# Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
## 5 Analysis
### RQ1: What Are the Different Phases of Forming an IoT Botnet? One of the major motivations of cybercriminals, when taking over IoT devices, is to use the devices as parts of botnets. As we mentioned in Section 3, an IoT botnet is a network comprising infected IoT devices controlled by malicious software named a bots. Cyber criminals have the ability to use special software to circumvent detection and intrusion prevention systems. They can obtain illegal access and control IoT devices to incorporate them into global networks called botnets that can be controlled remotely. The An IoT botnet is created in a series of phases, as seen in Figure 3. In the studies we selected, researchers chose different numbers of the phases for forming IoT botnets. They considered the process to have three phases, four phases, five phases or seven phases. The reasons for the different numbers of phases could have been the researchers wanting to put more emphasis on certain events and wanting to be more detailed. Phases help create models for protective methods. For example, in [81] the authors considered that IoT botnets have seven phases: (1) Searching the (inter)network for open ports on connected devices. (2) Brute force attacks on the exposed ports to obtain access to the victims. (3) Killing possible competitors on infected hosts. (4) Building a channel to the botmaster (command and control (C&C) channel). (5) Running a malicious script (and sometimes removing others) in the RAM. (6) Spreading across the network by looking for new instances. (7) Initiating attacks or executing other malicious acts. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
In article [45], the authors considered that an IoT botnet goes through five phases--namely, initial infection, secondary infection, communication, malicious activity, upgrade and maintenance. Initial infection: Compromising an exposed device. Secondary infection: Downloading malware which will communicate with a botmaster. Communication: Connecting to the command and control server (C&C) to receive commands from the botmaster. Malicious activity: Performing malice acts upon the directives of the botmaster (DDoS, scams, etc.). Upgrade and maintenance: Efficiently observing contaminated hosts whenever possible, adapting their behavior through downloading malicious code updates. In the same context, article [57] considered IoT botnets to have four phases--specifically, scanning, attack, infection and violation. In the scanning phase, the botmaster orders the bots to scan for exposed IoT devices on the Internet that have available ports for Telnet services or other services. In the attack phase, the successful login credentials for the new IoT system (cracked via brute force attack with a list of established default credentials) are sent to the C&C. Infection is when the infected device is directed to transfer and run the conformable payload binary. Some malware is extremely aggressive and will try to delete other malware found on the device. When run, the binary malware will be deleted and will only run in RAM to prevent detection. In the violation phase, the IoT botnet will be used for mounting a DDoS attack, i.e., via HTTP, UDP floods, etc. Other research, such as [82], in the same manner considered the IoT botnet's lifecycle to be composed of four phases: formation, control and compromise, attack, and post attack. The first phase of the bot is the discovery of a vulnerability in the target system. The vulnerability is abused in the next step and the host is compromised. The host then provides access to targeted device to the botmaster. Then, the bot will install some binary or executable files that are malicious, and in this process, the target machine will turn into an infected device, i.e., a bot. The final phase is a protective phase, during which the bot uses a technique to counter detection or removal. In addition, the authors in [51] divided the IoT botnet into four phases--formation, command and control, attack and post attack.