# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 3 Background
### IoT Botnet
#### 3.3.2 IoT Botnet Life Cycle Phases  
Many studies [21; 22; 27; 37] have agreed that IoT botnets carry out their actions in at least the three main phases (see Figure 3), as described below:  
* Scanning Phase: In order to locate a vulnerable device, a bot (or malicious code) implements scanning and reconnaissance. The botmaster scans for vulnerable IoT devices. Once it finds one, it starts to infect it through brute force or by exploiting a vulnerability. Once the vulnerable device is compromised, it becomes  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**IoT BotNet** & **Description** & **Estimated Number of Devices [34]** \\ \hline Bashlight (2014–2016) & Has IRC based targeting Linux based IoT devices (BusyBox) like cameras and DVRs. It executes brute force with default credentials with open & (120,000) \\  & TellNet port. & \\ \hline Mirai (2016) & Centralized architecture model targeting closed circuit television cameras, routers and Digital Video Recorders (DVRs). It uses TelNet port and predefined attack vectors Dictionary attack based on 62 entries. & (145,000+) \\ \hline Brickerbot (2017) & Bruteforce the TelNet password then run command to corrupt storage, delete all files and make the device inoperable. & (10,000,000+) \\ \hline Hajime (2016–2018) & Same as Mirai targeting Devices through TelNet but it has Peer-to-Peer architecture model. & \\ Hajime (2016–2018) & Recently Hajime evolve to use different ports and different exploits. Until now Hajime just scan and infect vulnerable devices but does not launch any DDoS attack & (300,000) \\ \hline Wirex (2017) & Working on android devices and proliferate through application in Google Play & (100,000+) \\ \hline Reaper (2018) & Exploit the vulnerabilities of IoT devices such as routers of LinkSys, DLink and connected cameras. & (1,000,000+) \\ \hline \hline \end{tabular}
\end{table}
Table 2: IoT malware families.  
a bot and starts communicating with the botmaster. Mirai malware families, for example, send fingerprint packets to scan for pseudorandom IPv4 addresses to locate IoT devices that are attainable through Telnet service on port 23 or port 2323 [26]. Through abusing frail credentials using brute force or exploiting the known vulnerabilities of IoT devices, the bot compromises new victims.  
* Propagation Phase: A suitable version of the bot is installed and executed based on the architecture of the vulnerable device. Oftentimes, to avoid targeting devices victimized by any other potential malware and acquire complete control, the bot kills the process bound to the related service [26] in order to delete any other previous malware and lock ports to itself. The malicious code recruit new bots and propagates to expand the IoT botnet as quickly as possible. In this phase, the bots are still awaiting commands from the botmaster.
* Attack Phase: Execution of malicious activities such as DDoS, crypto mining and spam. The attacker initiates the attack by sending the commands through the command and control server to all the distributed bots to trigger the attack. Consequently, the bots start the attack after receiving the identical commands.  
During all phases and depending on the architecture of the botnet, a communication and control process are established. In this process, the bot interacts with the controller host that manages the commands to receive instructions and exchange messages.