Keywords

1 Introduction

Due to the present coronavirus COVID-19 pandemic situation, a huge demand is looking for various ICT tools to meet the immediate business need without much concern to the security breaches inside it. Self-propagating botnet programs are moving around the Internet in search of vulnerable system. As per report by World Health Organization (WHO), more than 450 e-mails addresses and passwords of WHO’s were compromised during April 2020 [1] and a forecasted report by P&S intelligence, Market Research Future (MRFR) shows a compound annual growth rate (CAGR) of 12.6% with total $119.9 billion financial loss by the end of 2030 due to cyber-attacks [2, 3], and thus, this area needs immediate attention among researcher.

The journey of malwares was first appeared in 1988 and continues their impact till date. McGraw and Morrisett [4] define malicious code or malware as “any code added, changed, or removed from a software system in order to intentionally cause harm or subvert the intended function of the system.” Initially, Internet users were attacked with malwares, propagating through e-mails, freeware, lucrative software, and games or with some other medium [5]. However, by the time, this kind of approaches for infecting devices become not much effective, as the infection processes were easily detectable due to the actions initiated by the malware during infection or changes caused on the infected devices. With the advancement in anti-malware protection and elimination programs, the malware presence is being detected and immediately removed from the infected devices, and thus, the infected devices are no longer remain asset for the attacker. With the advancement in technology, the intention of trend for infection was changed, and now, attacker wish to hold the control of infected device as long as possible. Therefore, the presence of malware in the infected device needs to be shield. Various kinds of malwares are being used; botnet is one of them.

Botnets are utilizing the feature of self-propagation to target more and more devices by exploiting the vulnerabilities present in the devices such as open ports and default credentials. IoT devices are most suitable for performing such activities as the devices are implemented with least security mechanisms, continuous network connectivity, and limited computing resources in order to retain it simple to use. IoT devices are dynamic, heterogeneous, and interoperable, and due to these features, a uniform solution to prevent or mitigate the botnet in IoT devices is not feasible [6]. Most of the IoT devices are connected to Internet without firewall and available round the clock and are mostly configured with factory-enabled default username and password with open ports for various protocol, customer-care service, and thus, to contaminating an IoT device becomes quite easy. The device infected with malicious code called bot and group of infected devices together with Command and Control Centre (C&C) termed botnet [7]. In a botnet, infected devices (bots), take command(s) from the C&C to perform predefined action(s) on the basis of the received commands. These commands are given by the attacker who controls the botnet. Typically, the commands are being used for performing DDoS attack, sending spam mails, click fraud, or stealing financial and sensitive information from the infected device [8]. Many researchers believe that more than 25% of the IoT devices which are connected to the Internet without any proxy server are member of botnets [8,9,10].

Primarily botnets are configured for testing various features of network and however, later on, intruders started implementing bots with intention to perform malicious activities such as purloin financial information, security credential, sending spam mails, or performing DdoS attack to slow down or sometimes stop the services of the targeted system [11]. These botnets are capable of utilizing exact vulnerabilities available on specific devices from a manufacturer, in order to the keep the device easy to use, companies provide details on their website such as default credentials, open telnet ports for remote access of device. This publicly available information is utilized by the attackers to target any IoT device or a model of a manufacturer. Mostly, the botnet exploits the codes of exiting botnets or append new features to exploit the new vulnerabilities of the IoT devices [12]. The malware detector is a kind of program which basically looks for the description and the basic functionalities of malicious program. Unlike an anti-virus software, a malware detector is not necessarily supposed to reside on the device under observation (DUO) and senses the presence of malware on the basis of set of rules of the detection techniques. The performance of a malware detectors depends on the set of detection techniques it uses [7]. Many researches have been carried out to predict or mitigate the botnet attack. These detection techniques utilize various parameters of botnet or network such as botnet signature, network traffic, very-long connection time between client–server and so on [13,14,15].

The motivation and main contribution of this paper are as follows: Sect. 2 of the paper discusses the taxonomy of a botnet with common IoT vulnerabilities. Section 3 deliberates the basic detection techniques and a discussion about categories of botnet, based on common botnet attack along with a detailed review and comparison analysis of botnet detection techniques and tools followed by conclusion in Sect. 4.

2 Botnet Taxonomy

As described, a botnet is a network of connected bots that spread over network to perform various malicious activities such as spam mail generation, distributed denial of service (DDoS) attack, stealing sensitive financial (credit/debit card data) and security information, and tricking personal information for identity theft [13]. An autonomous program performing the above actions without taking instructions from any intruder is called bot, whereas the network of bots connected to Command and Control Server (C&C) taking commands to perform actions based on the commands are called botnet [8,9,10]. Botnets utilize the vulnerabilities present in the devices to infect them, and once a device is infected, it starts working as a bot and further search for the new device on the network for further infection. List of common vulnerabilities in Table 1 [13,14,15]. These botnets generally utilize default credentials of IoT devices, open ports or sometimes the vulnerabilities present in the software. Mirai botnet is the famous botnet that performs dictionary-based default credential attack on the devices.

Table 1 Common IoT vulnerabilities
Full size table

The connection between bots and C&C defines the architecture of the botnet. The architecture of the botnet can be categorized as centralized, peer to peer (P2P), and hybrid [7]. The centralized architecture of botnet is easy to implement, generate quick response to bots’ requests, quick and direct update to bots but the dependability on a single source make is less reliable.

