# Dissecting Mirai: Spatio-Sequential Analysis and Restoration Strategies Using MITRE ATT&CK and D3FEND

Zoé Lagache, Pierre-Henri Thevenon, Maxime Puys, Oum-El-Kheir Aktouf

► To cite this version:

Zoé Lagache, Pierre-Henri Thevenon, Maxime Puys, Oum-El-Kheir Aktouf. Dissecting Mirai : Spatio-Sequential Analysis and Restoration Strategies Using MITRE ATT&CK and D3FEND. 30th Nordic Conference on Secure IT Systems (NordSec), Nov 2025, Tartu, Estonia. hal-05325504

HAL Id: hal-05325504

https://uca.hal.science/hal-05325504v1

Submitted on 22 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Dissecting Mirai: Spatio-Sequential Analysis and Restoration Strategies Using MITRE ATT&CK and D3FEND

Zoé Lagache¹[0009-0007-8238-988X], Pierre-Henri Thevenon¹[0000-0002-4390-5622], Maxime Puys²[0000-0001-6127-9816], and Oum-El-Kheir Aktouf³[0000-0002-0493-9096]

¹ Univ. Grenoble Alpes, CEA-Leti, 38000 Grenoble, France
{zoe.lagache,pierre-henri.thevenon}@cea.fr

² Univ. Clermont Auvergne, CNRS, Clermont Auvergne INP, Mines Saint-Etienne, LIMOS, F-63000 Clermont-Ferrand, France maxime.puys@uca.fr

³ Univ. Grenoble Alpes, Grenoble INP, LCIS, 26000 Valence, France
oum-el-kheir.aktouf@lcis.grenoble-inp.fr

**Abstract.** The Mirai botnet has emerged as one of the most persistent and evolving threats targeting Internet of Things devices. Originally designed to orchestrate large-scale Distributed Denial of Service attacks, Mirai compromises devices by exploiting weak credentials and other vulnerabilities. Following the public release of its source code in 2016, numerous variants have proliferated, broadening its attack surface and complicating detection and mitigation efforts. Despite extensive research on Mirai, existing analyses remain fragmented and informal, lacking a structured representation of its attack patterns. This gap hinders the development of precise detection mechanisms and automated response strategies, leaving defenders with ad-hoc solutions rather than systematic countermeasures. In this paper, we present a formalized analysis of Mirai's tactics, techniques, and procedures using the MITRE ATT&CK framework. Our work introduces a spatio-sequential analysis of Mirai's attack flow, correlating adversary techniques with impacted assets through D3FEND. Additionally, we propose CACAO playbooks encoding systematic response and recovery actions to counter Mirai infections. To validate our approach, we implement a test environment using Wazuh IDS, demonstrating the effectiveness of our detection rules and automated recovery mechanisms.

**Keywords:** Recovery · Restoration · IoT · Response · Embedded Systems · Cybersecurity · Autonomous System

## 1 Introduction

Since its first appearance in 2016, the Mirai botnet malware has become one of the most notorious threats targeting Internet of Things (IoT) devices. Initially weaponized to launch massive Distributed Denial of Service (DDoS) attacks,
Mirai infected devices such as routers, cameras, and other embedded systems by exploiting weak or default credentials, among others. Over time, Mirai has undergone significant evolution, with its source code leaked in late 2016, enabling malicious actors to create variants and expand its attack surface. The general workflow of Mirai involves scanning for vulnerable devices, exploiting them to gain access, and subsequently enlisting these devices into a botnet that can be remotely controlled to execute attacks. Despite its widespread impact and continuous adaptations, the community lacks a formalized and structured understanding of Mirai's attack patterns, which has hampered the development of effective detection and mitigation strategies.

To address modern threats like Mirai, frameworks such as MITRE ATT&CK, D3FEND, and CACAO provide a foundation for describing, detecting, and responding to cyberattacks. The MITRE ATT&CK framework categorizes adversary behaviour into Tactic, Technique, Procedure (TTP), offering an understanding of attack workflows. D3FEND complements this by mapping countermeasures these TTPs, and providing spatial information, enabling defenders to link vulnerabilities to actionable defense strategies. CACAO extends this approach to enable the automation of defensive actions through interoperable playbooks that encode recovery and response strategies. Combined, these frameworks provide a robust foundation for formalizing attack behaviours and their corresponding countermeasures, which can be leveraged to dissect and mitigate Mirai.

Despite the existence of several descriptions and analyses of Mirai in the literature, most related works remain informal and fragmented, lacking the precision required to derive actionable countermeasures or automated recovery mechanisms. These descriptions often focus on high-level overviews of Mirai's behaviour or its variants, without addressing the specific spatio-sequential characteristics of its attack flow or formalizing its TTPs in a way that could be directly utilized by Intrusion Detection Systems (IDSs) or incident response frameworks. The absence of this formalization leaves a significant gap in the ability to design accurate detection signatures or implement systematic recovery strategies.

*Contributions:* In this paper, we provide an innovative and formalized description of the Mirai botnet malware and propose actionable methods to detect, respond to, and recover from its attacks. Our contributions are as follows:

1. **Formalization of Mirai TTPs:** we present a structured formalization of Mirai's TTPs using the MITRE ATT&CK framework;

2. **Spatio-Sequential analysis using MITRE ATT&CK and D3FEND:** we analyze the timely ordering of Mirai's attack steps (sequential dimension) via ATT&CK, linked with a spatial mapping of affected assets through D3FEND;

3. **Response and recovery mechanisms:** we propose a response and recovery orchestration algorithm and CACAO playbooks encoding a systematic set of actions to stop Mirai attacks and restore affected systems based on our formalized TTPs;
4. **Validation Testbench**: we developed a validation environment to demonstrate the effectiveness of our response and recovery mechanisms through a suite of scripts and configurations using the Wazuh IDS.

