Detection of Mozi IoT Botnet Using Autoencoder-Based Feature Learning and Hashing

The detection method described in this paper uses autoencoder-based feature learning to identify abnormal traffic patterns indicative of a Mozi infection and employs hashing techniques to track and enumerate the P2P botnet nodes. The Internet of Things (IoT) has emerged as a game-changer in today’s world, influencing numerous industries and lifelines. Detection of IoT botnets has multiple implications for the security and availability of IoT ecosystems. Mozi is a P2P IoT botnet with characteristics such as fast spreading, persistence, and misuse of weak device configurations. Traditional signature and rule-based detection schemes are often unable to detect such dynamic threats, due to their poor generalization capabilities. In this paper, we present an efficient Mozi botnet detection scheme that leverages auto encoder-based feature learning and a hashing technique to achieve fast, scalable detection.  Therefore, this paper proposes a method to detect botnets using an autoencoder and a hash function for large-scale data retrieval. The algorithm uses the autoencoder to learn what is normal, then it hashes what it learned to succinctly summarize the learned information, and it compares hash codes in real time to detect anomalies, including IoT botnet-related anomalies. The proposed method achieves high detection accuracy, and is robust to the evolving attack strategies of Mozi botnet, better than traditional methods with the low computation and storage overhead, which can be well applied in IoT infrastructure.