Analysis and Characterization of IoT Malware Command and Control Communication

Abstract

The emergence of Mirai botnet in 2016 has took worldwide research teams unaware, proving that a large number of low-performance IoT devices could be hacked and used for illegal means producing extremely voluminous DDoS attacks. Therefore, a thorough inspection of the current state of IoT botnets is essential. In this paper, we analyze the dynamic behavior and command and control channels of two classes of IoT botnets, Mirai and Gafgyt. Based on collected information, a comparative analysis and key phases of botnet communication is provided. Such an analysis will serve as basis for smart botnet detection mechanisms.