# An Automated Behaviour-Based Clustering of IoT Botnets
## 5 Findings and Discussion
### DBSCAN Parameter Tuning  
The DBSCAN clustering algorithm takes two parameters, the maximum distance between two samples for them to be considered neighbours, referred to as epsilon (eps), and the minimum number of samples required to define a cluster. The Python implementation of DBSCAN, provided by the scikit-learn framework, assigns the samples cluster labels in the range from 0 to N \(-\) 1, where N is the number of identified clusters. The outliers are labelled as \(-\)1. We evaluated the effectiveness of the DBSCAN clustering for identifying botnet variants equipped with new capabilities using a fixed value for the minimum number of samples per cluster, and different values for the eps parameter. We chose two as the minimum number of samples for defining a cluster because it may be possible that only two, or even only one sample of an IoT botnet variant has been captured by the honeypots or the security researchers. By selecting two as the minimum number of samples per cluster, the DBSCAN algorithm will be able to identify IoT botnet variants represented by only two samples in our dataset. The variants represented by only one sample would be labelled as outliers. The eps parameter was varied in the range between 0.2 and 0.9 at 0.1 intervals. The number of clusters and outliers for each eps value used in the evaluation is shown in Table 5. As can be seen from Figure 3, varying the eps parameter had significant effect on the number of clusters and outliers identified by DBSCAN. With the smallest eps value in the range, 0.2, DBSCAN identified 186 clusters and 226 outliers, while with the greatest eps value in the range, 0.9, the algorithm identified only two clusters and four outliers. As part of the evaluation, we investigated the effect the different eps values had on the degree of difference between the behaviour profiles of samples belonging to different clusters and within the same cluster. In doing so, we manually read the behaviour profiles and noted the observed differences. The clustering with eps values smaller than 0.6 resulted in larger number of clusters and very fine-grained differences among the behaviour profiles assigned to different clusters. The fine-grained differences include different domain names, different C2 IP addresses and/or ports, different names of the executed files, different IP addresses of MD servers, different commands for disabling the firewall, etc. We also observed different \begin{table}
\begin{tabular}{c c} \hline \hline
**Packet Used** & **Number of Samples** \\ \hline none & 536 \\ default UPX packer & 700 \\ custom packer & 75 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Packer used per number of IoT botnet samples. \begin{table}
\begin{tabular}{c c} \hline \hline
**CPU Architecture** & **Number of Samples** \\ \hline X86 & 302 \\ MIPS & 510 \\ ARM & 499 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: CPU architecture per number of IoT botnet samples. combinations of ports scanned or blocked/opened in the firewall, from the set of ports associated with widely exploited IoT vulnerabilities. These minor differences may be due to different botnet configuration parameters or slight changes in the botnet source-code. Because of this, the clustering based on such differences may not be beneficial for identifying botnet variants equipped with new capabilities. A significant difference that can be an indicator of a new capability could be, for instance, a unique set of scanned ports, including ports which are not associated with known infection vectors. On the other hand, the clustering with eps values greater than 0.6 resulted in significantly different behaviour profiles being assigned to the same cluster. In other words, samples presumably belonging to different IoT botnet variants were assigned to the same cluster. Therefore, we identified the clustering with eps = 0.6 as the most effective for identifying botnet variants equipped with new capabilities.