# An Automated Behaviour-Based Clustering of IoT Botnets
## 3 Related Work  
Over the past years, multiple approaches for clustering IoT botnets and for investigating their variation have been proposed. The proposed approaches and their key characteristics are presented in Table 1.  
The authors of [1] present different schemes for classifying and tracking Mirai botnet variants using three artefacts: the botnet configuration including the C2 settings and the encryption key, the supported DDoS attack methods, and the dictionary of usernames and passwords used in brute-force attacks. The artefacts are extracted automatically using static analysis and emulation. This study, however, is only concerned with Mirai IoT botnet variants that perform DDoS attacks. In [14], the authors propose an automated approach for clustering IoT botnet samples using NCD distance as a similarity measure. To achieve faster clustering, the authors present an algorithm for efficiently constructing a phylogenetic tree by reducing the compression attempts. The proposed clustering approach was evaluated using botnet samples compiled for only one CPU architecture. An approach for clustering IoT botnet samples using TLSH fuzzy hash as similarity measure is proposed in [15]. The authors evaluate the performance of two clustering algorithms, k-medoids and OPTICS, and propose a new clustering algorithm which achieves a performance superior to both k-medoid and OPTICS. Nonetheless, the proposed clustering approach was evaluated using only non-packed and non-encrypted samples, compiled for the ARM CPU architecture. The authors of [13] propose an approach for clustering IoT botnet samples and investigating their underlying correlations using strings-based similarity. The strings are extracted from the botnet binary samples using static analysis. Natural Language Processing (NLP) techniques such as word tokenization are then applied to process the identified strings and extract meaningful words. The meaningful words are compared using a combination of the Jaccard and overlap similarity coefficients. The ClusterONE algorithm is used to investigate correlated malware samples and to identify groups of similar IoT malware implementation. A novel approach for effective IoT botnet classification and family attribution by combining multi-dimensional features extracted from strings-based and image-based botnet binary representations is presented in [11]. The features are extracted automatically using Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) deep learning models. However, the approaches proposed in [11; 13; 14; 15] may not effectively cluster packed or obfuscated samples since they rely on static analysis for extracting the required features. A method for identifying behavioural differences between IoT botnet samples using FCSG is proposed in [12]. The FCSG are generated from the disassembled code of botnet samples. Therefore, the proposed method requires the botnet samples to be disassembled. In [25], the authors propose a clustering approach based on code-level similarity for tracking the evolution over time of a given IoT botnet family as well as the code reuse and functionalities borrowed among different IoT botnet families. Similar to [12], this approach also requires the botnet samples to be disassembled. However, if a sample is packed, it needs to be properly unpacked before it is disassembled. In addition, the unpacking of samples packed with custom packers can be challenging and time-consuming. Thus, the approaches presented in [12; 25] may not be effective for clustering packed botnet samples. The authors of [16] propose a clustering approach using a custom distance function that relies on three types of features: static, dynamic and hybrid. The hybrid features are a combination of the static and dynamic features. However, in this study, the packed samples were discarded from the dataset since the method used for extracting static features from the botnet samples is not effective for packed samples.