# An Automated Behaviour-Based Clustering of IoT Botnets
## 3 Related Work
Botnet families represented with less than ten samples were also removed from the dataset. In [24], the authors evaluate different algorithms for clustering IoT botnet samples based on their behaviour represented as system calls. The system calls are captured via a sandbox execution of the botnet samples. The features used by the clustering algorithms \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Proposed Approach** & **Automated or Manual** & **Operations Performed** & **Data Used** & **Features** \\ \hline
[1] & Automated & Static analysis and emulation & DDoS IoT botnets & Configuration; Supported DDoS attack methods; Brute-force dictionary \\ \hline
[14] & Automated & Compression & IoT botnet samples from same CPU architecture grouped in 3 clusters & NCD as similarity measure between binary samples \\ \hline
[15] & Manual & TLSH fuzzy hash calculation & Non-packed ARM bottnet samples & TLSH as similarity measure \\ \hline
[24] & Manual & Dynamic analysis & Various IoT botnet samples & System calls \\ \hline
[12] & Manual & Static analysis & Various IoT botnet samples & FCSG \\ \hline
[13] & Manual & Static analysis & Various IoT botnet samples & Strings-based features (IP addresses and/or embedded commands/payloads) \\ \hline
[25] & Automated & Static analysis & IoT botnet samples for multiple architectures except Intel and AMD & Program code \\ \hline
[11] & Automated & Static analysis & Various IoT botnet samples & Features extracted from string-based and image-based representations of the executable binaries \\ \hline
[26] & Mixed & Static analysis & Honeypot logs and IoT botnet samples & Honeypot login sessions and executable binaries \\ \hline
[16] & Mixed & Static and dynamic analysis & Various Linux malware samples & Static, dynamic and hybrid features \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Related work concerned with the clustering of IoT botnets. are extracted from the system call logs using the 2-g method discussed in the paper and reduced using PCA. The similarity between feature vectors is measured using Euclidean distance. The clustering algorithms evaluated in this study are DBSCAN, Mean-shift, and Hierarchical clustering. The Mean-shift algorithm achieved the best performance. The authors of [26] propose an approach for measuring the variation among IoT botnets based on infection attacks recorded by honeypots. A list of arguments from the executed commands is created for each attack session in which a botnet binary was created or downloaded. The similarity between the attack sessions is measured as a Levenshtein distance between the argument lists. To better understand the scope of the IoT botnet infection attacks, the authors also investigate the relationship between the IP address of the attacker and the hash of the downloaded file(s) for each attack session. Many of the related studies propose the use of features extracted via static analysis for clustering IoT botnets, based on the observation that the IoT malware obfuscation is not as common as the Windows malware obfuscation. However, in our recent study [8], concerned with the analysis of IoT botnet samples captured by honeypots, we observed that a significant proportion of the analysed samples were obfuscated. Approximately 38% of the analysed samples were packed, 25% of which were packed with custom packers. In addition, string encoding, a simpler form of obfuscation, was identified in 59% of the samples. The obfuscation can prevent the static analysis methods, such as code disassembly and string extraction, from identifying valuable features. As a result, the obfuscated samples may not be effectively clustered. Another limitation of the clustering using static features is that some of the static features may differ between different CPU architectures [16]. We argue that to facilitate the identification of IoT botnet variants equipped with new capabilities, the clustering must be effective for both obfuscated and non-obfuscated samples.