Hunting IoT Botnets with Wide-area-network Flow Data

With the rise of Internet-of-Things (IoT) technology, botnets like Mirai start to exploit IoT devices and pose severe threats to cybersecurity. In this paper, big data analysis is conducted on wide-area-network session records in an attempt to perceive the influence of botnets on the cyberspace. cNetS, a practical analysis system that can detect and profile botnets is introduced. With this system, infected devices are located with their behaviors reconstructed in detail. Data analysis methods employed can serve as a guidance to detect and combat Mirai-like botnets on the full Internet scale.