  In the rapidly evolving landscape of cyber threats targeting the Internet of
Things (IoT) ecosystem, and in light of the surge in botnet-driven Distributed
Denial of Service (DDoS) and brute force attacks, this study focuses on the
early detection of IoT bots. It specifically addresses the detection of stealth
bot communication that precedes and orchestrates attacks. This study proposes a
comprehensive methodology for analyzing IoT network traffic, including
considerations for both unidirectional and bidirectional flow, as well as
packet formats. It explores a wide spectrum of network features critical for
representing network traffic and characterizing benign IoT traffic patterns
effectively. Moreover, it delves into the modeling of traffic using various
semi-supervised learning techniques. Through extensive experimentation with the
IoT-23 dataset - a comprehensive collection featuring diverse botnet types and
traffic scenarios - we have demonstrated the feasibility of detecting botnet
traffic corresponding to different operations and types of bots, specifically
focusing on stealth command and control (C2) communications. The results
obtained have demonstrated the feasibility of identifying C2 communication with
a 100% success rate through packet-based methods and 94% via flow based
approaches, with a false positive rate of 1.53%.
