Publication detail

BOTA: Explainable IoT Malware Detection in Large Networks

POLIAKOV, D. HYNEK, K. ČEJKA, T. KOLÁŘ, D.

Original Title

BOTA: Explainable IoT Malware Detection in Large Networks

Type

journal article in Web of Science

Language

English

Original Abstract

Explainability and alert reasoning are essential but often neglected properties of intrusion detection systems. The lack of explainability reduces security personnel's trust, limiting the overall impact of alerts. This article proposes the botnet analysis (BOTA) system, which uses the concepts of weak indicators and heterogeneous meta-classifiers to maintain accuracy compared with state-of-the-art systems while also providing explainable results that are easy to understand. To evaluate the proposed system, we have implemented a demonstration of intrusion weak-indication detectors, each working on a different principle to ensure robustness. We tested the architecture with various real-world and lab-created data sets, and it correctly identified 94.3% of infected Internet of Things (IoT) devices without false positives. Furthermore, the implementation is designed to work on top of extended bidirectional flow data, making it deployable on large 100-Gb/s large-scale networks at the level of Internet Service Providers. Thus, a single instance of BOTA can protect millions of devices connected to end-users' local networks and significantly reduce the threat arising from powerful IoT botnets.

Keywords

detection, explainability, Internet of Things (IoT), malware, network monitoring, network security, weak indicators

Authors

POLIAKOV, D.; HYNEK, K.; ČEJKA, T.; KOLÁŘ, D.

Released

15. 5. 2023

Publisher

Institute of Electrical and Electronics Engineers

Location

Piscataway

ISBN

2327-4662

Periodical

IEEE Internet of Things Journal

Year of study

10

Number

10

State

United States of America

Pages from

8416

Pages to

8431

Pages count

15

URL

BibTex

@article{BUT185208,
  author="Daniel {Poliakov} and Karel {Hynek} and Tomáš {Čejka} and Dušan {Kolář}",
  title="BOTA: Explainable IoT Malware Detection in Large Networks",
  journal="IEEE Internet of Things Journal",
  year="2023",
  volume="10",
  number="10",
  pages="8416--8431",
  doi="10.1109/JIOT.2022.3228816",
  issn="2327-4662",
  url="https://ieeexplore.ieee.org/document/9983820"
}