*Outline:* The rest of the paper is organized as follows. Section 2 reviews the state-of-the-art in response and recovery orchestration architectures and playbook generation, alongside literature on Mirai. Section 3 provides a detailed description of Mirai, including its global behaviour, TTPs, and spatio-sequential analysis. Section 4 outlines recovery and response strategies using D3FEND, and CACAO playbooks. Section 5 evaluates these strategies in a testbed. Sections 6 and 7 discuss the results and conclude with a summary and future directions.

## 2 Related Work

In the domains of malware analysis and restoration, contributions can be categorized into distinct approaches: Mirai analyses, orchestration of intrusion response and remediation, system's autonomy in responding to attacks, and playbooks generation. The following paragraphs present several works for each category.

A significant part of the scientific literature on Mirai concerns its detailed analysis, mechanisms to detect it or system hardening to prevent it. Papers [1, 8, 10, 11] concentrate specifically on network analysis of Mirai. In [11], authors examine the evolving sophistication of IoT botnets, highlighting Mirai's use of Command and Control (CNC) and evasion techniques against detection. Detection methodologies are further explored in [3], which compares syntactic analysis and semantic analysis. A hybrid approach, prioritizing lightweight syntactic filtering before applying semantic analysis, is proposed. We can also mention [1], which emphasizes systemic failures in IoT security practices and advocates for regulatory measures alongside technical defenses, like mandatory credential rotation or traffic filtering to mitigate future botnets. Some researches focus on using deep learning for Mirai detection [13, 17]. As an example, [13] investigates an effective and scalable approach to detecting Mirai malware strains.

Another part of the state-of-the-art concerns the remediation from intrusion, with a significant number of works using optimization [2, 5, 14, 18] to solve system restoration problems, where the goal is often to minimize the impact of an attack and the recovery actions, and maximize the efficiency of the restoration. As an example, Chevalier [5] proposes a method for detecting and surviving intrusions. The solution is designed for Linux services with predefined costs and performance, including response against malicious behaviour (from experts) or malware-induced costs on specific services (manually set). Other researchers choose to apply a filtering approach [9, 19] to select only legitimate behaviours, like CRIU-MR [19]. This solution, based on Checkpoint Restore in User Space (CRIU), is capable to checkpoint processes and to restore them with a filter applied during the recovery phase so that the malicious processes are not restored.

On the autonomous response side, numerous studies [4, 7, 12, 16, 20] also propose solutions. For instance, Empl et al. [7] created the SOAR4IoT platform
in order to investigate how traditional Security Orchestration, Automation and
Response (SOAR) can be effectively adapted to IoT assets. For this goal, they
utilize IDSs to gather security information, and Digital Twins of IoT devices or
networks for which they generate playbooks. In [16], the idea is to extend a fall-
back solution implemented for Industrial Control Systems (ICS). In one of their
previous works, the authors present a solution that enters in fallback mode when
a detector sends an alert. In this extension, a Virtual Operation Unit is created
including another incident detector. Thus the system can move from a fallback
state into a "testing" state, in which it is tested to check if it triggers again the
incident detector. If not, the system moves back to the normal operation mode.

Finally, the articles [6, 15] present solutions for generating playbooks from
standardized frameworks. Saint-Hilaire et al. [15] wrote a paper in which they
produce playbooks from MITRE Detection, Denial, and Disruption Framework
Empowering Network Defense (D3FEND) countermeasures, Vulnerability De-
scription Ontology (VDO) vulnerabilities and R&ACT<fnref n="4" /> categories. The ap-
proach generates all possible playbooks from the list of actions selected by match-
ing D3FEND and VDO, ensuring each playbook exceeds a remediation impact
threshold. The Pareto front is then used to identify the optimal playbooks.

Analysis of existing work reveals several gaps in current research on restora-
tion strategies. While prior studies provide insights into Mirai's behaviour, they
lack a formalized approach to describing its techniques and spatial enrichment.
Most analyses focus on network behaviour without leveraging structured frame-
works such as MITRE Adversary Tactics, Techniques and Common Knowledge
(ATT&CK) and D3FEND, thus limiting their interoperability. Furthermore, al-
though some studies propose mechanisms to automate parts of the recovery
process, the majority of solutions either require human intervention or, when
not, are tightly coupled to specific detection methods. This dependence on pro-
prietary or predefined detection techniques reduces adaptability and makes these
solutions difficult to generalize across different environments. Finally, while play-
books are increasingly considered, their execution remains challenging. Many
approaches outline high-level responses without ensuring machine-executability,
often relying on human intervention. These limitations underscore the need for
standardized, autonomous, and executable recovery solutions that can operate
independently of specific detection mechanisms while ensuring structured and
repeatable responses to cyberattacks.

3 Analysis of Mirai

Mirai is a botnet whose first public report appeared in 2016. Its goal is to infect IoT networks, spread and create bots from devices in order to use them to launch DDoS attacks. Its intricate architecture, composed of multiple interconnected elements that exploit numerous vulnerabilities, combined with its available and well-structured source code, make it a compelling case study for analysis.

