g
ame
theory
techniques
to
decide
whet
her
an
IDS
agent
is
required
to
acti
v
ate
anomaly
detection
or
no.
Therefore,
increasing
detection
accurc
y
while
reducing
the
po
wer
consumption
in
IoT
de
vice.
Another
h
ybrid-based
detection
system
w
as
proposed
by
Bostani
et
al
[29].
This
system
combines
anomaly-based
and
specification-
based
intrusion
detection
models
to
detect
attac
k
s
in
IoT
.
The
specification-
based
detection
agent
will
be
located
on
routers
nodes;
it
will
analyze
the
host
node
beha
viour
and
send
the
results
to
the
root
node
where
the
anomaly-based
detection
agent
is
located.
This
agent
is
based
on
the
Map
reduce
architecture
and
emplo
ys
optimum
path
algorithm
using
the
data
sent
by
routers
to
project
clustering
model
and
detect
malicious
beha
viour
using
v
oting
mechanism.
4.
PR
OPOSED
W
ORK:
SIEM-B
ASED
DETECTION
AND
MITIGA
TION
OF
IO
T
BO
TNET
DDOS
A
TT
A
CKS
In
this
section,
we
present
the
proposed
SIEM-based
detection
and
mitig
ation
of
IoT
botnet
DDoS
attacks,
focusing
on
the
system
o
v
erall
architecture
and
a
prototype
implementation.
4.1.
System
ar
chitectur
e
SIEM
systems
are
primarily
used
in
the
security
field
to
correlate
e
v
ents
reported
by
v
arious
netw
ork
security
defense
technologies
(e.g.,
intrusion
detection
systems,
fire
w
alls,
bring
your
o
wn
de
vice
solutions,
operating
systems
syslogs,
etc.)
deplo
yed
within
an
Enterprise
netw
ork.
The
results
of
e
v
ent
correlation
indicate
weather
there
is
a
security
incident
or
no.
There
are
fe
w
recent
research
studies
about
the
use
of
SIEM
solutions
for
IoT
security
(e.g.,
[30,
31]).
These
studies
focused
mainly
on
ef
ficient
deli
v
ery
of
IoT
data
to
the
SIEM
system
for
analysis
and
correlation
of
e
v
ents.
Figure
1
depicts
the
basic
architecture
of
the
proposed
system.
First,
IoT
traf
fic
logs
are
forw
arded
by
the
def
ault
g
ate
w
ay
to
the
SIEM
system.
These
traf
fic
logs
are
obtained
from
v
arious
IoT
de
vices
in
the
monitored
netw
ork
including
IP
cameras,
fingerprint
readers,
b
uilding
management
system
sensors,
etc.
The
SIEM
solution
performs
a
se
q
ue
n
c
e
of
data
processing
tasks
that
include
parsing,
inde
xing,
and
storing
these
logs
in
a
highly
a
v
ailable
secure
database.
The
logs
are
then
analyzed
and
in
case
there
is
an
y
abnormal
beha
vior
compared
to
the
traf
fic
profile
of
the
de
vice
in
question,
it
detects
an
attack
and
alerts
the
netw
ork
administrator
.
DDoS
at
tacks
are
generally
characterized
by
a
high
pack
et
v
olume.
Therefore,
the
detection
of
DDoS
attacks
in
our
system
is
based
on
comparing
the
number
of
pack
ets
of
certain
type
(e.g.,
SYN,
ICMP
,
or
DNS)
that
are
destined
to
a
certain
machine
to
a
predefined
threshold
v
alue.
Once
an
attack
is
detected,
SIEM
mitig
ates
the
ongoing
attack
by
automatically
configuring
the
fire
w
all
application
installed
on
the
def
ault
g
ate
w
ay
such
that
ne
w
rules
are
added
t
o
block
attack
traf
fic.
There
are
multiple
S
IEM
platforms
that
can
g
ather
machine
data.
Figure
1.
System
architecture
Int
J
Elec
&
Comp
Eng,
V
ol.
10,
No.
2,
April
2020
:
2182
–
2191
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Elec
&
Comp
Eng
ISSN:
2088-8708
r
2187
4.2.
