Peer-to-Peer Networking and Applications (2023) 16:1380–1431

https://doi.org/10.1007/s12083-023-01478-w

IoT malware: An attribute‑based taxonomy, detection mechanisms

and challenges
Princy Victor1 · Arash Habibi Lashkari2 · Rongxing Lu1 · Tinshu Sasi1 · Pulei Xiong3 · Shahrear Iqbal4

Received: 24 November 2022 / Accepted: 10 March 2023 / Published online: 10 May 2023
© The Author(s), under exclusive licence to Springer Science+Business Media, LLC, part of Springer Nature 2023

Abstract
During the past decade, the Internet of Things (IoT) has paved the way for the ongoing digitization of society in unique
ways. Its penetration into enterprise and day-to-day lives improved the supply chain in numerous ways. Unfortunately, the
profuse diversity of IoT devices has become an attractive target for malware authors who take advantage of its vulnerabili-
ties. Accordingly, enhancing the security of IoT devices has become the primary objective of industrialists and researchers.
However, most present studies lack a deep understanding of IoT malware and its various aspects. As understanding IoT
malware is the preliminary base of research, in this work, we present an IoT malware taxonomy with 100 attributes based on
the IoT malware categories, attack types, attack surfaces, malware distribution architecture, victim devices, victim device
architecture, IoT malware characteristics, access mechanisms, programming languages, and protocols. In addition, we have
mapped these categories into 77 IoT Malwares identified between 2008 and 2022. Furthermore, To provide insight into the
challenges in IoT malware research for future researchers, our study also reviews the existing IoT malware detection works.

Keywords Internet of Things · Malware · Taxonomy · Challenges of malware detection methods

1 Introduction

Internet-of-Things (IoT) refers to an extensive network of

smart interconnected devices such as home appliances, sen-
* Rongxing Lu sors, and actuators that transfer data without human inter-
[email protected] vention [1]. Over the years, Internet of Things (IoT) devices
Princy Victor have expanded drastically, hovering at 27 billion by 2025.
[email protected] According to IoT analytic experts, devices are growing at a
Arash Habibi Lashkari rate of 9% despite Covid-19’s influence on the supply chain
[email protected] [2]. However, the rapid growth of IoT and its lack of secu-
Tinshu Sasi rity mechanisms make them a valuable target for attackers,
[email protected] including malware authors.
Pulei Xiong As the nefarious activities in IoT devices are surging,
[email protected] researchers, industrialists, and security personnel are con-
Shahrear Iqbal cerned about consumers’ security. According to ZScaler
[email protected] telemetry reports, the IoT malware attacks during the Covid-
19 pandemic have increased dramatically, [3], and the mal-
1
Faculty of Computer Science, University of New Brunswick, ware modifications have been raised by three-fold compared
Fredericton NB E3B 5A3, Canada
to that during 2018. These IoT devices, ranging from smart-
2
School of Information Technology, York University, phones to underwater sensors [4], are vulnerable to several
Toronto ON M3J 1P3, Canada
privacy and security issues. Among the different attacks, the
3
National Research Council Canada, Ottawa ON K1A 0R6, most famous one is the Mirai attack that ensued in 2016 [5],
Canada
where the malware authors launched a DDoS attack, which
4
National Research Council Canada, brought down Brian Krebs’ website and famous Domain
Fredericton NB E3B 9W4, Canada

13
Vol:.(1234567890)
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1381

service provider Dyn. After the attack, the authors published of each IoT malware family. Overall, the selected attributes
the malware source code, which paved the way for creating offer a panoramic view of IoT malware that can create pos-
diverse malware like Okiru, Satori, etc. sibilities for a robust defensive and preventive solution.
In 2015, Hewlett Packard conducted a study on IoT As attributes alone cannot help in a deeper understand-
devices and identified that 90% of the devices capture at ing, a mapping was also needed so that each malware could
least one personal information, 80% display privacy issues, be studied extensively. Hence, 77 IoT malware families that
and 70% exhibit vulnerable user interfaces. Besides, they appeared between 2008 and 2022 are identified from differ-
also realized the main reasons as the absence of transport ent sources and mapped to these attributes. Interestingly, it
encryption, inadequate authorization and authentication, was recognized that most of the attributes are not family-
insecure software, web interface, and firmware [6]. The haz- specific and can be exhibited in other families as well. This
ards due to these devices affect the IoT system security and might be due to the release of novel malware by enhancing
the whole network, servers, websites, social networks, and publicly available malware source codes. The main objec-
applications. This risk of a single component that ultimately tive of the mapping was to help future research in this field,
affects the networking system [7] results in the new acronym especially attribute-specific or family-specific studies.
of IoT as the Internet of Troubles rather than the Internet To get a complete picture of IoT malware, existing detec-
of Things [8]. Under these circumstances, even though the tion mechanisms need to be studied by focusing on their
manufacturers considered security the primary objective challenges. Therefore, we have reviewed the various IoT
before developing an IoT device, increasing production costs malware detection articles and categorized them based
made them feel security was insignificant. on traditional and learning-based detection algorithms.
Security practices for IoT devices include protection by Moreover, we were able to identify the 12 challenges in IoT
developing secure devices or techniques to detect and pre- malware research, which can help create novel detection
vent IoT malwares. Many researchers in enterprises and aca- methods. Furthermore, each challenge was then concluded
demia focused on IoT security by considering these aspects with the future scope so that researchers could focus on the
and preventing the devices from threats. However, most of keywords provided for attaining the same. To the best of our
the current works focus on machine learning-based or deep knowledge, this is the foremost study that comprehensively
learning-based detection algorithms [1, 9, 10] rather than investigates IoT malwares, illustrates a taxonomy, and stud-
understanding the IoT malware that builds such an exten- ies the existing IoT malware detection mechanisms.
sive network of infected devices. Consequently, reviews are Overall, the contributions of the paper include the
required to analyze existing research conducted on the topic. following:
Meanwhile, some works like [11–15] discussed IoT mal-
ware, their different attacks, features and so on. • A comprehensive taxonomy of IoT malwares with 100
As a plethora of IoT malware is available, its expeditious attributes based on IoT malware categories, attack
evolution and mismatched explanations in different types, attack surfaces, malware distribution architec-
sources make the studies on IoT security more complex. ture, victim devices, victim device architecture, charac-
Furthermore, it is interesting that the malware once used for teristics, access mechanisms, programming languages,
personal computers is also advancing, affecting IoT devices. and protocols.
One example is Emotet which improved their Trojan and • A detailed analysis of 77 IoT malwares between 2008 and
compromised IoT devices [16]. Similarly, ransomware- 2022 based on the abovementioned categories.
categorized malware, once prevalent in mobile devices, has • A study on works related to IoT malware case studies,
already compromised IoT devices [17]. This highlights a surveys, and detection methods.
real need to face the IoT security issue seriously. Moreover, • Presents the existing challenges and future research
we believe that the scarcity of an organized and in-depth scopes in IoT malware.
study obstructs the malware prevention and protection of
the devices. Because of this, extensive research is needed The overall objective of the paper is to offer a
in IoT malware that considers both technical aspects and comprehensive reference to the IoT research community
existing solutions to solve security issues. for understanding the growth of IoT malwares and its
Considering the above facts, 100 attributes of IoT mal- consequences. The remainder of the paper is structured as
ware based on IoT malware categories, attack types, attack follows. Section 2 gives the background of IoT malware,
surfaces, malware distribution architectures, victim devices, and Section 3 describes the methodology used for writing
victim device architectures, characteristics, access mecha- this paper. Section 4 discusses the related taxonomies
nisms, programming languages, and protocols are discussed from past studies, and Section 5 presents the IoT malware
in this paper. As each malware behaves differently, the attrib- categories and their attributes. In Section 6 we discuss
utes selected in the study help in analyzing the overall aspect 77 IoT Malwares identified between 2008 and 2022,