<footnote n="4">⁴ https://atc-project.github.io/atc-react/, accessed on 2025-10-02</footnote>
## 3.1 Global Mirai Description

The Mirai malware is composed of three main parts, as indicated by the structure of its source code<fnref n="5" />: a loader which connects to vulnerable devices and downloads the bot malware on them, the bot, i.e. the part of the program that runs on vulnerable devices, tries to register them as a bot and finds other vulnerable devices among its neighbours, and a CNC server whose role is to record and keep track of bots and attacks in a database and launch DDoS attacks.

The loader connects to a first device from which the attackers got a remote access with a dictionary-based attack, and the bot program is downloaded through HTTP. A HTTP server serves the bot binary that correspond to the device architecture. The loader then waits for the bots to send new devices credentials from scans, and repeat the same operation for each of them.

The bot starts with detection escaping actions: it hides itself by deleting its own binary and disables watchdogs to prevent the device from restarting. This way, it can persist in the program memory of the device. Moreover, it prevents debugging by blocking SIGINT and SIGTRAP signals. Finally, it forks to create 3 children with distinct roles: the killer child, which looks for and kills the programs using ports 22, 23 and 80. It also looks for other specific malwares, such as QBOT or Remaiten; the attack child, whose goal is to execute the CNC orders for DDoS attacks; the scanner child, in charge of parsing the network in order to discover other vulnerable devices.

Finally, the CNC server coordinates the communication between the infected IoT devices (the bots) and the attacker. Infected devices connects back to the CNC server to register themselves as part of the botnet by sending a message to identify as a new bot. The CNC server maintains a database, storing information such as IP addresses, device type, and communication status, allowing the attacker to monitor the botnet. It uses TCP to issue commands to infected devices and a custom DNS server is configured for the bots to resolve the CNC server address. This makes the traffic appear normal and harder to detect.

## 3.2 Mirai TTPs

We map the behaviour of Mirai on the MITRE ATT&CKv16 Enterprise matrix, and provide the resulting data in Table 1. It should be observed that some Tactics of the matrix are not represented, indicating the absence of Techniques for these Tactics within the Mirai description. The selection of ATT&CK Technique is determined by a process of filtering, keeping only the techniques pertaining to the assets associated with Mirai. Then the final selection is made by reading the Technique description and choosing the ones that correspond most to the behaviour of Mirai as exposed in its source code. In light of the considerations detailed in Section 3.1, Mirai's TTPs are the following:

- **T1133: External Remote Services**: the Loader uses Telnet to connect to the vulnerable devices;

<footnote n="5">⁵ https://github.com/jgamblin/Mirai-Source-Code, accessed on 2025-10-02</footnote>
- T1078.001: Valid Account (Default Account): it connects to the device thanks to a list containing default or known passwords;

- T1059.008: Command and Scripting Interpreter (Network Device CLI): it executes all the commands through Telnet;

- T1071.001: Application Layer Protocol (Web): it uploads the bot binary from an HTTP server;

- T1105: Ingress Tool Transfer: it uploads the bot binary on the device.

- T1562.001: Impair Defenses (Disable of Modify Tool): the Bot binary disables the watchdog;

- T1070.004: Indicator Removal (File): it deletes its own binary;

- T1110: Brute Force: when trying to discover new vulnerable devices, it uses brute force with a list of default or known passwords to find credentials;

- T1057: Process Discovery: it parses the /proc directory in order to find specific processes;

- T1018: Remote System Discovery: it sends SYN TCP packets in order to discover new vulnerable devices;

- T1489: Service Stop: it kills programs using port 22, 23 and 80.

- T1490: Inhibit System Recovery: this Technique is paired with the T1562.001 as we consider the watchdogs as part of the recovery capabilities of the system.

- T1583.005: Acquire Infrastructure (Botnet): the main goal of the CNC is to form a Botnet;

- T1071.004: Application Layer Protocol (DNS): the connection to the CNC uses a DNS server;

- T1498.001: Network DoS (Direct Network Flood): the CNC commands the botnet to execute a DDoS. Since this Technique is associated to a distributed system perspective, it will not be covered in the rest of this analysis, as the focus of this work is on a host-based solution.

<table><caption>Table 1. Techniques and Tactics of Mirai from MITRE ATT&CK Enterprise Matrix</caption><thead><tr><th>Resource Initial<br>Develop. Access</th><th>Execution</th><th>Defense<br>Evasion</th><th>Credential<br>Access</th><th>Discovery</th><th>C&C</th><th>Impact</th></tr></thead><tbody><tr><td>T1583.005</td><td>T1133<br>T1078</td><td>T1059.008<br>T1562.001</td><td>T1070.004</td><td>T1110</td><td>T1057<br>T1018</td><td>T1071.001<br>T1071.004<br>T1105</td><td>T1489<br>T1498.001<br>T1490</td></tr></tbody></table>

## 3.3 Mirai Attack Dependency and Sequence Graph

To understand the execution flow and dependencies between Mirai's ATT&CK Techniques, we construct a directed graph that captures both the sequential execution order and logical dependencies among the ATT&CK Techniques. We indicate the dependencies and sequential execution flow between all ATT&CK
Techniques of Mirai’s proper execution as the directed graph $G = (V, E)$, represented in Figure 1. $V$ is the set of vertices where each round-shaped vertex correspond to one Mirai ATT&CK Technique, and square-shaped vertices denote auxiliary actions not directly mapped to ATT&CK Techniques, included for clarity. The edges set $E$ includes $E_d$ and $E_s$, which are defined as follows.

- **Sequential Edges ($E_s$):** For $u, v \in V$, an edge $(u \to v) \in E_s$ signifies that a Technique *u* precedes *v* in execution order.

