# An Automated Behaviour-Based Clustering of IoT Botnets
## 5 Findings and Discussion
### Results  
The identified clusters, their unique behavioural characteristics, and the number of samples per cluster are shown in Table 6. Most of the samples, or 90%, were assigned to cluster 0. These samples exhibited behaviour very similar to the documented analyses of the leaked botnet and exploit source-codes [6]. We refer to such behaviour as generic IoT botnet behaviour. The generic IoT botnet behaviour typically includes the following actions: scanning for open ports associated with vulnerabilities commonly exploited by IoT botnets; exploiting the discovered vulnerable services using public exploits included in the  
Figure 3: Effect of varying the eps parameter on the number of clusters and outliers. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Min. Number of Samples** & **eps** & **Number of Clusters** & **Number of Outliers** \\ \hline
2 & 0.2 & 186 & 226 \\
2 & 0.3 & 115 & 135 \\
2 & 0.4 & 51 & 91 \\
2 & 0.5 & 27 & 58 \\
2 & 0.6 & 19 & 40 \\
2 & 0.7 & 17 & 30 \\
2 & 0.8 & 11 & 19 \\
2 & 0.9 & 2 & 4 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Number of clusters and outliers for different eps values. leaked IoT botnet source-codes; querying domain(s); connecting to C2 server(s); removing bash history and logs; disabling the firewall or blocking specific port(s); preventing watchdog from rebooting the device; etc. The dominant number of samples with generic IoT botnet behaviour supports the common belief that most of the IoT botnets are operated by cybercriminals with basic technical skills, who typically apply minor changes to the leaked IoT botnet source-codes [36]. We also inspected the behaviour profiles identified as outliers and observed that the actions described by each outlier behaviour profile differed significantly from those of the clusters and the other outliers. We assume that the behaviour profiles identified as outliers represent botnet variants, equipped with new capabilities, which are represented by a single sample in our dataset. An excerpt from an outlier behaviour profile is shown in Listing 3. The distinct behavioural characteristics of this outlier are a persistence technique involving a unique shell-script code which has not been observed in other variants, and the use of multiple configuration files downloaded as a rar archive during the initial infection stage. ```
1 Cmctop23.253.46.6480
2 Wroteto/etc/init.d/rorqefvqgc
3 Wroteto/etc/cron.hourly/gcc.sh
4 Wroteto/lib/libdev.so
5 dnsquestionw.searnec2.com
6 httprequest/config.rar
7 dnsquestiona.hostsasa.org
8 wroteto/usr/bin/rorqefvqgc
9 executed/usr/bin/rorqefvqgc
```  
Listing 3: Excerpt from an outlier behaviour profile. As can be seen from Table 6, the identified clusters exhibited new infection capabilities, and used unique techniques for establishing persistence, evading detection, and preventing infection remedy. The cluster 1 samples scanned a unique set of ports which have not been seen in other botnets, indicating a potential exploitation of unknown or less known vulnerabilities. The samples comprising cluster 9 exploited multiple vulnerable web services which are not typically exploited by IoT botnets, indicating that the variant may be infecting both IoT devices and Linux servers. The clusters 14, 16, and 18 used unique techniques for establishing persistence on an infected device. The cluster 2 samples sent a unique HTTP request, presumably to authenticate with an MD server. The authentication with an MD server may be a new capability aimed to prevent the discovery of the MD server and the botnet samples. The clusters 4,5, and 8 used unique HTTP requests to download stage-two payloads, presumably to avoid detection. The samples comprising clusters 12 and 18 used techniques for evading detection and preventing infection remedy which have not been observed in other variants.