13
1382 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

and Section 7 deals with the detection methods. Finally, the passwords or update poor passwords that Brute Force
Section 8 discusses the research challenges, conclusion, attacks can crack. Once the device is accessed, the attack-
and future work in Section 9. ers perform further infection based on their objective. Even
though IoT malware is used for different attacks, it is mainly
used for DDoS attacks, making the resources unavailable for
2 Background of IoT malware the users. However, the malware attacks can be prevented by
specific mechanisms, including [23]:
This section addresses the background of IoT malware in
a lucid manner. Malware is malicious software created for 1. Anti-virus and Anti-spyware software: Installing and
exploiting or attacking the devices, either into their hardware routinely updating your security software and any virus
or software [18]. There are different categories for malware, being uncovered must be removed immediately. Files
such as Virus, Trojan, Rootkit, Backdoor, etc. During the should be examined for errors, missing data, and illegal/
1980s, the malware was just file infectors or boot sectors that authorized changes.
were transferred through floppy disks inserted into the sys- 2. Secure Authentication: Securing IoT devices with Multi-
tem [19]. However, as the devices and technologies became Factor Authentication mechanism (MFA).
more standardized, malware has been advanced to attack 3. Least privilege principle: Give users the bare minimum
those devices. One such new technology being exploited of system features, services, and information needed to
by malware is IoT, which is a group of devices connected do their tasks.
to the Internet without human intervention [20, 21]. Unlike 4. Email and Spam Filtering: Putting spam and email secu-
traditional malware, IoT malware scans the Internet for rity procedures in place, every receiving email should
vulnerable devices and hosts their initial payload, which is have its attachments checked for malwares. Spam filter
a stager script, in the devices for downloading the archi- rules should be applied to reduce unwanted emails, and
tecture-specific binary sample. Once it is downloaded, the users should be blocked from accessing unauthorized
script executes the sample, which communicates with the emails, links and messages.
C&C server. Some scanner modules exist in the binary, so 5. File exchanging or downloading: Files should be
it infects more devices by distributing the sample. Most mal- exchanged or downloaded from trusted sources/web-
ware like Gamut, Necurs, and Skeeyah that used to attack sites only.
Personal computers started attacking IoT devices by advanc-
ing their capabilities. Following are some of the common
IoT vulnerabilities which make IoT devices attracted towards 3 Methodology
malware authors [22]:
This section presents the methodology of selecting relevant
1. Weak/default passwords: Lack of robust password articles, different data sources, search criteria, research
recovery mechanism; Weak or default password; Lack questions, taxonomy creation, and the scope of this work.
of enforcement of stronger password rules; Inability to In this paper, we have proposed a taxonomy, and it is devel-
modify the default username and password. oped based on the study of a vast amount of research arti-
2. Poor security awareness in users: Lack of granular per- cles and resources on IoT malware. To have meaningful
missions models in IoT devices, collection of excessive research, we limited the scope of the paper to the last five
user data, and inability to distinguish administrators years, with most of the papers selected from various data-
from users. bases, including IEEE Xplore, ScienceDirect, SpringerLink,
3. Lack of Encryption: Transmission of unencrypted data ACM Digital Library, and Google Scholar. On each data-
and credentials; Lack of integrity verification. base, search keywords like “IoT malware”, “Mirai”, “Smart
4. Firmware issues: Hardcoded credentials; files uploaded Home attack”, “IoT attack”, “IoT malware detection”, “IoT
are not encrypted or verified. malware survey”, “IoT malware machine learning”, and
5. Missing updates: Lack of software and security update “IoT malware review” were considered which led to finding
mechanisms. relevant papers. Moreover, we have included a backward
6. Insecure network: Connecting devices over insecure public approach for finding new articles and identifying new ones
networks; No login or screening mechanism to log in to based on the list of references in the article under study.
the network; networks with weak/no password policies. Furthermore, we narrowed the analysis by considering the
following questions:
Among all these shortcomings, weak/default passwords are
identified to be the primary reason for the attacks on IoT 1. What is the current research state of IoT malware as new
devices. To access the device easily, users skip changing attacks are emerging daily?