- **Dependency Edges ($E_d$):** For $u, v \in V$, an edge $(u \to v) \in E_d$ indicates that a Technique *v* depends on *u*. This implies both logical dependency and sequential ordering since *u* must precede *v*.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Mirai Dependency and Sequential Graph Enhanced with non-ATT&CK Actions</figcaption></figure>

Thus, dependency relations are a subset of sequential relations ($E_d \subseteq E_s$) with additional constraints. This means that every dependency edge $(u \to v) \in E_d$ implies a sequential edge $(u \to v) \in E_s$. This representation enable an efficient decision making on the responses and recoveries selection and execution order that is described in Section 3.4.

## 3.4 Mirai Spatial Description

Effective response and recovery strategies require a comprehensive understanding of how Mirai operates within a system, including which system components it affects. In this section, we explain how spatial elements are identified and categorized using D3FEND. The process of creating such perspective was made by selecting D3FEND Artifacts. Indeed, the number of Artifacts and their various layers of hierarchy is substantial, hence a selection had to be made to limit their number, and the number of generated countermeasures in D3FEND. This selection is done according to the following criteria:
- only the Artifacts associated to Mirai ATT&CK Techniques are considered;

- the D3FEND' Artifacts that only have a relationship with the *Model, Harden* or *Deceive* D3FEND Tactics are excluded, since these Tactics are not of interest in terms of recovery or response;

- when the detail of an Artifact is not crucial for successful response, or recovery of an ATT&CK Technique, we opt for the Artifact holding a higher, or less specific, hierarchical rank. For example, we choose "System Call" over "Create Process". This step is not mandatory, but facilitates the understanding and helps the countermeasure selection presented in Section 4.1.

This process can be partially automated, as D3FEND proposes several ways to query their database, such as a REST API <fnref n="6" />. Only the last step cannot be achieved this way and would necessitate the implementation of classification techniques. The selection yielded the following refined set of Artifacts that are relevant to Mirai's Techniques, and serve as the foundational elements of Mirai's spatiality: *Network Session, Network Traffic, Socket, User Account, File, Configuration File, Process, Executable Script, System Call*. It should be noted that it was necessary to add the link between the *Process* Artifact and T1489, since this Technique is not initially associated to any Artifact.

The incorporation of D3FEND Artifacts into Mirai's analysis is a subject of interest, as it facilitates detection and system response and recovery. By associating them with their respective Mirai Techniques, as outlined in our mapping, we gain a clear understanding of what to look for during detection and restoration.

# 4 Mirai Response and Recovery

In this Section, we explain how we utilize D3FEND to obtain a first set of countermeasures from the Artifacts and TTP to properly respond to and recover from Mirai. Subsequently, the global solution architecture is described. We also present how to exploit the spatio-sequential analysis in order to orchestrate the countermeasures, and some derived Collaborative Automated Course of Action Operations (CACAO) playbooks developed.

## 4.1 D3FEND Countermeasures for Mirai

To effectively respond and recover Mirai's TTPs, we leverage the D3FEND framework to identify relevant countermeasures. The D3FEND Countermeasures first selection is obtained by filtering out the Countermeasures not related to Mirai's ATT&CK Techniques and corresponding Artifacts. Then, we only keep those from the *Evict, Isolate* and *Restore* categories. Table 2 lists the D3FEND selected Countermeasures for a given Technique and Artifact. Finally, a last selection has to be done to reduce the Countermeasures number to a maximum of one per D3FEND category per Technique in order to keep them applicable with the tools available for our use case, and avoid their concurrences.

<footnote n="6">⁶ https://d3fend.mitre.org/api-docs/, accessed on 2025-10-02</footnote>
This step must be made according to the targeted system and with the help of the system's administrator to identify what restoration resources are available. The countermeasures are indicated in the Table 2 last column. We can observe that not all types of D3FEND considered categories present a Countermeasure, meaning that no Countermeasures exist for this category. In some cases, we added relations between Techniques and existing Artifacts, and in consequence Countermeasures, to improve the selection. Changes include the addition of the Restore Process countermeasure, linked to the Process Artifact and T1489, and the relation between T1562.001 and T1490 and the Configuration File Artifact.

<table><caption>**Table 2.** Mirai Response and Recovery</caption><thead><tr><th>ATT&CK Techniques</th><th>D3FEND Artifacts</th><th>D3FEND Countermeasures</th></tr></thead><tbody><tr><td>T1133</td><td>Network Session</td><td>Session Termination (Evict)</td></tr><tr><td>T1078</td><td>User Account</td><td>Unlock Account (Restore); Account Locking (Evict)</td></tr><tr><td>T1059.008</td><td>Executable Script</td><td>File Eviction (Evict); Executable Denylisting (Isolate)</td></tr><tr><td>T1071.001; T1071.004; Network Traffic T1110; T1498.001; T1105</td><td>Network Traffic Filtering (Isolate)</td><td>Network Traffic Filtering (Isolate)</td></tr><tr><td>T1562.001; T1490</td><td>Configuration File</td><td>Restore Configuration (Restore); System Call Filtering (Isolate)</td></tr><tr><td>T1070.004</td><td>File</td><td>Restore File (Restore); File Eviction (Evict)</td></tr><tr><td>T1057, T1018</td><td>System Call</td><td>System Call Filtering (Isolate)</td></tr><tr><td>T1489</td><td>System Call; Process</td><td>Restore Process (Restore); System Call Filtering (Isolate)</td></tr></tbody></table>

(Isolate), (Evict) and (Restore) correspond to the D3FEND categories of countermeasures.

