DISTR: Detecting multi-stage IoT botnets through contextual traffic and causal analytics

The proliferation of Internet of Things (IoT) devices has introduced more vulnerabilities that can be exploited by cyber attacks, such as botnets. It is imperative to detect these attacks to prevent significant damage. However, existing solutions fail to meet both the efficacy and interpretability goals demanded in the real world. By analyzing the traffic patterns of normal IoT networks and attack traffic, we observe that (1) IoT devices with similar traffic patterns exhibit clustering tendencies; (2) the attack starts with one IoT device as a foothold, then moves to other devices, which proceeds in a progressive manner. Based on these insights, we propose DISTR, a novel framework that detects and validates malicious activities on an IoT device by analyzing behaviors of other devices within the same cluster in the network, which improves the detection accuracy. In addition, by causally correlating anomalies, DISTR is able to reconstruct the progression of IoT botnets. Our evaluations on public datasets, along with those collected from real IoT devices, show that DISTR achieves the detection of IoT attacks accurately, on average with a precision and F1 score of 99.1% and 99.3%, respectively on various attack scenarios, outperforming the state-of-the-art solutions.