# Distributed Detection of Large-Scale Internet of Things Botnets Based on Graph Partitioning
###### Abstract  
With the rapid growth of IoT devices, the threat of botnets is becoming increasingly worrying. There are more and more intelligent detection solutions for botnets that have been proposed with the development of artificial intelligence. However, due to the current lack of computing power in IoT devices, these intelligent methods often cannot be well-applied to IoT devices. Based on the above situation, this paper proposes a distributed botnet detection method based on graph partitioning, efficiently detecting botnets using graph convolutional networks. In order to alleviate the wide range of IoT environments and the limited computing power of IoT devices, the algorithm named METIS is used to divide the network traffic structure graph into small graphs. To ensure robust information flow between nodes while preventing gradient explosion, diagonal enhancement is applied to refine the embedding representations at each layer, facilitating accurate botnet attack detection. Through comparative analysis with GATv2, GraphSAGE, and GCN across the C2, P2P, and Chord datasets, our method demonstrates superior performance in both accuracy and F1 score metrics. Moreover, an exploration into the effects of varying cluster numbers and depths revealed that six cluster levels yielded optimal results on the C2 dataset. This research significantly contributes to mitigating the IoT botnet threat, offering a scalable and effective solution for diverse IoT ecosystems. b ont detection; graph convolutional networks; graph partitioning; METIS +
Footnote †: journal: Applied Sciences  
The botnet, consisting of a vast network of infected computers, poses a significant threat to the security of the Internet of Things. Attackers have compromised these computers through various means, infecting them with malicious programs and turning them into puppet hosts under the attackers' control. Once the attacker successfully infects victim devices with bot programs, these devices become botnet hosts and join the attacker's command and control network. As shown in Figure 1, when there is a need for attack activities, the attacker sends various attack commands through a control channel, which are received and executed by these puppet hosts, forming a highly controllable botnet. Due to the dynamic nature of network traffic, it is challenging to detect botnet nodes effectively. According to Threat Intelligence Report 2023 [10], 60% of attacks in telecom mobile networks are linked to Internet of Things (IoT) bots scanning for vulnerable hosts to expand their botnets for use in distributed DDoS attacks. Botnets have become a major generator of DDoS traffic. In 2016, attackers exploited Mirai [11] to compromise thousands of IoT devices and use them as nodes to launch large-scale DDoS attacks, causing significant disruptions to numerous mainstream websites. The Mirai attack wave reached its peak in September 2016 when this botnet launched massive DDoS attacks, resulting in temporary outages of prominent sites such as OVH, Dyn, and Krebs on Security, rendering them unable to provide normal services. According to reports from OVH and Dyn, the peak traffic of these attacks exceeded 1 Tbps, making it the largest known attack in terms of scale. The Necurs botnet [12], composed of millions of infected devices, is capable of sending 5 million spam emails worldwide every hour. IoT botnets have increasingly become a serious threat to network security. Existing botnet detection methods mostly rely on machine learning or deep learning-based approaches. [PERSON] et al. [13] evaluated the effectiveness of features such as the source port, destination port, protocol, communication duration, first packet length, packet exchange, and random reconnection in botnet detection. However, using similar features requires researchers to possess sufficient domain knowledge and select the most effective features for experimentation.