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1383

2. What are the different aspects of IoT malware? The taxonomy [12] considers the IoT and IIoT environ-
3. Which techniques are used to perform IoT malware ments along with their vulnerabilities, attack vectors, and
detection? eight different IoT malware families. Moreover, the taxon-
4. How can the research gaps identified in the existing IoT omy of DDoS attacks introduced in the work was from [24],
malware detection studies be filled? and vulnerabilities were from the top 10 OWASP threats.
Shobana and Rathi [13] discusses the nine most wide-
All articles on Automotive IoT were excluded, including IoT spread IoT malware between 2013 and 2017 and the IoT
malware papers from non-English journals or conferences. environment’s vulnerable points. This work explains the IoT
Following the abovementioned criteria, we have selected malware and the comparison based on the target devices,
articles and identified different aspects of IoT malware. On architecture, attack, number of devices, communication pro-
identifying each attribute, we briefly described one or two tocol, and language. Based on the study, the authors identi-
related works on that attribute. These associated works are fied the most attacked devices, architectures, communication
considered from online resources like Medium, Bleeping protocols, etc.
computer, Malwarebytes, etc. The work [14] investigates the evolution of the 16 most
widespread IoT malware between 2008 and 2018 by com-
paring various characteristic features such as DoS capa-
bilities, Data Stealing, Endpoint Exploit, Industrial Spying,
4 Related works Exploit, Target Architecture, Scanning methods, Botnet
architecture, Anti-detection Features, Efficiency Enhancing
Although numerous surveys were conducted on IoT Mal- Features, DGA Algorithm, Code Modularity, Victim Scan,
ware, there is no single complete literature on IoT malware Virtualization Evasion, and Crypto Mining. Besides, this
taxonomy. Therefore, we are proposing a new taxonomy work considers a phylogenic malware classification and a
in this section presents the works that analyze the existing feature propagation multi-graph that depicts how each mal-
taxonomies. A comparison of the current works with our ware influenced the successors and how the feature spreads
proposed work is shown in Table 1. in the malware pool. The authors identify the challenges IoT
In [11], a taxonomy of IoT malware DDoS attacks is dis- devices face and their solutions through this work.
cussed based on literature from 2008. This taxonomy clas- In their next work [15], 28 IoT malware from 2008 to
sifies DDoS attacks into subcategories based on architecture 2019 is considered in taxonomy with 77 taxa. Besides that,
model, exploited vulnerabilities, protocol level, degree of the authors could predict the future evolution of IoT botnets
automation, scanning strategy, propagation mechanism, using their simulation tool.
impact on the victim, attack rate, source address validity,
attack traffic distribution, resources involved, victim type.
Moreover, this work compares malware based on character- 5 IoT malware categories and families
istics such as source code, agent CPU, architecture model,
and attacks. This work also explains different DDoS attack This section discusses a new taxonomy with 100 attributes
phases: recruitment, exploitation, infection, communication, based on IoT malware categories, attack types, attack sur-
and the attack. faces, malware distribution architecture, victim devices,

Table 1  Comparison with existing works

Year Title # Malware # Attributes Taxonomy Malware Detection Challenges
discussed Mapping methods in Detection
methods

2017 Analysis of ddos-capable IoT malwares [11] 13 45 Yes Yes No Yes

2017 IoDDoS-the internet of distributed denial of sevice 8 4 Yes No No Yes
attacks [12]
2018 IoT malware: An analysis of IoT device hijacking [13] 9 39 No Yes No Yes
2019 10 years of IoT malware: A feature-based taxonomy 16 46 Yes Yes No Yes
[14]
2021 The evolution of IoT malwares, from 2008 to 2019: 28 77 Yes Yes No Yes
Survey, taxonomy, process simulator and perspectives
[15]
−− Proposed survey 77 100 Yes Yes Yes Yes

13
1384 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

IoT Malware Taxonomy

IoT Malware Malware Aack Type Aack Surface Target Device Target Devices Device Access IoT Malware Characteriscs Protocols Programming
Category Distribuon Architecture Mechanism Languages
Architecture
Worm Command and DDoS Aack Network MIPS Router Brute Force VM Detecon Telnet C
Control Aack
Trojan Peer to Peer Coin Mining Firewall MIPSEL Printer CVE Exploit Survive Reboot TCP Go/Golang/GoP

Virus Spamming Storage ARM Video Camera Target specific Stealthy FTP PHP
mechanisms
Backdoor Data Exfiltraon Soˆware ARC Smart TV Turn device to proxy server, SSH Perl
network, honeypots
Spyware PDoS Ports SuperH CCTV Close ports to prevent HTTP Lua
further infecon
Ransomware DNS Spoof Firmware PowerPC DVR New variants can be created BiTorrent VisualBasic

Command Injecon Communicaon SPARC WebCam Provide services UPnP C++

channels
Payload Execuon Memory X86/64 IP Camera Huge Packet Size Customized Delphi
protocols
Ransomware Server Intel 80386 Seop Box Use only one exploit Shell Commands

Website Hacking Hardware Motorola m68k Modem Vicm device architecture

detecon
Industrial Spying Renesas Smart Phone Periodic Command Execuon

Click Fraud Thermostat Binary Removal

Other Aacks Video Player Name stealing

-- White Hat Aack Storage Devices Name assignment

-- Download /Remove other Smart Toys UPX header inseron

malware
-- Infect other devices Smart Bulb DGA algorithm

-- Aacker purpose like Gaming Console Prevent reboot

downloading anime videos
NVR

Fig. 1  IoT Malware Taxonomy

victim device architecture, characteristics, access mecha- 5.1 Categories

nisms, programming languages, and protocols., as shown
in Fig. 1. Furthermore, this work better understands 77 Over the years, malware has evolved in functionality com-
IoT malware families between 2008 and 2022 by mapping plexity and caused a significant impact on nearly all devices.
them to each taxon based on the information gathered from Various malware categories exist based on their functional-
various reliable sources. ity, like Worms, Trojans, Viruses, Spyware, Ransomware,
Table 2 summarizes the references used to create dif- Rootkits, and backdoors. The exciting fact about IoT mal-
ferent attributes in the proposed taxonomy. ware is that even though they belong to different categories,

Table 2  IoT Malware Taxonomy Summary

Attribute Category Academic Source Other references

IoT Malware Category [26, 27, 29, 31, 33–35, 37, 38] [25, 28, 30, 32, 36]
IoT Botnet Architecture [11, 13–15, 39–41] [42]
Attack Type [11, 13–15, 22, 43–57] [14, 14, 26, 36, 58, 59, 59–67, 67–84]
Attack Surface [11, 13–15, 49, 50, 85–92] [25, 76, 93–98]
Target Device Architectures [1, 1, 1, 11, 13–15, 99, 100, 100–102] [103–112]
Target Devices [11, 13–15, 34, 37, 46, 48, 92, 113] [114–118]
Device Access Mechanisms [11, 13–15, 45, 92, 119, 120] [14, 59, 121–126]
Characteristics [11, 13–15, 15, 26, 27, 31, 127, 128] [14, 129–139]
Port/Protocols [11, 13–15, 26, 27, 91] [140–142, 142–145, 145, 146, 146–156]
Programming Language [11, 13] [157–164]

