IoT botnet detection via power consumption modeling

Abstract Many IoT botnets that exploit vulnerabilities of IoT devices have emerged recently. After taking over control of IoT devices, the botnets generate tremendous traffic to attack target nodes. It is also a threat to the smart health area since they have used IoT devices more and more. To detect the malicious IoT botnets, many researchers have proposed botnet detection systems; however, these are not easily applicable to resource-constrained IoT devices. Moreover, since the botnet's early stage makes marginal differences in terms of traffic, it is hard to detect when they first attack the victim nodes. However, we observe that the IoT botnets generate distinguishable power consumption patterns. Thus, we aim to classify whether the IoT device is affected by malign behaviors through power consumption patterns so that we can protect the healthcare ecosystem from the malicious IoT botnets. We propose a CNN-based deep learning model that consists of a data processing module as well as an 8-layer CNN. Prior to applying the CNN model, we segment and normalize the collected power consumption data to help our CNN model to achieve higher accuracy. The 8-layer CNN classifies the processed data into four classes including a botnet class, which is our primary target. To demonstrate the performance, we run self-evaluation, cross-device-evaluation, leave-one-device-out, and leave-one-botnet-out tests on three common types of IoT devices, which are Security Camera, Router, and Voice Assistant devices. The self-tests achieve up to 96.5% classification accuracy whereas the cross-evaluation tests perform about 90% accuracy. Leave-one-out tests also introduce higher than 90% accuracy for botnet detection.