Pr
ototype
implementation
An
enterprise
netw
ork
(e.g.,
a
campus
netw
ork)
usually
has
dif
ferent
types
of
IoT
de
vices
such
as
IP
cameras,
temperature
sensors,
fingerprint
attendance
system,
etc.
Monitoring
the
se
de
vices
indi
vidually
w
ould
be
dif
ficult
because
of
traf
fic
heterogeneity
.
In
this
paper
,
we
ha
v
e
implemented
a
prototype
of
an
IoT
botnet
detection
system
based
SIEM
solution.
Our
goal
is
to
sho
w
that
it
is
possible
to
detect
dif
ferent
types
of
malicious
traf
fic
originating
from
v
arious
IoT
de
vices.
A
prototype
implementation
of
the
proposed
systems
is
sho
wn
in
Figure
2.
This
prototype
consists
of
the
follo
wing
main
components:
Figure
2.
Netw
ork
topology
of
the
SIEM-based
IoT
botnet
detection
system
prototype
(a)
IoT
Botnet:
In
an
y
or
g
anizational
netw
ork,
there
are
dif
ferent
types
of
IoT
de
vices
that
are
vulnerable
to
botnet
infection.
In
our
prototype,
we
represented
the
IoT
botnet
by
Raspberry
Pi
v1
which
is
an
open
source
hardw
are
platform
that
can
be
used
for
special
purpose
IoT
de
vices.
W
e
installed
a
bot
code
written
in
Python
scripting
language
on
these
de
vices
to
generate
dif
ferent
types
of
attack
traf
fic
that
include
SYN
flooding,
DNS
fl
oo
di
ng,
and
ICMP
flooding.
In
addition,
we
used
a
Cisco
2520V
camera
with
frame
w
ork
Cisco
V
ideo
Surv
eillance
2421
IP
Dome
camera
in
order
to
generate
background
IoT
traf
fic.
Bots
recei
v
e
commands
in
the
format:
(
type
,
count,
IP
,
data
),
where
type
represent
attack
pack
et
type
(e.g.,
SYN,
DNS,
or
ICMP),
count
specifies
the
number
of
pack
ets
to
be
sent
in
case
of
flooding
attacks,
IP
represents
the
IP
address
of
the
tar
geted
system,
and
data
specifies
the
port
number
if
in
case
of
SYN
flooding
attack,
or
the
domain
in
case
of
DNS
attack,
not
used
in
ping
scan.
Each
bot
runs
a
Python
script
to
conduct
the
attack
based
on
the
parameters
assigned
in
the
command
recei
v
ed
from
the
botmaster
.
(b)
Gateway:
W
e
configured
a
Linux
machine
to
w
ork
as
the
def
ault
g
ate
w
ay
of
the
IoT
de
vices.
The
machine
has
tw
o
netw
ork
interf
aces.
One
Interf
ace
is
f
acing
the
Internet
and
the
other
one
is
f
acing
the
local
netw
ork
where
IoT
de
vices
are
located.
W
e
run
tcpdum
on
this
machine
in
order
to
capture
IoT
traf
fic.
W
e
used
the
command:
bash
tcpdump
{
n
{
e
{
i
n
inter
f
ace
"
>
l
og
f
il
e:l
og
to
capture
all
outgoing
traf
fic
and
sa
ving
it
in
a
logfile
to
be
forw
arded
to
Splunk
serv
er
periodically
.
Here
we
used
the
options
-n
and
-e
in
order
not
to
con
v
ert
the
IP
address
and
to
include
MA
C
addresses
in
the
traf
fic
capture,
respecti
v
ely
.
W
e
installed
and
configured
the
Splunk
forw
arder
on
the
g
ate
w
ay
to
forw
ard
the
generated
traf
fic
log
fil
e
to
the
Splunk
serv
er
.
W
e
specified
t
he
source
type
and
inde
x
on
the
forw
arder
as
the
same
source
type
and
inde
x
we
defined
on
the
Splunk
serv
er
.
