# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Botnet  
Due to weak protection and the huge number of embedded devices, APT organizations often control numerous embedded devices to build botnets. Therefore, it is significant to study the formation mechanism and behavior characteristics of botnets. [PERSON] et al. [116] provided a longitudinal retrospective analysis of Mirai's growth history and its DDoS victims. The authors gathered and analyzed raw data from various aspects, including network packets, port scans, IoT honeypots, C2 milkers, DNS queries, DNS clusters, and aggregate histories of DDoS attacks. They confirmed that Mirai has launched over 15,000 attacks against both high-profile and seeming unrelated targets, such as Krebs on Security, game servers, telecoms, and anti-DDoS providers. Mirai may represent a giant change in the evolutionary development of botnets, and it reveals the absence of security in the IoT space. Hajime is a new botnet that is similar to Mirai in IoT devices, and [PERSON] et al. [117] surveyed it. Hajime sends control commands and updates attack exploits through a public peer-to-peer system, which makes the botnet more resilient and quickly increases its size and power. Through detailed active scanning of Hajime's peer-to-peer infrastructure, they measured the bot size, bot churn, bot location, device composition, payload updates, and track vulnerabilities over time. Considering that there is no way to satisfactorily stop Hajime's C&C without damaging the quality of a BitTorrent's DHT, the authors made their code and data publicly available to help people patch vulnerable IoT devices. [PERSON] and [PERSON] [118] proposed an analytical model to study the device-to-device (D2D) propagation of malware in wireless IoT networks. Inspired by dynamic population processes and Poisson point process theory, the authors set up a mean-field dynamical system to capture the malware infiltration process and control command propagation in networks. They also considered the overhead caused in patching devices and used the mean-field equilibrium in the population to solve the problem. To clear compromised devices in the botnet, [PERSON] et al. first proposed AntibIoTic [158], which utilizes the vulnerabilities in the infected devices and creates a white botnet to secure them. However, this method has legal issues, as the owners' explicit consent is missing. Therefore, in ANTIBOTIC 2.0 [84], the authors solved the problem and introduced fog computing to improve its predecessor. In the N-tier architecture of fog computing, every ANTIBOTIC fog node cleans the infected device from malware and fixes the vulnerabilities (e.g., closing unnecessary ports and changing original passwords). By evaluating it on a real-world router, the authors proved the capability of ANTIBOTIC Bot in securing and sanitizing. [PERSON] et al. [119] studied malicious IoT device behaviors on an internet scale from a network telescope perspective. They obtained IoT device information and darknet traffic from online resources and inferred the compromised IoT devices interacting with the darknet. By characterizing the traffic generated by unsolicited IoT devices, they discovered new malware families whose target is vulnerable devices. Overall, the authors highlighted the large-scale insecurities of the IoT paradigm and pinpointed the risks of new malware variants. In this paper, [PERSON] and [PERSON] [120] studied the behavior of cybercriminals by operating low- and high-interaction IoT honeypots. They found that both the diversity and complexity of IoT botnets are increasing, while the Mirai malware family is still dominant. An increasing number of software vulnerabilities are used to exploit targeting devices, which makes the IoT malware ecosystem rapidly grow. [PERSON] et al. [121] presented a formal preprocessing probabilistic model to analyze internet-scale probing activities of more than 20 frequently used CPS protocols.