## 4.2 Proposed Solution

Our solution is illustrated in Figure 2, with the various components that constitute it and their interactions. It incorporates a Security Operation Center (SOC), composed of the ATT&CK Techniques identifier and our main restoration script. The restoration script implements the algorithm derived from the spatio-sequential analysis and detailed in Section 3.4. The attacker machine is represented and embeds Mirai's Loader, binary server and CNC. Finally, the IoT device holds playbooks with their executor and the Host-based Intrusion Detection System (HIDS). The Mirai Bot is not initially present on the device; it is delivered during the attack phase via the Loader and binary server. The execution flow begins with the attacker machine launching the attack, followed by the HIDS recording malicious logs, and the Techniques identifier detecting the intrusion. Subsequently, it triggers our restoration script which sends which playbooks to execute to the executor, which in turn executes them.
<figure><img src="image_3.png" /><figcaption>Fig. 2. Solution Architecture</figcaption></figure>

**Algorithm:** As presented in Algorithm 1, it determines the response and recovery countermeasures to apply during run time. The circumstances in which they should be employed are based on the last detected ATT&CK Technique. In this algorithm, we distinguish the techniques employed in the past, those currently being detected, and those that are anticipated to emerge in the future based on our knowledge of the Mirai malware. For these three distinctions, we apply different types of response and recovery according to the D3FEND *Restore*, *Evict* and *Isolate* categories. Indeed, if some malicious activities happened in the past, we want to recover from them using Restoration playbooks, detailed in Section 5.1. For future threats, we prefer to isolate what could be incoming through the Isolation playbooks, and we suppress the ongoing activity employing the Eviction playbooks. We determine which Technique belongs to which time by using the graph in Figure 1. This way, we can obtain the future techniques by getting the **descendants** of the vertex corresponding to the Technique being detected, while we can obtain the past techniques by getting its **ancestors**.

Considering our use case, the detection of some Techniques such as **T1133: External Remote Services** or **T1078: Valid Accounts** can be confused with a normal behaviour, like a technician intervention for application update. Blocking an access or a technician account could highly impact the availability of the device. Thus, we added a threshold Technique before which no responses or recoveries are applied and once reached, all past Techniques are recovered and evicted. In other words, the restoration process starts when we are more confident in the malicious activity. In our case, this threshold is set to the **T1059.008** Technique, which corresponds to the Bot execution. This algorithm can be de-
scribed as the pseudo-code 1. An example demonstrating outputs provided by
our implementation of this algorithm is provided in Figure 4.

**Algorithm 1** Mirai Main Restoration Algorithm

**In:** ATT&CK Technique *t*

**Out:** D3FEND countermeasures list *restorations*

**Internal variables:** *mirai* is the Mirai dependency and sequence graph;
*restorationsMap* is the mapping associating techniques with countermeasures

1: *restorations* = ∅
2: *past* = *mirai.ancestors*(*t*)
3: *threshold* = *T*1059.008
4: **if** *threshold* not in *past* and *t*! = *threshold* **then**
5: **return** ∅
6: **else**
7:     *present* = [*t*]
8:     *future* = *mirai-descendants*(*t*)
9:     **if** *t* == *threshold* **then**
10:     *present* = *present* + *past*
11:    **else**
12:        **for** *i* in *past* **do**
13:            *restorations.append*(*restorationsMap*[*i*][*recover*])
14:            **end for**
15:        **for** *i* in *present* **do**
16:            *restorations.append*(*restorationsMap*[*i*][*evict*])
17:            **end for**
18:        **for** *i* in *future* **do**
19:            *restorations.append*(*restorationsMap*[*i*][*isolate*])
20:            **end for**
21:        **end if**
22:    **end if**
23: **return** *restorations*

Let $G = (V, E)$ be Mirai's dependency graph, the algorithmic complexity of this algorithm is $O(|V| + |E|)$. In fact, its complexity is the sum of the complexity of all the operations and functions that make it up. In the worst execution case, lines 2 and 8 require the same number of operations as parsing the entire $G$ graph, which is $O(|V| + |E|)$. The loops at lines 4, 12, 15 and 18 can take up to $|V|$ operations, thus giving a total of:

$$|V| + |E| + 4|V| = 5|V| + |E| = \mathcal{O}(|V|/+|E|) \quad (1)$$

With regard to spatial complexity, the requirement is for the graph named *mirai*, the Techniques-Countermeasures mapping *restorationsMap* and the *past*, *present*, *future* lists structures. Their items number is bounded to $|V|$, $3|V|$ and $3|V|$ respectively. Consequently, the total spatial complexity is $O(|V|)$.
**CACAO Playbooks:** To facilitate an autonomous and structured response to Mirai infection, we designed a set of CACAO playbooks categorized into three main types derived from the D3FEND countermeasures categories Isolate, Evict, and Restore respectively for *Isolation*, *Eviction* and *Restoration* playbooks. Each playbook is mapped to specific Technique countermeasures. The *Isolation Playbooks* have as objective to contain the malware and prevent further compromise of the system, in accordance with the D3FEND countermeasures of the *Isolate* category. The majority of these playbooks include network filtering mechanisms (e.g. firewall rules) and those that regulate resource access (e.g. system call filtering). The *Eviction Playbooks* execute immediate remediation actions upon detecting malicious activity. They are associated to the *Evict* D3FEND countermeasures category and address the Techniques by neutralizing ongoing threats, including session termination to cut attacker access or deletion of Mirai-related files. Finally, the *Restoration Playbooks* facilitate the restoration of system functionality our restoration playbooks focus on reversing malicious modifications. These correspond to the *Restore* D3FEND countermeasures, ensuring the recovery of critical files that may have been altered or deleted, whilst preserving essential system configurations and binaries. Additionally, the *Restoration Playbooks* restart legitimate processes that might have been terminated, thus enabling the system to return to a stable and operational state. This way, these playbooks can recover the processes killed by Mirai and recover configurations that were modified for the purpose of evading detection.