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1385

the nature of all malware is bot-based, which uses botnet as matching using YARA. Based on the results, the authors
a technique for malware distribution, execution, command, could identify that each IoT malware sample used in the
and control. This section explains the IoT malware catego- study was built using 13 building tools available on the
ries based on their functionality. web. Moreover, it was revealed that most of the sam-
ples used Firmware Linux 0.9.6 toolchain because of
1. Worm: This category of IoT malware spreads and propa- the description given in the Mirai installation guide.
gates itself in IoT devices in an automated fashion. Due 4. Spyware: The IoT malware category Spyware permits
to this propagation method, Juniper Threat [25] consid- the attackers to eavesdrop or spy the data on a target
ers the worm as an annoying malware. Mirai, Darlloz, using the infected device [32]. Spybot, Skeeyah, and
Brickerbot, and Gitpaste-12 are some of the worms in HNS are some IoT malware that spy on users. As IoT
IoT devices. However, some situations exist where cer- devices’ usage increases, attacks caused by this malware
tain malware is better for the systems. are rising drastically.
  One such IoT malware is Hajime which acts as a   A spyware category Context-Aware Adaptation-based
white-hat malware that secures the devices from other Spyware, SpyCon, was introduced in [33] where the
IoT malware. Various IoT malware analysis works daily behaviour of users is tracked from Smart Home
were also conducted to identify these types of malware and mobile phones. Integrating this spyware identified
behaviour. One such work is done by [26] in which a that it can spy on various human behaviours, including
lifespan is introduced to the Hajime worm using the average home-to-work commuting time, working hours,
PN2 method. The outcome of the work proved that the and weekend behaviour, with an accuracy of 90.3%. As
model is a safe mitigation technique that reduces the system behaviour and code signature-based, traditional
infection ratio of Mirai. Similarly, using several existing detection approaches could not detect Spycon; an infor-
artefacts, forensic analysis is done on the Mirai botnet mation-based detection engine was also proposed.
server in [27]. The work uses various tools, including 5. Ransomware: IoT Ransomware is a malware category
LiME, Volatility, DD8.3, Autopsy, WireShark, Bulk that holds the IoT devices and demands a ransom from
Extractor, and Ghidra. the victim to exchange the device [30]. Once the device
2. Trojan: A Trojan, also known as Trojan Horse or Tro- is infected, the attacker encrypts the files and restricts
jan Virus, is another IoT malware category where the the user from accessing them. After getting the ransom,
malware appears benign to the users even though it has the attacker gives the decryption key and releases the
a hidden malicious functionality [28]. Indeed, the func- device. Necurs is an IoT malware that launches a ran-
tionality of Virus and Trojan is entirely different as the somware attack and various other digital extortions.
Trojan cannot replicate itself, and the Virus can replicate   Various Ransomware attacks in IoT, including Fran-
[28]. An IoT malware, ProxyM, is a Trojan that performs tic Locker, attacks on Thermostats, Smart TVs, and
email spamming in addition to DDoS attacks. Smart Bulb, were presented in [34] along with their
 [29] discusses Trojan malware and various types of methodologies and preventive solutions. Furthermore,
attacks and vulnerabilities in IoT. Moreover, the chal- the authors delivered the frightening hazards that can
lenges in IoT are also presented following Confidential- occur due to Ransomware with the help of some real-life
ity, Integrity, and Availability. examples. However, the work could not cover the IoT
3. Virus: Although the Virus is a common term in computer malware families responsible for these attacks. Unlike
science, the Virus in IoT devices seems confusing. IoT other works, a descriptive survey was done in [35] where
virus works similarly to the normal virus category except the homeowners with IoT experience were interviewed
that IoT virus attacks IoT devices by self-replicating and given questionnaires to find the security threats,
malicious programs [30]. Due to this reason, the Virus including Ransomware in IoT. Nevertheless, an in-depth
is hard to clean, and it attacks the device in a complex analysis was not performed to identify the challenges.
way. For example, Silex is an IoT virus that logs into 6. Backdoor: Backdoor, an IoT malware category, is a type
the device and attacks it by bricking it, also known as a of malware where manufacturers make several hidden
Permanent DoS attack. access mechanisms [30]. Although these mechanisms
  Various toolchains exist to create this IoT malware make the customer fulfil requirements, these pave the way
for architectures like ARC, ARM, MIPS, PowerPC, etc. for making the device poor in security aspects. As a result,
Work was done by [31] for identifying the toolchains backdoors are also known as the front door of attackers
used for IoT malware like Silex, Tsunami, Mirai, Gafgyt, [36]. Tsunami and Bashlite are backdoor IoT malware
etc. For each toolchain available on the web, the authors with a few resources that address them as Trojans.
have generated patterns of library functions and identi-   The work [37] gave an overview of backdoors in IoT
fied the library functions in the IoT malware by pattern and discussed different types of attacks, including sim-

13
1386 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

ple attacks, complicated attacks, IoT-initiated attacks, 1. Command and Control: Command-and-Control (C&C)
internal attacks, and accomplice attacks that can occur is a centralized architecture that sends commands to the
in IoT devices. Moreover, the work introduced an IoT- bots using various communication protocols, including
enabled network infrastructure that monitors incom- Internet Relay Chat or Hypertext Transfer Protocol. This
ing and outgoing packets in IoT devices and matches is the broadly used botnet architecture due to its simplic-
the pre-defined pattern for finding attacks. As part of ity. Nevertheless, it is easy to remove the server when
this work, backdoor scripts were used on Raspberry discovered as it has a centralized server [42] as shown in
Pi devices. However, the work is not applicable for Fig. 2. Mirai, Aidra, and Okane are some IoT Malware
unordered packet patterns and exhibits an overfitting with C&C architecture.
problem when considering actual IoT attacks like ses-   Malware authors use several techniques to avoid the
sion hijacking. tracking of the C&C server. One such method, fast-flux,
  A work [38] investigated a smart controller and a is discussed in [39], where the botnet uses various IP
smart meter to identify their security vulnerabilities and addresses and domain names to hide the C&C server. In
promote the creation of IoT security methods that are this work, botnet domain name characteristics are ana-
less expensive. The study found that these devices can lyzed and detected to filter out the same and stop com-
be attacked even with simple backdoors and could lead munication. To achieve this, the Rustock botnet, which
to hijacking functionality, damaging property, deploying uses a.cn top-level domain server, was studied, and the
rogue services, disrupting operations, and so on. log data from the server was collected. Moreover, 32
botnet domain name features, such as Meaningful length
ratio, queries per recursive server, queries per hour, etc.,
5.2 Malware distribution architecture were estimated for the malicious domain name detection
model. However, the model considers a small imbal-
As mentioned in the section 5.1, all IoT malware catego- anced dataset and is considered in future work.
ries can use infected devices within the botnet to propagate   A Threshold Random Walk (TRW) based IoT botnet
malware further to uninfected devices. The attributes in detection approach, ConnSpoiler, is proposed in [41] by
this section discuss the most commonly used two kinds of investigating the random NXDOMAINs generated by
architectures used for malware distribution. the DGA(Domain Generation Algorithm) schemes. In