The
serv
er
w
as
configured
as
sho
wn
in
Figure
3,
where
port
9997
w
as
used
to
recei
v
e
traf
fic
logs
and
port
8089
for
management.
In
addition,
we
used
IPT
ABLES
to
add
specific
rules
pre
v
enting
abnormal
traf
fic
generated
from
a
specific
IoT
de
vice
and
tar
geting
certain
machine.
Figure
3.
outputs.conf
file
and
deplo
ymentclient.conf
file
SIEM-based
detection
and
mitigation
of
...
(Basheer
Al-Duwairi)
Evaluation Warning : The document was created with Spire.PDF for Python.
2188
r
ISSN:
2088-8708
(c)
SIEM
Solution:
W
e
used
the
well
kno
wn
Splunk
SIEM
solution
[8]
to
a
n
a
lyze
IoT
traf
fic
collected
through
the
g
ate
w
ay
.
Splunk
w
as
installed
on
a
standalone
serv
er
and
w
as
configured
to
present
the
collected
traf
fic
logs
in
a
readable
and
searchable
w
ay
.
This
required
us
to
e
xtract
certain
fields
from
the
IoT
traf
fic
logs
and
present
it
in
Splunk
readable
format.
The
Splunk
system
represents
the
core
of
our
IoT
botnet
detection
prototype.
In
this
re
g
ard,
collected
traf
fic
logs
were
parsed,
inde
x
ed,
and
stored
in
a
secure
database
designed
only
for
high
a
v
ailability
and
real-time
analysis.
Analyzing
this
traf
fic
allo
wed
us
to
understand
the
beha
vior
of
the
monitored
de
vice.
Moreo
v
er
,
Splunk
w
as
configured
to
alarm
the
netw
ork
administrator
about
suspicious
e
v
ents
and
to
automatically
add
defensi
v
e
rules
to
the
fire
w
all
in
order
to
block
attack
traf
fic
originating
from
infected
IoT
de
vices.
(d)
Fir
ewall:
W
e
used
IPT
ABLES
to
implement
the
fire
w
all
where
the
SIEM
is
configured
to
add
specific
rules
to
block
certain
traf
fic
types
in
a
fully
automated
f
ashion
based
on
the
IoT
traf
fic
log
analysis.
Adding/remo
ving
rules
is
done
through
an
SSH
connection
between
the
SIEM
and
the
fire
w
al.
4.3.
Attack
alert
generation
Splunk
SIEM
platform
w
as
configured
to
generate
three
types
of
alerts
in
order
to
notify
netw
ork
administrator
once
an
attack
is
detected.
As
sho
wn
in
Figure
4,
these
alerts
are
ma
inly
for
SYN-flood
attack,
DNS-flood
attack
and
alert
for
ping
scan.
An
alert
w
as
configured
by
defining
a
specific
search
that
is
based
on
pack
et
headers
found
in
the
periodically
recei
v
ed
traf
fic
logs.
Figure
4.
Main
alerts
defined
in
Splunk
platform
F
or
e
xample,
in
the
case
of
SYN-flooding
attack,
an
alert
is
generated
whene
v
er
the
SIEM
platform
detects
that
there
there
is
lar
ge
number
of
SYN
pack
ets
tar
geting
certain
system.
SIEM
reads
the
traf
fic
log
continuously
and
search
about
SYN
pack
ets
originating
from
a
gi
v
en
source
and
tar
geting
a
gi
v
en
destination
(i.e.,
a
one
to
one
rel
ationship)
and
count
them
in
a
specific
period
of
time,
if
the
number
of
pack
ets
e
xceeds
a
predefined
threshold
v
alue,
the
alert
will
send
a
notification
email
for
the
administ
rator
about
the
ongoing
at-
tack.
Th
e
search
of
this
al
ert
is
sho
wn
in
Fi
gure
5.
This
search
c
o
m
mand
is
mainly
to
search
about
pack
ets
with
SYN
flag
set
in
the
traf
fic
logs
that
came
from
the
inde
x
traffic
idx
and
sort
them
based
on
(
Src
MAC,
Src
IP
and
Dst
IP
)
and
count
them.