By integrating these CACAO playbooks, our framework achieves a structured and automated approach to restore from a Mirai infection. The playbooks not only provide immediate mitigation but also contribute to system resilience by ensuring that recovery steps are executed without manual intervention.

# 5 Evaluation

In this section, the procedure for evaluating the solution presented in Section 4 is outlined. Firstly, the testbed utilised for conducting the experiments is presented in Section 5.1, followed by the evaluation of the efficiency of the restoration process, and the presentation of the results in Section 5.2.

## 5.1 Experiment Setup

Experiments are conducted on a controlled environment to replicate Mirai's attack lifecycle and evaluate the recovery framework. The setup, illustrated in Figure 3, comprises the components described in the following paragraphs.

*The hardware components* are composed of a *Raspberry Pi* 4 Model B with 4GB of RAM, a Broadcom BCM2711 processor with quad-core Cortex-A72 and running a Raspbian Bookworm OS, employed as a representation of an IoT device that is compromised by the Mirai malware. The playbooks designed to counteract the Mirai malware are executed on this device. In addition, *Dell*
Latitude 7490 computer with 16GB of RAM, an Intel Core i7-8650U CPU and running an Ubuntu 24.04.1 LTS OS is configured to simulate the attacker's device and run the Wazuh manager.

The software components include the Mirai malware for which the source code is available<sup>7</sup>, and has been slightly adapted in order to ensure compatibility with our IoT environment. The alterations that have been made include some modifications to update the code for current compilers and adaptations to our testbed (e.g. changing the Loader IP address). Furthermore, we adjusted the DNS to isolate Mirai to our testbed and prevent its propagation on the Internet. Moreover, the Wazuh SIEM tool<sup>8</sup> is used as a rule-based IDS to detect Mirai's TTPs. The Wazuh agent<sup>v4.9.1</sup> is installed on the Raspberry Pi to monitor system logs, sockets, and processes activity while the Wazuh manager<sup>v4.10.1</sup> runs on the computer. In order to detect Mirai's Techniques, Wazuh detection rules were implemented, allowing to correctly identify **13 of Mirai's 15 TTPs**. Indeed, our solution is host-based, and T1583.005 would necessitate a distributed perspective to be detected, while T1071.004 require to be able to detect DNS packets among a network traffic which is not a native feature of Wazuh. This setup addition diverges slightly from reality, as Mirai's originally impacted devices may not have implemented host-based IDS. However, regulations such as the Cyber Resilience Act now imposes more pressure over IoT security. Thus, discussing security measures such as the incorporation of IDSs with embedded systems designers is crucial, especially when considering critical IoT. In addition, the restoration script is composed of a Syslog server and the algorithm defined in Section 4.2, both written in Python. The *The playbooks* include isolation playbooks, for which we developed dynamic network traffic filtering mechanisms using `iptables`. The Eviction playbooks have been designed to swiftly execute a series of countermeasures that include the deletion of harmful files, abrupt termination of compromised sessions, and the locking down of affected accounts, leveraging common shell commands (e.g. `usermod -L` to lock down user accounts, or `kill` for process termination). The Restoration playbooks focus on file and configuration recovery, and process restart. They are built on common Linux tools, such as `systemctl` for service restart, or `cp` for file recovery, and ensure that the IoT device can quickly bounce back from disruptions caused by Mirai. Finally, the *COSSAS SOARCA* SOAR<sup>9</sup> is utilized as an executor that is fed with CACAO playbooks. These playbooks are launched automatically upon receipt of alerts from the Wazuh manager.

## 5.2 Experiments and Results

To evaluate the framework's accuracy, we measure the *restoration timeliness*, defined as the time taken by the main restoration script to execute the countermeasures selection algorithm presented in Section 4.2. We conducted four

<footnote n="7"><sup>7</sup> https://github.com/jgamblin/Mirai-Source-Code, accessed on 2025-10-02</footnote>

<footnote n="8"><sup>8</sup> https://wazuh.com/, accessed on 2025-10-02</footnote>

<footnote n="9"><sup>9</sup> https://github.com/COSSAS/SOARCA, accessed on 2025-10-02</footnote>
<figure><img src="image_4.png" /><figcaption>Fig. 3. Experiment Setup</figcaption></figure>

iterations of the Mirai attack, which triggered the algorithm a total of 52 times upon detection of Mirai's ATT&CK Techniques. To allow the full attack to unfold and ensure that each ATT&CK Technique is correctly mapped to its corresponding playbooks, the playbooks were not executed for this evaluation. The framework successfully identified and assigned playbooks for each detected Technique. The results show an average execution time of **610 microseconds** per detected Technique, with a median of **116 microseconds**, demonstrating its efficiency in autonomous response and recovery selection.

An example output of our tool is provided Figure 4. The figure depicts the sequence of operations performed by the program, including the detected ATT&CK Techniques (in red), the computed playbook names (in purple), formed by the name of the associated Technique and the countermeasures it is part of, and the timestamps of these events (in black) in milliseconds. The output demonstrates that the tool successfully identifies and computes restorations.