Whereas the P2P architecture does not directly communicate to the bots, rather command is sent via another bot in the network so the detection of the C&C becomes next to impossible. The hybrid architecture utilizes the features of both architectures to control the bots. Figure 1 shows the architecture of the botnet.

Fig. 1
figure 1

Botnet command and control topology

Full size image

Authors [11, 12] classified the IoT attacks on the basis of how the attacker utilizes these devices after successful infection. Table 2 shows the categories of attacks. These attacks were categorized on the basis of the impact caused by the malicious code after they have successfully infected the device or network.

Table 2 Common botnet attack categories
Full size table

3 Botnet Detection Techniques

Botnet detection techniques are the most discussed topic nowadays. Many works have been done to address this issue. Here in this paper, we are trying to find out the most relevant works and categories them how they are addressing detection of botnet. The botnet detector takes two inputs [12]. The first input is the knowledge of the malicious behavior of the botnet. Second input is the program that needs to be observed. Once the botnet detector has the knowledge of what is considered malicious behavior and the program under inspection, then it employs its detection techniques to decide that the program is malicious or benign. Sometimes IDS and malware detectors are used interchangeably but a malware detector is usually only a component of a complete IDS. Techniques used for detecting malware can be categorized into three categories: anomaly-based detection, specification-based detection, and signature-based detection [16]. Figure 2 provides the information about various botnet detection approaches. All the three categories have three subcategories, namely static, dynamic, and hybrid [13, 17,18,19].

Fig. 2
figure 2

Botnet detection techniques

Full size image

An anomaly-based botnet detection technique uses its gathered information during the run-time of a program to constitute normal behavior of the program to decide the maliciousness of a program under observation. A sub-category of anomaly-based detection is referenced as specification-based detection.

Specification-based botnet detection techniques control some specification or set of rules of what is valid behavior in order to decide the maliciousness of a program under observation. Programs violating the set of rules of specification are considered anomalous and usually malicious [20].

Signature-based botnet detection technique uses its predefined set of rules to what is known to be malicious for the host under observation to decide the maliciousness of a program under inspection. It is clear that characterization of properties or signature of the malicious behavior is the key to a signature-based botnet detection method’s effectiveness.

Table 3 presents a detailed analysis of variances among static and dynamic approach. Static analysis uses syntax or structural properties of the program under observation to predict its maliciousness. Whereas the dynamic approach works on various features on the host or the network under observation such as connection time between client–server, DNS and starts when the code starts executing [21]. The specific approach of an anomaly-based or signature-based technique is determined by how the techniques gather information to detect malware.

Table 3 Review of botnet detection techniques and tools
Full size table

These botnet detection techniques can be further classified as on host and on network-based detection techniques [9, 11]. On host-based detection technique, the detection of malware is done locally on the host itself. These techniques are local to the machines under observation. While in network-based detection techniques, the network traffic is monitored for the detection of malware. Network-based monitoring technique can be further divided into active monitoring techniques and passive monitoring techniques.

In active monitoring techniques especially, crafted packets are injected into the network traffic and their responses are apprehended for presence of malware in the network. Many legitimate DNS that expires are used by intruders for malicious activities. Such domains are specially used for sending the patches for many software, and when these patches are installed on machine, it starts performing many malicious activities such as keystroke recording, stealing valuable information from the device and sending it to the attacker’s device. Passive detection technique monitors such DNS queries for malicious activities that can be a part of any botnet.

3.1 Limitations in Botnet Detection

Botnet detection has many limitations [20, 25, 26] for designing single uniform solution such as heterogeneity, functionalities, and management policies for IoT devices. Sometimes the governing policies, goals of the Internet or network may also limit the applicability of botnet detection mechanisms. Lack of information related to connected devices to a network, sometimes it tough to decide that a particular device belongs to a network. The Command and Control channels also cause problem in detection of botnet many C&C channels use push methodology, whereas some C&C channels use pull methodology for communication. The protocols such as HTTP and IRC are used for communication between client and server. These protocols are also one of the limiting factors for botnet detection.

4 Conclusion

Due to the wide range of applications and easy deployment, IoT devices become a popular choice among people; however, due to unpleasant market demand, manufacture is not much concern about the security breaches in their products. Malware(s) is (are) one of the malicious programs always looking for such kind of vulnerable devices, and thus, IoT devices become one of the great choices. Due to the availability of open source-code of many malwares on various online forums and available for free download, intruders are using their knowledge to add new features to utilize the new vulnerabilities available in the system. In this paper, various methods have been compared based on the static analysis of malware detection. A detailed common IoT vulnerabilities have been presented based on common botnet attack categories. A brief review of botnet detection techniques and tools also has been discussed so far. Static botnet detection techniques have fixed set of rules to detect the botnet that makes them quick and easy to implement but this also becomes their limitation when it comes to detect any new botnet as their rules are not known to the static-based detection techniques. Whereas dynamic detection techniques detect malware by utilizing the features of botnet when they are executing and trying to detect the malicious action being performed by any device. If so then the alarm is triggered for botnet. This detection technique is complex to implement but has its own advantages as it works on the attributes of the traffic and behavior of the PUO. Discussion on detailed common IoT vulnerabilities and review of botnet detection techniques and tools are main contributions of this paper.