Improved Mirai Bot Scanner Summation Algorithm

Abstract

Mirai is the most dangerous Distributed Denial of Service (DDoS)-capable IoT malware to date that is in the wild and yet very simple in nature. Mirai attack an array of Internet of Things (IoT) and embedded devices that ranges from Digital Video Recorders (DVRs), Internet Protocol (IP) cameras, routers and printers recruiting them to form a botnet. The biggest DDoS attack in history was executed using Mirai botnet. A recent study proposed the Mirai Bot Scanner Summation Prototype that analyzes the network traffic generated from Mirai bot host discovery. The Mirai Bot Scanner Summation Algorithm however, cannot recognize if a network traffic is truly Mirai bot host discovery traffic or not. Given any network traffic, the Mirai Bot Scanner Summation Prototype will proceed to summate and output number of bots, retransmission packets, number of packets and number of potential victim IoT devices using only the source Internet Protocol (IP) address and destination IP address of a packet without identifying if it is truly a Mirai bot host discovery packet or not. This paper present an Improved Mirai Bot Scanner Summation Algorithm that looks at the packet to determine whether it is a truly packet generated due to Mirai bot host discovery by looking at the TCP flag of the packet and the port number of the packet. To perform a host discovery Mirai bot sends out SYN packet over TELNET port 23 or 2323 to a randomly generated non-governmental IP addresses to establish a TCP 3-way handshake with a potentially vulnerable IoT device. The Improved Mirai Bot Scanner Summation Algorithm uses this condition to determine whether a packet is a Mirai bot host discovery packet or not. The Mirai Bot Scanner Summation Algorithm and the Improved Mirai Bot Scanner Summation Algorithm are evaluated using IoT Network Intrusion Dataset. The evaluation results have shown that the Improved Mirai Bot Scanner Summation Algorithm provides more accurate results than the Mirai Bot Scanner Summation Algorithm.