# 6 Comparison with Related Works

Our proposed approach enhances autonomous response and recovery from Mirai by leveraging structured playbooks and standardized attack representations. In this section, we compare our results with the state-of-the-art in two key areas: Mirai analysis and autonomous restoration.

Our analysis of Mirai diverges from prior state-of-the-art research in its standardized approach to describe the attack. While previous studies have conducted network traffic analyses [1, 10, 11], none have leveraged security standardized frameworks such as ATT&CK and D3FEND to systematically categorize Mirai's Tactics and Techniques. By integrating these frameworks, our analysis enhances reproducibility, interoperability, and alignment with cybersecurity best practices. Additionally, while prior works examine Mirai's network behaviour, they do not clearly define the spatial distribution of attack components. Our approach, by analyzing Mirai's source code<fnref n="10" />, explicitly maps both sequential

<footnote n="10">¹⁰ https://github.com/jgamblin/Mirai-Source-Code, accessed on 2025-10-02</footnote>
<figure><img src="image_5.png" /><figcaption>Fig. 4. Execution Example</figcaption></figure>

and spatial aspects of its lifecycle as presented in Section 3.4, which provides a
more comprehensive perspective on its operation within IoT environments.

Moreover, the evaluation of our recovery framework demonstrates an average
610 µs restoration efficiency. In comparison, each phase in [9] and [16] takes
at least several tens of seconds. Unfortunately, these are the only two articles
allowing a fair comparison for this result as other state-of-the-art works lack
full autonomy [5, 19] or focus on hardening against Mirai [7], and not restoring
from it. In addition, part of this literature propose solutions which are tightly
coupled with their own detection systems [9, 16]. Our approach, in contrast,
achieves fully autonomous response and recovery while remaining distinct from
the detection tool used thanks to our use of structured frameworks, as long as it
can obtain TTPs sequences. By structuring attacks based on MITRE ATT&CK,
our framework can adapt to various detection systems without requiring specific
integration efforts. This flexibility enhances its applicability across different IoT
environments, making it more resilient and scalable than prior works that rely
on proprietary or ad-hoc detection-restoration couplings.

Finally, the executability of our playbooks further differentiate our approach
from the state-of-the-art. Existing playbook generation solutions either lack
structured executable playbooks [15] or require human intervention to properly
manage the playbook execution flow [6]. Our approach, based on the CACAO
playbook standard, ensures that the complete response and recovery are both
machine-readable and fully automatable. By integrating these structured play-
books with SOARCA, we eliminate the need for manual intervention, thus en-
abling a truly autonomous recovery process. In contrast, previous solutions often
provide response guidelines without formalizing them into executable workflows,
limiting their practical deployment in real-time attack scenarios.

Overall, our work advances autonomous solutions for restoration, ensuring
fully executable playbooks, and introducing a structured, frameworks-based ap-
proach to malware analysis. These contributions address critical gaps in existing
research and provide a foundation for more resilient IoT recovery mechanisms.

7 Conclusion

The Mirai botnet remains a significant threat to IoT ecosystems, exploiting vulnerabilities to orchestrate large-scale attacks. Existing analyses often overlook the spatial dimension of its behaviour which hinders the development of systematic detection and restoration strategies. In this paper, we addressed these gaps by formalizing Mirai's TTPs through the MITRE ATT&CK and D3FEND frameworks, establishing a structured taxonomy of its attack lifecycle. Our spatio-sequential analysis associates the temporal progression of techniques with their spatial footprint, mapping Mirai's actions to compromised assets via D3FEND Artifacts. This dual perspective not only clarifies how Mirai interacts with system components but also identifies critical junctures for deploying targeted countermeasures. To operationalize these insights, we developed CACAO-based playbooks that encode automated response and recovery workflows, validated in a controlled testbed environment using the Wazuh IDS and SOARCA. By integrating standardized frameworks like ATT&CK, D3FEND, and CACAO, our approach ensures interoperability across security tools and reproducibility in diverse IoT environments. This reduces dependence on ad-hoc solutions and empowers organizations to respond dynamically as attacks unfold.

However, this solution presents some limitations. First of all, the evaluation
include solely one malware: the original Mirai variant. Future work will focus
on generalizing this methodology to other malware families with models that
could represent complex attack behaviours, including parallel execution paths
and conditional dependencies. Other next steps include improving the experi-
ments setup by adding or simulating several IoT devices to better underline the
malware propagation and global restoration of a network, since an important
part of IoT devices are deployed in distributed environments. Automating the
malware analysis process will also be necessary to facilitate this process' ac-
cessibility. Specifically, parts of the Artifacts refinement and Countermeasures
selection can be improved using machine learning techniques.