Fig. 2  C&C Botnet Architecture

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1387

this model, a finite-state machine is used to handle the Table 3  Comparison on C&C and P2P Architecture
system by identifying the malicious attempts and alert- C&C Architecture P2P Architecture
ing the system, which prevents the device’s connection
to C&C. Moreover, as it needs fewer system resources, Easy to take down once discovered Hard to take down
this is well-suited for resource-constrained IoT devices. Must contain the list of all bots in the Contains the list of
network neighboring peers
Unlike other works, in this model, real-world DNS traf-
only
fic is collected from two large ISPs, and results proved
Easy to discover malicious traffic due to Hard to distinguish
that the proposed model could detect the unknown IoT the unusual traffic size malicious and
botnets that create domains never reported earlier. legitimate traffic
2. Peer to Peer: Peer-to-Peer (P2P) architecture is a
decentralized architecture that considers each bot as
both server and client [42] as shown in Fig. 3. Due to not deal with the simulations and presented the same as
this characteristic, unlike C&C architecture, it is hard future work to compare the effectiveness.
to take down the network. However, it is not widely
used. Hajime, a worm, is one IoT malware that follows A comparison of C&C and P2P Architecture is illustrated
P2P architecture. in Table 3, and mapping of IoT malware to the architecture
  A work [40] also briefly discusses the advantages of is depicted in Table 4.
P2P architecture over C&C architecture. Moreover, the
phases of the product development life cycle CRIME are 5.3 Attack types
explained by giving a lucid explanation of Conception,
Recruiting, Interaction, Marketing, and Execution. In Attributes under attack types discuss the various ways in
addition to that, different botnet models, including Epi- which the IoT malware attacks IoT devices.
demiological Models, Machine Learning Models, Sto-
chastic Models, Game Theory Models, Non-parametric 1. DDoS Attack (A1): DDoS is an attack where the
Bayesian Models, Graph Models, and Economic Mod- attacker prevents the users from accessing the
els, are also studied in this work. However, the paper did resources by making them unavailable [68]. DDoS

Fig. 3  P2P Botnet Architecture

13
1388 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

Table 4  Malware Distribution Architecture Table 4  (continued)

Category Malware Year Architecture Category Malware Year Architecture

C&C P2P C&C P2P

Worm Mirai 2016 X IoTReaper/IoTroop 2017 X

Hajime 2016 X Elknot/BillGates/Mayday 2015 X
Aidra 2012 X Gr1n 2017 X
Darlloz/Zollard 2013 X Setag 2014 X
Satori 2017 X Karu 2019 X
Sefa 2018 X InterPlanetaryStorm 2020 X
Okane 2018 X Trojan Blueborne 2017 X
Okiru 2018 X ProxyM 2017 X
ZHtrap 2021 X Luabot 2016 X
Persirai 2017 X Emotet 2014 X
Gitpaste-12 2020 X AirDropBot/Cloudbot 2019 X
Moose 2015 X Leet 2016 X
Shishiga 2017 X Pnscan 2016 X
Mozi 2019 X dark_nexus 2020 X
Carna 2012 X Hydra 2008 X
Echobot 2019 X Demonbot 2018 X
Wicked 2018 X APEP 2018 X
Masuta 2018 X Ares 2019 X
Tori 2018 X Kluh 2015 X
Bushido 2018 X Qbot 2008 X
JenX 2018 X Virus Silex 2019 X
Miori 2018 X Amnesia 2017 X
Sora 2018 X Wifatch 2014 X
Omni 2018 X Joker 2017 X
Fritzfrog 2020 X Cereal 2012 X
TheMoon 2014 X HEH 2020 X
Yowai 2019 X
OMG 2018 X
Owari 2018 X attacks in IoT devices have rapidly increased in the
Ouija 2017 X past few years, putting the IoT world in a hazardous
Spyware VPNFilter 2018 X situation. Due to this reason, it is one of the top attacks
Psybot 2009 X caused by IoT malware. Even though this attack can
Gamut 2013 X occur from multiple categories of IoT Malware, the
Hide and Seek 2018 X worm is the most widely used category. According to
Xarcen/XORDDoS 2015 X [83], Mirai, which belongs to the Worm category, and
Spybot 2005 X Kaiji [60], which belongs to the Backdoor category, are
Skeeyah 2015 X some of the IoT malware that performs DDoS attacks.
Ransomware Necurs 2016 X   IoT DDoS attack is clearly explained in [51] by
Cr1ptT0r 2019 X mentioning the IoT device vulnerabilities, protocols,
Hades 2020 X and the working of the attack in each layer. In addi-
Razor 2019 X tion, malware, including Mirai, Reaper, and Torii, that
Lulz 2017 X causes DDoS attacks on IoT devices are also discussed,
Muhstik 2017 X along with different detection methods. [49] presents
Backdoor Bashlite 2014 X an IoT DoS and DDoS attacks detection method by
Kaiji 2020 X converting network traffic data into an image using
Tsunami 2010 X OpenCV, from which the patterns are identified using
IRCflu 2020 X a residual network model ResNet. Results proved
Brickerbot 2017 X that the model achieved 87% accuracy, more than the

