An approach to analyze and detect BotNet behavior for IoT devices

Other Title(s)

منهج جديد لتحليل و كشف سلوك الروبوتات البرمجة في أجهزة إنترنت الأشياء

Dissertant

Wishah, Ahmad Raji

Thesis advisor

al-Majali, Sufyan

University

Princess Sumaya University for Technology

Faculty

King Hussein Faculty for Computing Sciences

Department

Information Systems Security and Digital Criminology

University Country

Jordan

Degree

Master

Degree Date

2018

English Abstract

The Internet of Things (IoT) is a system that involves a large number of computing devices connected with a network to share data and information to serve a common purpose without requiring human-to-human or human-to-device interaction.

IoT devices are any object that can be assigned an IP address and has the ability to transfer data over network.

Examples of IoT devices are Internet home appliances, Internet-enabled health monitoring devices, printers, sensors, and mobile phones.

IoT systems require less interaction from a human and are exposed to multiple threats.

Threats come from several reasons mainly the simple capability of an IoT device, Internet-connected, remote, and even mobile in some cases.

One of the major threats in security is Botnet Attack.

A botnet attacks happens when a device is lead by BotMaster’s using controls and commands injected with malicious software or a Trojan.

This can lead to Distrusted Denial of Service DDoS attacks, spamming, identity theft, etc.

Recently, IoT networks and systems have been attacked by botnet attacks.

Thus, need to consider the behavior of IoT devices with less human interaction and heterogeneity in IoT devices.

The main idea of this thesis is to create a solution to analyze, classify and detect behavior of botnet in IoT network.

This research studies the feasibility of detecting botnet activity by collecting network traffic in IoT networks and analyzing this data to build profiles to classify the Botnet traffic from normal traffic.

In this thesis, the behavior of two types of IoT applications were studied and analyzed.

The two IoT applications were studied against a common botnet attack called Mirai attack.

A solution of detecting botnet attack is proposed with an datasets for the simulated applications contain 71.5% of abnormal flows of entire dataset and 28.5% of normal flows of entire dataset for HealthCare application, and for smart home application contain 93% of abnormal traffic and 7% of normal traffic for entire dataset.

The accuracy for the proposed solution of detecting botnet attack is 98.35% for HealthCare application and 99.90% for smart home application using machine learning algorithms

Main Subjects

Information Technology and Computer Science

Topics

• Computer software
• Internet

No. of Pages

79

Table of Contents

• APA
• MLA
• AMA

Language

English

Data Type

Arab Theses

Record ID

BIM-833360