Towards a Distributed Defence Mechanism Against IoT-based Bots

Abstract

IoT devices are the target of choice for attackers, and one of the most devastating threats involving compromised IoT devices has been their exploitation as part of botnets. Here, we propose c-Shield, as a distributed and extensible solution designed to detect and respond to IoT-based bots in an enterprise network. c-Shield passively inspects network traffic associated with IoT devices over a range of different protocols and systematically analyses the URLs extracted. Compared with the existing solutions, c-Shield is designed to be capable of detecting bots using advanced evasion techniques such as Domain Name Generation Algorithms (DGA) with a high accuracy rate.