  The proliferation of insecure Internet-connected devices gave rise to the IoT
botnets which can grow very large rapidly and may perform high-impact
cyber-attacks. The related studies for tackling IoT botnets are concerned with
either capturing or analyzing IoT botnet samples, using honeypots and
sandboxes, respectively. The lack of integration between the two implies that
the samples captured by the honeypots must be manually submitted for analysis
in sandboxes, introducing a delay during which a botnet may change its
operation. Furthermore, the effectiveness of the proposed sandboxes is limited
by the potential use of anti-analysis techniques and the inability to identify
features for effective detection and identification of IoT botnets. In this
paper, we propose and evaluate a novel framework, the IoT-BDA framework, for
automated capturing, analysis, identification, and reporting of IoT botnets.
The framework consists of honeypots integrated with a novel sandbox that
supports a wider range of hardware and software configurations, and can
identify indicators of compromise and attack, along with anti-analysis,
persistence, and anti-forensics techniques. These features can make botnet
detection and analysis, and infection remedy more effective. The framework
reports the findings to a blacklist and abuse service to facilitate botnet
suspension. The paper also describes the discovered anti-honeypot techniques
and the measures applied to reduce the risk of honeypot detection. Over the
period of seven months, the framework captured, analyzed, and reported 4077
unique IoT botnet samples. The analysis results show that some IoT botnets used
anti-analysis, persistence, and anti-forensics techniques typically seen in
traditional botnets.