Matching
results
are
inserted
in
a
special
table,
and
all
entries
with
count
less
than
100
are
remo
v
ed
from
the
table.
Finally
,
the
fields
(Src
MA
C,
Src
IP
and
Dst
IP)
are
e
xtracted
to
be
included
in
the
attack
notification
email
as
sho
wn
in
Figure
6.
Figure
5.
The
search
command
of
SYN
flood
alert
Int
J
Elec
&
Comp
Eng,
V
ol.
10,
No.
2,
April
2020
:
2182
–
2191
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Elec
&
Comp
Eng
ISSN:
2088-8708
r
2189
Figure
6.
Configuration
of
attack
notification
email
details
5.
EV
ALU
A
TION
The
prototype
implementation
described
in
Subsection
4.2.
w
as
used
to
test
the
functionality
of
the
proposed
system.
In
this
prototype,
IoT
bots
were
instructed
to
flood
a
tar
geted
system
with
dif
ferent
types
of
attack
pack
ets.
Then,
IoT
traf
fic
logs
were
forw
arded
periodically
to
the
Splunk
serv
er
.
While
Splunk
platform
comes
with
a
predefined
source
types
(e.g.,
syslog,
apachelog,
etc.),
the
IoT
traf
fic
log
captured
by
tcpdum
could
not
be
recognized
by
Splunk.
Therefore,
we
defined
a
ne
w
source
type
called
“tcpdump
traf
fic”.
Defining
a
ne
w
source
type
can
be
done
by
creating
a
ne
w
file
in
the
configuration
folder
in
SIEM
deplo
yment
this
file
l
ocated
in
“$SPLUNK
HOME/etc/system/local”
the
source
type
helps
the
SIEM
serv
er
in
determine
ho
w
can
the
serv
er
reacts
with
this
kind
of
log.
Also,
we
added
a
special
field
called
stamp
in
each
forw
arded
pack
et
such
that
Splunk
identified
the
source
type
of
the
recei
v
ed
log.
In
Splunk,
it
is
required
to
write
specific
re
gular
e
xpressions
to
e
xtract
certain
pack
et
fields
from
the
traf
fic
logs.
F
or
IoT
botnet
detection,
we
instructed
Splunk
to
e
xtract:
Source
Mac
address
(Src
MA
C),
Destination
Mac
address
(Dst
MA
C),
Source
IP
address
(Src
IP),
Destination
IP
address
(Dst
IP),
Source
port
(Src
port),
Destination
port
(Dst
port).
Figure
7
sho
ws
an
e
xample
of
the
e
xtracted
fields
from
one
of
the
pack
ets.
F
or
each
of
the
attack
types
mentioned
abo
v
e,
we
set
a
threshold
v
alue
for
the
number
of
pack
ets
originating
from
IoT
de
vices.
Once
this
number
e
xceeds
the
threshold
v
alue
a
notification
email
is
sent
to
the
netw
ork
administrator
and
a
filtering
rule
is
automatically
added
to
the
fire
w
all
to
block
attack
traf
fic.
Figure
7.
Main
pack
et
header
fields
e
xtracted
by
Splunk
W
e
tested
the
prototype
by
conducting
dif
frent
types
of
attacks
including
SYN
flooding,
DNS
flooding,
and
ICMP
flooding.
F
or
e
xample,
in
the
case
of
SYN
flooding
attack
the
botmaster
instructed
IoT
de
vice
to
flood
the
tar
get
machine
(IP
address:
10.242.232.144)
with
SYN
pack
ets.
Figure
8
sho
ws
the
wireshark
traf
fic
capture
on
the
tw
o
netw
ork
interf
aces
of
the
Gate
w
ay
side
by
side.
Splunk
alerts
the
administrator
about
this
attack
as
sho
wn
in
Figure
9
and
a
filtering
rule
is
added
automatically
to
IPT
ABLES
in
order
to
block
attack
traf
fic
as
sho
wn
in
Figure
10.
Dealing
with
other
attacks
w
as
done
in
a
similar
w
ay
.
Figure
8.
A
wireshark
traf
fic
capture
of
SYN
flooding
attack
traf
fic
from
Internet
side
and
IoT
netw
ork
side
SIEM-based
detection
and
mitigation
of
...