**Acknowledgement.** This work was supported by the French National Research Agency under the France 2030 program projects IRT Nanoelec (ANR-10-AIRT-05), MIAI Cluster (ANR-23-IACL-0006) and SUPERVIZ (ANR-22-PECY-0008).
References

1. Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., Kallitsis, M., Kumar, D., Lever, C., Ma, Z., Mason, J., Menscher, D., Seaman, C., Sullivan, N., Thomas, K., Zhou, Y.: Understanding the mirai botnet. In: 26th USENIX security symposium (USENIX security 17). p. 10931110. USENIX Association, Vancouver, BC (Aug 2017), https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis

2. Balepin, I., Maltsev, S., Rowe, J., Levitt, K.: Using specification-based intrusion detection for automated response. In: Vigna, G., Kruegel, C., Jonsson, E. (eds.) Recent Advances in Intrusion Detection. p. 136154. Springer, Berlin, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45248-5_8

3. Ben Said, N., Biondi, F., Bontchev, V., Decourbe, O., Given-Wilson, T., Legay, A., Quilbeuf, J.: Detection of mirai by syntactic and behavioral analysis. In: 2018 IEEE 29th International Symposium on Software Reliability Engineering (ISSRE). pp. 224–235 (2018). https://doi.org/10.1109/ISSRE.2018.00032

4. Cao, H., Jindal, A., Hu, H., Piran, M.J., Yang, L.: Secure and intelligent service function chain for sustainable services in healthcare cyber physical systems. IEEE Transactions on Network Science and Engineering 10(5), 26742684 (Sep 2023). https://doi.org/10.1109/TNSE.2022.3189546

5. Chevalier, R., Plaquin, D., Dalton, C., Hiet, G.: Intrusion Survivability for Commodity Operating Systems. Ph.D. thesis, Université Paris-Saclay (2020), https://inria.hal.science/hal-03085774

6. Empl, P., Schlette, D., Stöger, L., Pernul, G.: Generating ics vulnerability playbooks with open standards. International Journal of Information Security 23(2), 12151230 (2024). https://doi.org/10.1007/s10207-023-00760-5

7. Empl, P., Schlette, D., Zupfer, D., Pernul, G.: Soar4iot: Securing iot assets with digital twins. In: Proceedings of the 17th International Conference on Availability, Reliability and Security. p. 110. ACM, Vienna Austria (Aug 2022). https://doi.org/10.1145/3538969.3538975

8. Frank, C., Nance, C., Jarocki, S., Pauli, W.E., Madison, SD.: Protecting IoT from mirai botnets; IoT device hardening. In: Proceedings of the Conference on Information Systems Applied Research, Austin, TX, USA. p. 1508 (2017)

9. Goel, A., Po, K., Farhadi, K., Li, Z., De Lara, E.: The taser intrusion recovery system. In: Proceedings of the Twentieth ACM Symposium on Operating Systems Principles. pp. 163–176 (2005). https://doi.org/10.1145/1095810.1095826

10. Kelly, C., Pitropakis, N., McKeown, S., Lambrinoudakis, C.: Testing and hardening iot devices against the mirai botnet. In: 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security). p. 18. IEEE, Dublin, Ireland (Jun 2020). https://doi.org/10.1109/CyberSecurity49315.2020.9138887

11. Kolias, C., Kambourakis, G., Stavrou, A., Voas, J.: Ddos in the iot: Mirai and other botnets. Computer 50(7), 8084 (2017). https://doi.org/10.1109/MC.2017.201

12. Lekidis, A., Mavroeidis, V., Fysarakis, K.: Towards incident response orchestration and automation for the advanced metering infrastructure. In: 2024 IEEE 20th International Conference on Factory Communication Systems (WFCS). p. 18. IEEE, Toulouse, France (Apr 2024). https://doi.org/10.1109/WFCS60972.2024.10540775

13. Palla, T.G., Tayeb, S.: Intelligent mirai malware detection for iot nodes. Electronics 10(11) (2021). https://doi.org/10.3390/electronics10111241, https://www.mdpi.com/2079-9292/10/11/1241
14. Sahu, A., Huang, H., Davis, K., Zonouz, S.: Score: A security-oriented cyber-physical optimal response engine. In: 2019 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm). pp. 1–6 (2019). https://doi.org/10.1109/SmartGridComm.2019.8909814

15. Saint-Hilaire, K.A., Neal, C., Cuppens, F., Boulahia-Cuppens, N., Hadji, M.: Optimal automated generation of playbooks. In: Ferrara, A.L., Krishnan, R. (eds.) Data and Applications Security and Privacy XXXVIII. pp. 191–199. Springer Nature Switzerland, Cham (2024)

16. Sasaki, T., Sawada, K., Shin, S., Hosokawa, S.: Fallback and recovery control system of industrial control system for cybersecurity. IFAC-PapersOnLine 50(1), 15247–15252 (2017). https://doi.org/10.1016/j.ifacol.2017.08.2402, 20th IFAC World Congress

17. Sharma, A., Mansotra, P.V., Singh, K.: Detection of mirai botnet attacks on iot devices using deep learning. Journal of Scientific Research and Technology (JSRT) 1(6) (Sep 2023). https://doi.org/10.5281/zenodo.8330561

18. Strasburg, C., Stakhanova, N., Basu, S., Wong, J.S.: A framework for cost sensitive assessment of intrusion response selection. In: 2009 33rd Annual IEEE International Computer Software and Applications Conference. p. 355360. IEEE, Seattle, Washington, USA (2009). https://doi.org/10.1109/COMPSAC.2009.54

19. Webster, A., Eckenrod, R., Purtilo, J.: Fast and service-preserving recovery from malware infections using CRIU. In: 27th USENIX Security Symposium (USENIX Security 18). pp. 1199–1211. USENIX Association, Baltimore, MD (Aug 2018), https://www.usenix.org/conference/usenixsecurity18/presentation/webster

20. Zheng, Z., Jin, S., Bettati, R., Reddy, A.N.: Securing cyber-physical systems with adaptive commensurate response. In: 2017 IEEE Conference on Communications and Network Security (CNS). pp. 1–6 (2017). https://doi.org/10.1109/CNS.2017.8228641