# An Automated Behaviour-Based Clustering of IoT Botnets
###### Abstract  
The leaked IoT botnet source-codes have facilitated the proliferation of different IoT botnet variants, some of which are equipped with new capabilities and may be difficult to detect. Despite the availability of solutions for automated analysis of IoT botnet samples, the identification of new variants is still very challenging because the analysis results must be manually interpreted by malware analysts. To overcome this challenge, we propose an approach for automated behaviour-based clustering of IoT botnet samples, aimed to enable automatic identification of IoT botnet variants equipped with new capabilities. In the proposed approach, the behaviour of the IoT botnet samples is captured using a sandbox and represented as behaviour profiles describing the actions performed by the samples. The behaviour profiles are vectorised using TF-IDF and clustered using the DBSCAN algorithm. The proposed approach was evaluated using a collection of samples captured from IoT botnets propagating on the Internet. The evaluation shows that the proposed approach enables accurate automatic identification of IoT botnet variants equipped with new capabilities, which will help security researchers to investigate the new capabilities, and to apply the investigation findings for improving the solutions for detecting and preventing IoT botnet infections. IoT botnets; malware analysis; clustering; behavioural analysis +
Footnote †: journal:  
To identify IoT botnet variants, it is necessary to analyse the samples captured from IoT botnets propagating on the Internet. However, the large number of IoT botnet samples collected by antivirus vendors makes it impossible for the malware analysts to examine each botnet sample [7]. Although significant efforts have been made for automating the analysis of IoT botnet samples using sandboxes [8; 9; 10], the analysis results still need to be interpreted by malware analysts. This challenge can be overcome by grouping together samples that exhibit similar behaviours into clusters. After the samples are clustered, the malware analyst would need to examine only one sample per cluster to identify the distinct capabilities of that cluster. Over the years, multiple approaches for clustering IoT botnet samples have been proposed. The proposed approaches use different features, such as botnet configuration parameters [1], multidimensional features extracted from strings-based and image-based botnet binary representations [11], Function Call Sequence Graphs (FCSG) [12], strings [13], sizes of compressed botnet binaries [14], Trend Micro Locality Sensitive Hashes (TLSH) [15], and a combination of static and dynamic features [16]. However, these features are extracted or computed using static analysis and disassembly of the botnet samples. As a result, the proposed approaches may not be effective for clustering obfuscated samples. In our recent study [8], we observed that 38% of the samples captured by our honeypots were packed, while 59% had encoded strings. Therefore, we argue that to identify botnet variants equipped with new capabilities, both obfuscated and non-obfuscated samples should be effectively clustered. Another limitation of some of the proposed approaches is that they were evaluated using samples compiled for only one CPU architecture. Different from the existing approaches, the approach taken in the work reported in this paper uses behaviour profiles generated via a behavioural analysis of the botnet samples. The approach was evaluated using both obfuscated and non-obfuscated IoT botnet samples, compiled for different CPU architectures. The behaviour profiles are text files describing the actions executed by the botnet samples. To identify clusters representing botnet variants, the behavioural profiles are first transformed into feature vectors using the Term Frequency-Inverse Document Frequency (TF-IDF) method [17], and then clustered with the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithm [18].