  The widespread adoption of Internet of Things has led to many security
issues. Recently, there have been malware attacks on IoT devices, the most
prominent one being that of Mirai. IoT devices such as IP cameras, DVRs and
routers were compromised by the Mirai malware and later large-scale DDoS
attacks were propagated using those infected devices (bots) in October 2016. In
this research, we develop a network-based algorithm which can be used to detect
IoT bots infected by Mirai or similar malware in large-scale networks (e.g. ISP
network). The algorithm particularly targets bots scanning the network for
vulnerable devices since the typical scanning phase for botnets lasts for
months and the bots can be detected much before they are involved in an actual
attack. We analyze the unique signatures of the Mirai malware to identify its
presence in an IoT device. The prospective deployment of our bot detection
solution is discussed next along with the countermeasures which can be taken
post detection. Further, to optimize the usage of computational resources, we
use a two-dimensional (2D) packet sampling approach, wherein we sample the
packets transmitted by IoT devices both across time and across the devices.
Leveraging the Mirai signatures identified and the 2D packet sampling approach,
a bot detection algorithm is proposed. Subsequently, we use testbed
measurements and simulations to study the relationship between bot detection
delays and the sampling frequencies for device packets. Finally, we derive
insights from the obtained results and use them to design our proposed bot
detection algorithm.
