# An Automated Behaviour-Based Clustering of IoT Botnets
## 5 Findings and Discussion
### Comparison with Mean-Shift Clustering  
We also evaluated the effectiveness of the Mean-shift clustering algorithm for identifying botnet variants with new capabilities from our sample collection. Mean-shift is a centroid-based algorithm which does not require prior knowledge of the number of clusters. In our evaluation, we used the Python implementation of the algorithm provided by the scikit-learn framework [37]. We configured the algorithm to automatically estimate the bandwidth used in the RBF kernel using the 'estimate_bandwidth' function. Because the Mean-shift algorithm requires the input data to be dense, we converted the sparse matrix produced by the TfidfVectorizer to a dense one. The Mean-shift algorithm identified 66 clusters, 48 of which contain only one sample. To evaluate the effectiveness of Mean-shift, we compared the clusters it identified with the clusters found by DBSCAN. We refer to the clusters identified by Mean-shift as Mean-shift clusters and to the clusters identified by DBSCAN as DBSCAN clusters. To ease the comparison, we consider the clusters identified by Mean-shift which contain only one sample as outliers. The number and size of the clusters identified by Mean-shift are similar to those of the clusters identified by DBSCAN, as can be seen in Tables 6 and 7, respectively. Like DBSCAN, the Mean-shift algorithm also identified one large cluster, i.e., \begin{table}
\begin{tabular}{l l l} \hline \hline
**Cluster** & **Unique Behavioural Characteristics** & **No. of Samples** \\ \hline
0 & generic IoT botnet behaviour & 1180 \\ \hline
1 & scanned a unique combination of ports not seen in other botnets & 4 \\ \hline
2 & unique HTTP request not associated with exploits; presumably a technique for authenticating with an MD server & 2 \\ \hline
3 & created a unique set of directories and copied the botnet binary to the directories & 2 \\ \hline
4 & downloaded and executed a stage-two payload using a unique HTTP request & 3 \\ \hline
5 & downloaded and executed a stage-two payload using a unique HTTP request & 2 \\ \hline
6 & downloaded multiple botnet samples compiled for different CPU architectures; loaded a kernel module & 7 \\ \hline
7 & replaced the rm,tftp, and kill Linux programs & 2 \\ \hline
8 & downloaded and executed a stage-two payload using a unique HTTP request; replaced /dev/ty & 37 \\ \hline
9 & exploited multiple vulnerable web services which are not typically exploited by IoT botnets & 3 \\ \hline
10 & created and wrote to files using encoded filenames, presumably to hinder analysis & 2 \\ \hline
11 & obtained a list of malicious URLs, presumably used for botnet propagation & 4 \\ \hline
12 & modified and added user accounts; downloaded and executed a stage-two payload using a unique command aimed to remove infection traces; replaced the ls tool & 2 \\ \hline
13 & performed multiple DNS queries for google domains & 3 \\ \hline
14 & downloaded multiple files; created a service for crypto-mining purposes and used several unique persistence techniques & 2 \\ \hline
15 & installed UPnP plug and play service; modified /etc/hosts & 2 \\ \hline
16 & used unique persistence techniques in which the botnet sample is run with arguments & 2 \\ \hline
17 & downloaded a unique set of multiple different Python libraries, typically used for crypto-mining, and stored them in a uniquely named directory & 3 \\ \hline
18 & used unique persistence techniques with multiple runlevels; loaded kernel modules; replaced the ps, lsof, sshd and netstat programs & 9 \\ \hline outliers & each outlier exhibited unique behavioural characteristics & 40 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Unique behavioural characteristics and number of samples per cluster. cluster 0, and several small clusters. Furthermore, Mean-shift identified 48 outliers, labelled as cluster \(-1\) in Table 7, while DBSCAN identified 40 outliers. The clusters identified as cluster 0 by both algorithms are comprised of samples which exhibited generic IoT botnet behaviour.