(Basheer
Al-Duwairi)
Evaluation Warning : The document was created with Spire.PDF for Python.
2190
r
ISSN:
2088-8708
Figure
9.
A
Splunk
generated
email
alert
about
ongoing
SYN
flooding
attack
Figure
10.
A
filtering
rule
is
added
automatically
to
iptables
in
order
to
block
attack
traf
fic.
6.
CONCLUSIONS
W
ith
the
rapid
adoption
of
IoT
de
vices
in
our
daily
life,
there
is
a
gro
wing
concern
from
e
xploiting
vulnerabilities
of
these
de
vices
to
form
IoT
botnets
and
perform
dif
ferent
types
of
attacks.
DDoS
attacks
originating
from
IoT
botnets
represent
an
imminent
threat
for
today’
s
Internet
because
of
the
attack
ers
ability
to
generate
high
pack
et
v
olume
from
millions
of
compromised
IoT
de
vices.
In
this
paper
,
we
proposed
a
SIEM
based
system
to
detect
and
mitig
ate
this
type
of
attacks.
The
proposed
system
detects
and
blocks
DDoS
attack
traf
fic
from
compromised
IoT
de
vices
by
monitoring
specifi
c
pack
et
types
including
TCP
SYN,
ICMP
and
DNS
pack
ets
originating
from
these
de
vices.
Also,
W
e
discussed
a
prototype
implementation
of
the
proposed
system
sho
wing
ho
w
the
SIEM
based
solutions
can
be
configured
to
accurately
identify
and
block
malicious
traf
fic
originating
from
compromised
IoT
de
vices.
In
addition,
we
discussed
recent
adv
ances
in
the
field
of
IoT
botnets
focusing
mainly
on
main
methods
to
disco
v
er
IoT
de
vices’
vulnerabilities
and
main
approaches
to
detect
IoT
botnets.
REFERENCES
[1]
H.
Lin
and
N.
Ber
gmann.
IoT
pri
v
ac
y
and
security
challenges
for
smart
home
en
vironments.
Information
,
7(3):44,
2016.
[2]
S.
Bak
er
,
W
.
Xiang,
and
I.
Atkinson.
Internet
of
things
for
smart
health
care:
T
echnologies,
challenges,
and
opportunities.
IEEE
Access
,
5:26521–26544,
2017.
[3]
H.
Bo
yes,
B.
Hallaq,
J.
Cunningham,
and
T
.
W
atson.
The
industrial
internet
of
things
(iiot):
An
analysis
frame
w
ork.
Computer
s
in
Industry
,
101:1–12,
2018.
[4]
S.
Cha,
S.
Baek,
S.
Kang,
and
S.
Kim.
Security
e
v
aluation
frame
w
ork
for
military
iot
de
vices.
Security
and
Communication
Networks
,
2018,
2018.
[5]
IoT
:
num
ber
of
connect
ed
de
vices
w
orldwide
2012-2025
—
statista.
https://www
.statista.com/statistics/471264/iot-number
-of-connected-de
vices-w
orldwide/.
(Accessed
on
03/09/2019).
[6]
K.
Angrishi.
T
urning
Internet
of
things
into
Internet
of
vulnerabilities
(Io
vV
:
IoI
botnets.
arXiv
pr
eprint
arXiv:1702.03681
,
2017.
[7]
2016
dyn
c
yberattack
-
wi
k
i
pedia.
https://en.wikipedia.or
g/wiki/2016
Dyn
c
yberattack.
(Accessed
on
03/09/2019).
[8]
Splunk
SIEM
solution,
https://www
.splunk.com/.
(Accessed
on
09/18/2019)
[9]
W
ei
Zhou,
Y
an
Jia,
Anni
Peng,
Y
uqing
Zhang,
and
Peng
Liu.
The
ef
fect
of
iot
ne
w
features
on
security
and
pri
v
ac
y:
Ne
w
threats,
e
xisting
soluti
ons,
and
challenges
yet
to
be
solv
ed.
IEEE
Internet
of
Things
J
ournal
,
2018.
