N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders

TL;DR

This paper presents a novel network-based anomaly detection method using deep autoencoders to identify IoT botnet attacks in real-time, effectively distinguishing malicious activity from normal network behavior.

Contribution

The paper introduces a new deep autoencoder-based approach for detecting IoT botnet attacks by analyzing network behavior snapshots, with empirical validation on real IoT devices infected by Mirai and BASHLITE.

Findings

Accurately detects IoT botnet attacks in real-time

Effective in distinguishing attack traffic from normal behavior

Validated on nine real IoT devices infected with known botnets

Abstract

The proliferation of IoT devices which can be more easily compromised than desktop computers has led to an increase in the occurrence of IoT based botnet attacks. In order to mitigate this new threat there is a need to develop new methods for detecting attacks launched from compromised IoT devices and differentiate between hour and millisecond long IoTbased attacks. In this paper we propose and empirically evaluate a novel network based anomaly detection method which extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic emanating from compromised IoT devices. To evaluate our method, we infected nine commercial IoT devices in our lab with two of the most widely known IoT based botnets, Mirai and BASHLITE. Our evaluation results demonstrated our proposed method's ability to accurately and instantly detect the attacks as they were being launched from the compromised IoT devices which were part of a botnet.