  In general, a botnet is a collection of compromised internet computers,
controlled by attackers for malicious purposes. To increase attacks' success
chance and resilience against defence mechanisms, modern botnets have often a
decentralized P2P structure. Here, IoT devices are playing a critical role,
becoming one of the major tools for malicious parties to perform attacks.
Notable examples are DDoS attacks on Krebs on Security and DYN, which have been
performed by IoT devices part of botnets.
  We take a first step towards detecting P2P botnets in IoT, by proposing
AutoBotCatcher, whose design is driven by the consideration that bots of the
same botnet frequently communicate with each other and form communities. As
such, the purpose of AutoBotCatcher is to dynamically analyze communities of
IoT devices, formed according to their network traffic flows, to detect
botnets. AutoBotCatcher exploits a permissioned Byzantine Fault Tolerant (BFT)
blockchain, as a state transition machine that allows collaboration of a set of
pre-identified parties without trust, in order to perform collaborative and
dynamic botnet detection by collecting and auditing IoT devices' network
traffic flows as blockchain transactions.
  In this paper, we focus on the design of the AutoBotCatcher by first defining
the blockchain structure underlying AutoBotCatcher, then discussing its
components.