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1389

state-of-the-art methods. Another machine learning- this experiment, the author used spammer and actual
based DDoS attack detection model is introduced in links and identified the hits on each website.
[47] that consists of three layers of defence; the first 4. Data Exfiltration (A4): Data exfiltration, also known as
defence layer prevents the access of blacklisted devices data extrusion or data theft, is the unauthorized data
by authenticating ZigBee and Bluetooth devices. The transfer from the IoT device either manually or using
second defence layer detects the DDoS attack using malware attack [72]. This includes data compression
a decision tree in preprocessed data, and the third and disassembling it into short undetectable chunks. A
defence layer is where the blacklisted devices are pre- variant Mozi of worm category evolved from the IoT
vented from access. malware Gafgyt, IoT Reaper, and Mirai focuses on data
2. Coin Mining (A2): Coin mining attacks mine various exfiltration and other attacks such as command injection
types of cryptocurrencies such as XMR, bitcoins, and and payload execution [61]. In addition, malware like
dogecoins by hijacking IoT devices [73]. As some of HNS from Spyware, Razor, and Lulz from Ransomware
the existing IoT malware evolves with new features, is also known for data exfiltration in IoT devices.
coin mining is an evolving threat not limited to any   A data exfiltration attack is performed in [46] using
particular coin. Fritzfrog [65], Satori, and Sefa from a smart light bulb in a secure environment where peo-
the Worm category, and Dofloo and Ayedz from the ple have limitations in accessing the data. This is done
Backdoor category are some of the IoT malware per- using a chromium-based web browser and the Blue-
forms coin mining in IoT devices. tooth web API. The web application does not need any
  Coin mining is also discussed in [55], which pre- internet connection, administration rights, or software
sents a hybrid IoT honeypot, IoTCMal, that records 8 installation and can be used in air-gapped networks.
IoT malware families of 11 infection patterns with dif- In this data exfiltration attack, the attacker inside the
ferent capabilities for DDoS and coin mining attacks. network performs data encoding in Bluetooth com-
On successful implementation, 8 IoT malware families mands with a javascript script to be accessed within
are captured with 11 infection patterns and named each 25 m from the smart bulb. Two techniques are used for
pattern according to the character strings in the sam- the script deployment; the inside attacker can take the
ples. The malicious samples were captured using two QR-code with embedded script on paper, or a minified
components, and corresponding logs and patterns were version of the script is rewritten inside the protected
recorded. Likewise, another article [22] also discusses area. Once the script is opened in a Chromium-based
the DDoS and coin mining attacks in IoT devices in web browser, it is executed, and data is encoded using
addition to the vulnerabilities, security measures, and steganography. The data thus encoded is sniffed from
different aspects of IoT botnets. the receptor side utilizing a computer, BLE sniffer,
3. Spamming (A3): Spam attacks or spamming is one of WireShark, and Python script. Results proved that
the quotidian attacks where innumerable messages are the data could be exfiltrated, and the smart bulb col-
sent to people in an unauthorized way using any digital our could be adjusted without notifying the owner. In
systems like a social network, mobile phones, etc. [81]. future work, Javascript scripts can be used for optical
ProxyM that belongs to the Trojan category is one of channel attacks when Bluetooth connections cannot
the IoT malware spams, and the device that is infected be sniffed.
receives an SMTP server address, credentials to access 5. PDoS Attack (A5): PDoS, also known as Permanent
the server, an email address list and an email template Denial of Service, is an attack type similar to a DoS
for sending numerous emails to the mail addresses pro- attack except for the fact that the hardware is destructed
vided [62]. or sabotaged instead of the resources [76]. Brickerbot
  A work [53] was proposed to address the QR-based malware, which belongs to the Backdoor category,
web spamming in IoT using digital signature-embedded performs a group of Linux commands after gaining
QR codes. This work generates a digitally signed QR access to the device and aims to damage the hardware
code with original content, and a digital signature is permanently. Unlike other attacks, rebooting cannot
generated using an Elliptic Curve private-public key remove the infection from the device and IoT malware.
pair and the content creator’s public key. The digital Spyware is another category known for PDoS attacks
certificates are placed at the URL if the content is a using IoT malware like Skeeyah and VPNFilter.
website link. Once the QR code is generated, a mobile   Permanent DoS attacks were concisely described
application is used to verify the QR code by retrieving in work [50], which identifies the different IoT attacks
the original content, signed version, and public key of in IoT wireless protocols such as BLE, LoRaWAN,
the content creator. This application ensured the QR Z-Wave, and ZigBee along with their vulnerabilities.
code’s integrity and opened the referred website. For PDoS and several other attacks like DDoS and Coin-

13
1390 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

mining were also discussed in [44], which detects 8. Payload Execution (A8): Payload execution in IoT is
these attacks using FastGRNN, which offers faster an attack type where the malicious payload is down-
detection with less complexity. As it does not require loaded to the device and remains in a dormant phase
additional equipment, it is considered an independent until it is executed [78]. Once executed, it takes over
module with less training time. Moreover, the work the IoT device and follows various other attacks. Mozi
also compares other deep learning algorithms using from the Worm category, Luabot, and Wroba from the
two datasets. Trojan category do payload execution in IoT devices in
6. DNS Spoof (A6): Domain Name System (DNS) is an addition to their different attack types. As mentioned
Internet phone book that helps in resolving the domain in the above section, Mozi is known for several attacks
names to find the corresponding Internet Protocol on IoT devices.
address [79]. However, DNS records can be altered   An interesting fact about the payload is discussed
by malware attacks that result in traffic redirection to in [36], where the malware is the secondary payload
a malicious website that causes theft of credentials or once downloaded. It will perform other attacks related
related attacks [82]. Tsunami from the Backdoor cat- to that particular malware.
egory is an IoT malware that performs DNS spoofing 9. Ransomware (A9): This attack holds the device by
in IoT devices, where the user credentials are stolen by encrypting the files inside them and demands a ran-
providing them with a fake website. Ttint and Wroba som in exchange for the decryption key. Unlike other
from the Trojan category also perform DNS spoofing malware, Ransomware is both an attack type and a
in IoT devices. malware category. Even though ransomware is a typi-
  DNS Spoofing is one of the several attacks used for cal attack on ordinary devices, it severely impacts IoT
testing the IISR router proposed in [48], using differ- devices, according to the latest reports by [67]. Necurs,
ent penetration testing tools in Kali Linux. However, a malware that appeared in 2012, is known for its capa-
results found that except for DNS Spoofing, Malware bility to perform ransomware attacks in both IoT and
Injection, and Firmware Vulnerability attacks, all ordinary devices [75].
attacks were detected by the proposed router. DNS-   IoT ransomware attacks during the two years are
related attack like DDoS, Spoofing is also discussed reviewed in [56] to understand the increase in IoT ran-
in [52], with examples like Dyn and a target-specific somware attacks. In addition, a Cryptowall ransom-
university attack. Even though DNS-based attack is ware attack detection model is also presented in this
common, recognizing the same is crucial to the model. work, where the TCP/IP header is extracted from the
This article also discussed the solutions to prevent the traffic, and C&C is used for the blacklisting. However,
same, like building a standard for IoT devices. the model could not address new or unknown C&C
7. Command Injection Attack (A7): Command injection servers, and in the future, new ransomware families
in IoT is an attack that executes arbitrary commands and attack nature in different operating system plat-
on the host device through vulnerable web interfaces forms need to be studied.
or applications [69]. Although code injection and com- 10. Industrial Spying (A10): Industrial Spying is an attack
mand injection appear similar, code injection is an where IoT malware targets industries to spy on their
attack where the attacker adds code to the application. movements and control operations. This IoT malware
In contrast, command injection executes commands often attacks SCADA systems known for capturing
without injection of code [84]. Mozi, an IoT Malware data from turbines in the industry [14]. VPNFilter,
from the worm category, is known for different attacks, spyware, is one such IoT malware that targets Ukrain-
including command injection, payload execution, and ian hosts and makes the industry activities slow down
data exfiltration. using a C&C server specific for this specific country
  A Command injection attack is focused in [57] [59]. In addition, spyware like Skeeyah and worms like
where the PLC register values are identified and altered Omni and Themoon also perform industrial Spying in
for the malfunctioning of two pumps in an Industrial IoT areas.
IoT testbed. Furthermore, the work also identifies the   Spying, along with different attacks like data
challenges of IIoT-ML integration as the effect of type probing, is detected in [45], using a three-stage
imbalanced datasets in detection models. The authors machine learning-based detection model. Stage one
have used an ANN-based anomaly detection model includes the dataset preparation and assortment. The
with an imbalance ratio to prove the same. Instead of data is then passed through the preprocessing phase
standard performance measures, MCC, also known as involving data cleaning, visualization, feature engi-
Matthews Correlation Coefficient, is used for the per- neering, and vectorization. Once the preprocessing is
formance evaluation. done, sampling is performed, and the dataset is divided

