  In this work, we present a lightweight IoT botnet detection solution, EDIMA,
which is designed to be deployed at the edge gateway installed in home networks
and targets early detection of botnets prior to the launch of an attack. EDIMA
includes a novel two-stage Machine Learning (ML)-based detector developed
specifically for IoT bot detection at the edge gateway. The ML-based bot
detector first employs ML algorithms for aggregate traffic classification and
subsequently Autocorrelation Function (ACF)-based tests to detect individual
bots. The EDIMA architecture also comprises a malware traffic database, a
policy engine, a feature extractor and a traffic parser. Performance evaluation
results show that EDIMA achieves high bot scanning and bot-CnC traffic
detection accuracies with very low false positive rates. The detection
performance is also shown to be robust to an increase in the number of IoT
devices connected to the edge gateway where EDIMA is deployed. Further, the
runtime performance analysis of a Python implementation of EDIMA deployed on a
Raspberry Pi reveals low bot detection delays and low RAM consumption. EDIMA is
also shown to outperform existing detection techniques for bot scanning traffic
and bot-CnC server communication.
