[Paper Review] Machine Learning-Based Early Detection of IoT Botnets Using Network-Edge Traffic

Ayush Kumar, Mrinalini Shridhar+2 more|arXiv (Cornell University)|Oct 22, 2020

Network Security and Intrusion Detection4 citations

TL;DR

EDIMA is a lightweight, two-stage machine learning-based solution for early detection of IoT botnets at the network edge, using aggregate traffic classification and ACF-based analysis to identify scanning and C2 communication with near 100% accuracy and low false positives. It achieves low detection delay and minimal RAM usage on a Raspberry Pi, outperforming existing methods in robustness and efficiency.

ABSTRACT

In this work, we present a lightweight IoT botnet detection solution, EDIMA, which is designed to be deployed at the edge gateway installed in home networks and targets early detection of botnets prior to the launch of an attack. EDIMA includes a novel two-stage Machine Learning (ML)-based detector developed specifically for IoT bot detection at the edge gateway. The ML-based bot detector first employs ML algorithms for aggregate traffic classification and subsequently Autocorrelation Function (ACF)-based tests to detect individual bots. The EDIMA architecture also comprises a malware traffic database, a policy engine, a feature extractor and a traffic parser. Performance evaluation results show that EDIMA achieves high bot scanning and bot-CnC traffic detection accuracies with very low false positive rates. The detection performance is also shown to be robust to an increase in the number of IoT devices connected to the edge gateway where EDIMA is deployed. Further, the runtime performance analysis of a Python implementation of EDIMA deployed on a Raspberry Pi reveals low bot detection delays and low RAM consumption. EDIMA is also shown to outperform existing detection techniques for bot scanning traffic and bot-CnC server communication.

Motivation & Objective

• To address the growing threat of IoT botnets, especially those leveraging malware like Mirai, Reaper, and Satori, which exploit weak device security and enable large-scale DDoS attacks.
• To design a lightweight, deployable detection system for edge gateways in home networks that enables early botnet detection before full-scale attacks.
• To overcome limitations of host-based security by proposing a network-based, scalable solution suitable for resource-constrained IoT environments.
• To ensure high detection accuracy and low false positive rates even as the number of connected IoT devices increases.
• To evaluate runtime performance on low-cost hardware like the Raspberry Pi to ensure practical deployment feasibility.

Proposed method

• EDIMA employs a two-stage detection mechanism: first, a supervised machine learning classifier (e.g., Random Forest) analyzes aggregate gateway traffic to detect anomalous patterns indicative of bot scanning.
• Second, an Autocorrelation Function (ACF)-based test is applied to individual device traffic to detect periodic bot-CnC communication, even in the presence of noise.
• The system integrates a malware PCAP database of known IoT malware traffic, a feature extractor, a traffic parser, and a policy engine for automated response.
• The ML model is trained using labeled traffic samples from honeypots and retrained periodically to adapt to evolving threats.
• A Python implementation is deployed on a Raspberry Pi to evaluate real-time performance, including detection delay and RAM consumption.
• The architecture is designed to be extensible, allowing updates to detection logic when new CnC protocols or evasion techniques emerge.

Experimental results

Research questions

• RQ1 Can a lightweight, edge-deployable system detect IoT botnet scanning and C2 traffic with high accuracy and low false positive rates?
• RQ2 How does the detection performance of EDIMA scale with an increasing number of IoT devices connected to a single gateway?
• RQ3 Can EDIMA achieve low detection delay and minimal resource consumption on low-end hardware like the Raspberry Pi?
• RQ4 How does EDIMA’s performance compare to existing botnet detection techniques for scanning and C2 communication?
• RQ5 What are the system’s limitations in detecting zero-day malware or evasive variants using adversarial traffic patterns?

Key findings

• EDIMA achieves near 100% detection accuracy for both bot scanning and bot-CnC traffic using Random Forest and other ML models, with a very low false positive rate.
• The detection performance remains robust even when the number of connected IoT devices is more than doubled, indicating strong scalability.
• A Python implementation of EDIMA on a Raspberry Pi exhibits low bot detection delays and minimal RAM consumption, confirming its feasibility for real-world deployment.
• EDIMA outperforms existing detection techniques in both accuracy and reliability for identifying bot scanning and C2 communication traffic.
• The ACF-based method effectively detects periodic CnC signals even when noise is present, provided the noise is uncorrelated with the signal.
• The system is vulnerable to evasion attempts that alter scanning frequency or CnC messaging patterns, but such changes reduce malware efficiency and may compromise CnC control.