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1391

into training and testing sets. The training set is then infecting other IoT devices(A15), downloading anime
applied with machine learning algorithms such as videos(A16).
Logistic Regression, SVM, ANN, Decision tree, and
Random Forest.
5.4 Attack surfaces
11. Website Hacking (A11): This attack access website in
an unauthorized way for performing various activi-
An attack surface is the vulnerable parts, or the exploit-
ties like information theft, content modification, and
able vulnerabilities in the system [165] that cause risks to
at times, adding malware to the device that views the
the devices. The traditional attack surface classification
website [66]. ProxyM of the Trojan category is one
can be classified into network attack surface, human attack
such IoT Malware attackers use to perform website
surface, and software attack surface. Unlike other malware,
hacks [74]. This malware’s proxy server hacks web-
attacks by IoT malware are not limited to any one part
sites via different techniques, including SQL injec-
of the device. Therefore, unlike the general classification,
tions, XSS, and Local File Inclusion. Worms like
attack surfaces are classified into network and network
Omni and Themoon also perform website hacking in
device-level, service-level, firmware-level, and device-level
IoT devices.
attack surfaces. Table 5 illustrates the mapping of various
  Website hacking is discussed in [54], with differ-
IoT malware to its attack type and surfaces.
ent vulnerabilities such as code execution, command
execution, buffer overflow, etc. Moreover, the paper
1. Network and network devices: IoT itself is known as a
addressed a crawler model that identifies the vulner-
network of interconnected devices. Sometimes, this net-
ability trends or patterns using a four-step process:
work and network devices can be an attack surface due
Building a functional crawler using the dark web,
to the vulnerabilities in the system.
classifying vulnerabilities based on keywords, storing
results in a database, and visualization all vulnerabili- • Network (S1): Each IoT malware behaves differ-
ties using a python script that executes in a website. ently in the network attack surface. For example,
The model proved that vulnerability trends could be When IoT malware like Silex of the Virus category
identified quickly based on the results. removes the network configuration while infecting
  Another work [43] introduced two web-based attacks the device [96], another IoT malware, Blueborne of
to discover and manage the local IoT devices using a the Trojan category, sniffs the traffic by penetrating
malicious website where the IoT devices present behind the ’air gapped’ network.
NATs can also be found. This model identifies the local   In DoS attacks, the network is the attack surface,
IoT devices when a victim visits the malicious web page. and there exist works like [49] for its detection. This
The infected devices can be controlled to identify infor- work converts network traffic data into an image and
mation such as software version, SSID, model number, performs detection. However, in most works, the
Owner name, status, and a unique ID. Moreover, the attack types are more focused than the attack surface.
work proposes various countermeasures to prevent this • Firewall (S2): Firewall, a network-level attack sur-
attack and compares model performance in different face, is a security system that controls the incoming
operating systems, devices, and web browsers. as well as outgoing traffic passing through the system
12. Click Fraud (A12): Click fraud is the attack in which using a set of predefined rules [93]. Usually, firewalls
the marketing of companies is fraudulently manipu- will be there between these devices and the internet.
lated by clicking pay-per-click advertisements in an However, when malware infects the IoT device, it
unauthorized manner [70]. In the case of IoT, a bot drops firewall rules and makes changes to the net-
acts as a legitimate visitor and tricks the platform. work configuration changes. This opens the IoT
For example, the creators of Mirai Worm were con- devices to attacks like DDoS UDP flooding, DDoS
victed for leasing it for DDoS and click fraud attacks TCP-SYN flooding, phishing etc. One example is
[80]. TheMoon, ZHTrap belongs to the same worm Silex Virus [90, 96].
category and focuses on click fraud as their attack in   However, most companies and homes use tradi-
IoT devices. tional firewalls that cannot detect data packets and
13. Other attacks: Some other attacks are not expected as their content due to the absence of features like anti-
the attacks mentioned above. It includes the White Hat spam and anti-virus. Hence thorough examination
attack, which notifies the vulnerabilities(A13) in the of the data packets was required. As a solution for
device to the user so that the user can take the neces- this problem, Unified Threat Management came into
sary steps to prevent further attacks [26], download- existence with these features. But, due to repeated
ing or removing other malware like Backdoor (A14), inspections that cause increased latency and pro-

