# MITIBOT: An Intelligent Mitigation Technique for IoT Botnets
###### Abstract  
The tremendous growth of the Internet of Things (IoT) has gained a lot of attention in the global market. The massive deployment of IoT is also inherent in various security vulnerabilities, which become easy targets for hackers. IoT botnets are one type of critical malware that degrades the performance of the IoT network and is difficult to detect by end-users. Although there are several traditional IoT botnet mitigation techniques such as access control, data encryption, and secured device configuration, these traditional mitigation techniques are difficult to apply due to normal traffic behavior, similar packet transmission, and the repetitive nature of IoT network traffic. Motivated by botnet obfuscation, this article proposes an intelligent mitigation technique for IoT botnets, named IMTIBoT. Using this technique, we harnessed the stacking of ensemble classifiers to build an intelligent system. This stacking classifier technique was tested using an experimental testbed of IoT nodes and sensors. This system achieved an accuracy of 0.984, with low latency. IoT botnet mitigation techniques; stacking ensemble classifier +
Footnote †: journal: _Future Internet_  
0000-0001-6691-507X]C.G.G. * The botmaster initially sends a command to the C&C server for the scanning of IP addresses of IoT nodes. * Then, it chooses the legitimate communication channel using distinct techniques such as Telnet, IRC, etc. * The loader server is utilized to load the malware or compromise the IoT nodes. * Once the IoT node is compromised, it joins the army of bots and tries to infect other nodes in the same network. * These devices are controlled by the C&C server and provide the instructions for propagating the same. To substantiate the IoT botnet, distinct algorithms and methods have been introduced by various researchers. The detection of an IoT botnet can be achieved by using host-based or network-based techniques. Due to its limited processing and power, botnet detection based on a host intrusion detection system (HIDS) achieved low reliability and accuracy [5]. The IoT domain's network-based botnet detection approach was proposed using a hierarchical classification [6]. Machine learning algorithms (MLAs) are the current trend for the identification and detection of IoT botnets that are working based on the network traffic [7]. Distinct intrusion detection systems (IDS) are utilized to detect IoT botnets with misuse, anomaly, DNS, stateful, and hybrid techniques [8]. The misuse-based method is used to detect a botnet with pre-defined signatures of the malware, while unknown malware is detectable by using an anomaly-based technique. DNS anomalies can be identified with fast flux or domain-generation algorithms. Stateful detection utilizes predetermined profiles of IoT devices and networks. If the traffic or behavior deviates from the original behavior, it will be treated as an anomaly. Hybrid IDS utilizes the power of two or more detection approaches. After characterizing, comprehending, and analyzing the behavior of the bots, honeypots are used to detect the botnet [9]. Additionally, honeypots need signature extraction, data analysis, etc., to detect the presence of bots. To confront the IoT botnet security issues, mitigation is an important step that takes the necessary actions against the detected attack [10]. Some traditional mitigation techniques utilized for IoT botnets are as follows:  
* Secured Device Configuration: The configuration of IoT devices should be secured via the modification of the default username and password. It also ensures that disabled unused features are regularly updated in firmware. * Data Encryption: The data should be in an encrypted form during data in transit and protected from interception or unauthorized access. The involvement of protocols such as SSL/TLS is required for data encryption stored in the cloud. * Network Segmentation: IoT networks are different than other networks that need to segregate IoT devices to minimize potential attacks and limit security breaches.