Int
J
Elec
&
Comp
Eng,
V
ol.
10,
No.
2,
April
2020
:
2182
–
2191
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Elec
&
Comp
Eng
ISSN:
2088-8708
r
2191
[10]
E.
Fernandes,
J.
Jung
and
A.
Prakash.
Security
Analysis
of
Emer
ging
Smart
Home
Applications.
In
2016
IEEE
Symposium
on
Security
and
Privacy
(SP)
,
pages
636–654.
IEEE,
2016.
[11]
Y
.
.M
P
a
P
a,
S.
Suzuki,
K.
Y
oshioka,
T
.
Matsumoto,
T
.
Kasama,
and
C.
Rosso
w
.
IoTPO
T
:
Analyzing
the
Rise
of
IoT
Compromises.
In
9th
f
USENIX
g
W
orkshop
on
Of
fensive
T
ec
hnolo
gies
(
f
W
OO
T
g
15)
,
2015.
[12]
E.
Ronen,
A.
Shamir
,
A.
W
eing
arten,
and
C.
O’Flynn.
IoI
Goes
Nuclear:
Creating
a
Zigbee
Chain
Reaction.
In
2017
IEEE
Symposium
on
Security
and
Privacy
(SP)
,
pages
195–212.
IEEE,
2017.
[13]
A.
Costin,
J.
Zaddach,
A.
Francillon,
and
D.
Balzarotti.
A
Lar
ge-Scale
Analysis
of
the
Security
of
Em-
bedded
Firmw
ares.
In
23r
d
f
USENIX
g
Security
Symposium
(
f
USENIX
g
Security
14)
,
pages
95–110,
2014.
[14]
E.
Fernandes,
J.
Jung,
and
A.
Prakash.
Security
Analysis
of
Emer
ging
Smart
Home
Appl
ications.
In
2016
IEEE
Symposium
on
Security
and
Privacy
(SP)
,
pages
636–654.
IEEE,
2016.
[15]
H.
Kim,
T
.
Kim,
and
D.
Jang.
An
Intelligent
Impro
v
ement
of
Internet-W
ide
Scan
Engine
for
F
ast
Disco
v-
ery
of
V
ulnerable
IoT
De
vices.
Symmetry
,
10(5):151,
2018.
[16]
Z.
Durumeric,
M.
Baile
y
,
and
J.
A.
Halderman.
An
Internet-W
ide
vie
w
of
Internet-W
ide
Scanning.
In
Pr
oceedings
of
the
23r
d
USENIX
Confer
ence
on
Security
Symposium
,
SEC’14,
pages
65–78,
Berk
ele
y
,
CA,
USA,
2014.
USENIX
Association.
[17]
J.
Luo,
C.
Shan,
J.
Cai,
and
Y
.
Liu.
IoT
Application-Layer
Protocol
V
ulnerability
Detection
Using
Re
v
erse
Engineering.
Symmetry
,
10(11):561,
2018.
[18]
Y
.
Jia,
Y
.
Xiao,
J.
Y
u,
X.
Cheng,
Z.
Liang,
and
Z.
W
an.
A
No
v
el
Graph-based
Mechanism
for
Identifying
T
raf
fic
V
ulnerabilities
in
Smart
Home
IoT
.
In
IEEE
INFOCOM
2018-IEEE
Confer
ence
on
Computer
Communications
,
pages
1493–1501.
IEEE,
2018.
[19]
H.
Li,
Y
.
He,
L.
Sun,
X.
Cheng,
and
J.
Y
u.
Side-Channel
Information
Leakage
of
Encrypted
V
ideo
Stream
in
V
ideo
Surv
eillance
Systems.
In
IEEE
INFOCOM
2016-The
35th
Annual
IEEE
Internati
on
al
Confer
ence
on
Computer
Communications
,
pages
1–9.
IEEE,
2016.
[20]
N.
Apthorpe,
D.
Reisman,
and
Nick
Feamster
.
A
Smart
Home
is
no
Castle:
Pri
v
ac
y
V
ulnerabilities
of
Encrypted
IoT
T
raf
fic.
arXiv
pr
eprint
arXiv:1705.06805
,
2017.
[21]
D.
Summerville,
K.
M.
Zach,
and
Y
.
Chen.
Ultra-Lightweight
Deep
pack
et
Anomaly
Detection
for
In-
ternet
of
Things
De
vices.
In
2015
IEEE
34th
International
P
erf
ormance
Computing
and
Communications
Confer
ence
(IPCCC)
,
pages
1–8,
Dec
2015.
[22]
G.
Sagirlar
,
B.
Carminati,
and
E.
Ferrari.
Autobotcatcher:
Blockchain-based
P2P
Botnet
Detection
for
the
Internet
of
Things.
CoRR
,
abs/1809.10775,
2018.
[23]
V
.
Blondel,
J.
Guillaume,
R.
Lambiotte,
and
E.
Lefeb
vre.
F
ast
unfolding
of
communities
in
lar
ge
netw
orks.
J
ournal
of
Statistical
Mec
hanics:
Theory
and
Experiment
,
2008(10):P10008,
oct
2008.
[24]
P
.
Ioulianou,
V
.
V
asilakis,
I.
Moscholios,
and
M.
Logothetis.
A
Signature-based
Intrusion
Detection
System
for
the
Internet
of
Things.
2018.
[25]
H.
R.
Shahriari
and
E.
Khoshhalpour
.
Botre
v
ealer:
Beha
vioral
Detection
of
Botnets
based
on
Botnet
Life-Cycle.
The
ISC
International
J
ournal
of
Information
Security
,
10(1):55–61,
2018.
[26]
L.
De
Carli,
R.
T
orres,
G.
Modelo-Ho
w
ard,
A.
T
ong
aonkar
,
and
S.
Jha.
Botnet
Protocol
Inference
in
the
Presence
of
Encrypted
T
raf
fic.
In
IEEE
INFOCOM
2017
-
IEEE
Confer
ence
on
Computer
Communica-
tions
,
pages
1–9,
May
2017.
[27]
A.
O.
Prok
ofie
v
,
Y
.
S.
Smirno
v
a,
and
V
.
A.
Suro
v
.
A
Method
to
Detect
Internet
of
Things
Botnets.
In
2018
IEEE
Confer
ence
of
Russian
Y
oung
Resear
c
her
s
in
Electrical
and
Electr
onic
Engineering
(EIConRus)
,
pages
105–108,
Jan
2018.
[28]
H.
Sedjelmaci,
S.
M.
Senouci,
and
M.
Al-Bahri.
A
Lightweight
Anomaly
Detection
T
echnique
for
Lo
w-
Resource
IoT
De
vices:
A
Game-Theoretic
Methodology
.
In
2016
IEEE
International
Confer
ence
on
Com-
munications
(ICC)
,
pages
1–6,
May
2016.
[29]
H.
Bostani
and
M.
Sheikhan.
Hybrid
of
Anomaly-based
and
Specification-based
IDS
for
Internet
of
Things
Using
Unsupervised
OPF
based
on
MapReduce
Approach.
Computer
Communications
,
98:52–71,
jan
2017.
[30]
D.
S.
La
vro
v
a,
“
An
approach
to
de
v
eloping
the
SIEM
system
for
the
Internet
of
Things,
”
Automatic
Control
and
Computer
Sciences,
v
ol.
50,
no.
8,
pp.
673–681,
2016.
[31]
P
.
Ze
gzhda,
D.
Ze
gzhda,
M.
Kalinin,
A.
Pechenkin,
A.
Minin,
and
D.
La
vro
v
a,
“Safe
inte
gration
of
SIEM
systems
with
Internet
of
Things:
Data
aggre
g
ation,
inte
grity
control,
and
bioinspired
safe
routing,
”
in
Proceedings
o
f
the
9th
International
Conference
on
Security
of
Information
and
Netw
orks,
SIN
2016,
pp.
81–87,
USA,
July
2016.
SIEM-based
detection
and
mitigation
of
...
(Basheer
Al-Duwairi)
Evaluation Warning : The document was created with Spire.PDF for Python.