13
 Table 5  Attack surfaces and attack types of IoT malware
1392

Category Malware Attack Surface Attack Type

13
S1 S2 S3 S4 S5 S6 S7 S8 S9 S10 A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16

Worm Mirai X X X X X
Hajime X X X
Aidra X X X
Darlloz/Zollard X X X
Satori X X X X X X
Sefa X X X
Okane X X
Okiru X X
ZHtrap X X X X X X
Persirai X X X X X X X
Gitpaste-12 X X X X X X X X
Moose X X X X X X X
Shishiga X X
Mozi X X X X X X X X X
Carna X X X X
Echobot X X X X X X X
Wicked X X X X
Masuta X X X X X
Tori X X X X X X
Bushido X X
JenX X X X X X
Miori X X X X X
Sora X X X X X
Omni X X X
Fritzfrog X X X X
TheMoon X X X X X
Yowai X X X
OMG X X X
Owari X X
Ouija X X X X
Spyware VPNFilter X X X X X X X X X X X X X X
Psybot X X X X
Gamut X X X X
Hide and Seek X X X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431
 Table 5  (continued)
Category Malware Attack Surface Attack Type
S1 S2 S3 S4 S5 S6 S7 S8 S9 S10 A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16

Xarcen/XORDDoS X X X X X X X
Spybot X X X X
Skeeyah X X X X X X X X
Ransomware Necurs X X X X X
Cr1ptT0r X X X X
Hades X X X X X
Razor X X X X
Lulz X X X X X X
Muhstik X X X X X X X X X
Backdoor Bashlite X X X X X
Kaiji X X
Tsunami X X X X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431

IRCflu X X X X
Brickerbot X X X X X X X X X X
IoTReaper/IoTroop X X X X X X
Elknot/BillGates/Mayday X X
Gr1n X X X X
Setag X X X X
Karu X X X X
InterPlanetaryStorm X X X X
Trojan Blueborne X X X X X X
ProxyM X X X
Luabot X X X X X
Emotet X X X X
AirDropBot/Cloudbot X X
Leet X X
Pnscan X X X
dark_nexus X X X
Hydra X X
Demonbot X X X X X
APEP X X
Ares X X X
Kluh X X
Qbot X X X X X X

13
1393
 1394 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

cessing, a firewall known as the Next-Generation

A10 A11 A12 A13 A14 A15 A16

Firewall was proposed. In [90], different attacks

X
like DDoS UDP flooding, DDoS TCP-SYN flood-
ing, phishing, and SQL Injection were carried out in
the IBM ISS Proventia firewall and Next-Generation
Firewall. Based on the results, the authors concluded
that the IBM ISS firewall blocked only DDoS UDP
X

flooding, and NGF prevented all the attacks.

• Communication channels (S7): The channels that
connect several IoT devices are another attack sur-
face. This includes the protocols that have security
vulnerabilities [166]. One such wireless protocol
is Bluetooth which acts as a communication pro-
A9

tocol in IoT devices. However, it has been proved

that Bluetooth can also work as an attack vector and
A8

vulnerability due to the emergence of the new IoT

A7

malware called Blueborne Trojan [98]. The impact

X

of dangers caused by IoT malware can be under-

A6

stood when we know that Blueborne doesn’t even

A5

need Bluetooth to be paired between devices. Due

X

to this reason, this IoT malware is also known as

A4

Airborne malware.
A3

  In works like [86], the experimental study for

Attack Type

security is conducted on Bluetooth devices. In this

A2

work, the Bluetooth dynamic analysis tested essen-

S10 A1

tial parameters in Security Management Protocols

X
X

(SMP) for key cracking and fake device formation.

Similarly, [92] presented a penetration testing tool
for IoT devices that communicate via Bluetooth,
S9

WiFi, and ZigBee.

S8

X
X

2. Services: Services are another attack surface in IoT

S7

devices, divided into two sub-levels, as shown below.

S6

• Software as a service (S4): IoT Software is a group of

programs or data that helps the IoT device work and
S5

execute specific tasks. Unfortunately, vulnerabilities

S4

in software are increasing in a peak manner, and it

X

X
Attack Surface

is understandable from IoT malware Satori from the

S3

worm category as they target the software vulner-

abilities in the routers [95].
S2

  Satori is discussed in [87] where an IoT malware

S1

network activity detection model, EDIMA, is pro-

posed, which extracts the features from the incom-
ing traffic samples. Once the features were extracted,
various ML algorithms, including DT, SVM, and
NB, were used to classify IoT malware.
• Server as a service (S9): Server, a software-level
Malware

Amnesia
Wifatch

attack surface, is a computer program or device that

Cereal
Joker
Table 5  (continued)

HEH
Silex

offers a service to another computer program and its

user, also known as the client. Servers like SSH and
Github are often exploited by IoT malware like Git-
Category

paste of the worm category, which affects the service

Virus

provided by those servers [25].

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1395

  Several authentication methods were proposed • Storage(S3): In IoT, data capturing and computation
using the Chain of Trust and Threat models to capabilities are provided by edge storage, making the
secure these servers. Works like [85] were also pro- system deliver the insights after analyzing it. Still,
posed, where security keys supporting authentica- IoT malware also finds ways to attack the storage in
tion and registration are used to secure IoT servers IoT devices. Brickerbot from Backdoor is the best
and devices using encryption. The proposed model example, as it corrupts the Multi-Media Card and
was developed with the goals of easiness, security, Memory Technology Device storage. In addition,
and privacy. Silex Virus, the malware mentioned in the network
and firewall attack surface, also affects the storage
3. Firmware (S6): IoT Firmware, often called the heart
[96] proves that IoT malware is not limited to any
of IoT devices, offers adequate communication com-
one attack surface.
mands with other devices. The most common attack on
  Brickerbot is also mentioned in [88] by explain-
the firmware is the PDoS attack, where the firmware
ing its attack types and the prevention mechanisms,
is sabotaged due to IoT malware such as Silex Virus,
such as periodic device updates, firewall setup, and
Brickerbot Trojan, and so on [96].
authentication techniques. The authors also explain
  Even though there exist several analysis solutions
how AI is used to attack devices which is not widely
for firmware vulnerabilities, most focus on the analysis
discussed in the existing papers.
improvement rather than integrating them for a model
• Memory (S8): Even though a device’s memory is
that audits the firmware, network services, and web
confused with storage, the main difference between
interfaces. Despite this, in [86], the problem is solved
memory and storage is that memory is a component
by proposing a modular, extendable, and configurable
that offers short-term access. Meanwhile, storage is
model with a web interface for the Quality Assur-
a component that provides long-term access. In IoT,
ance team and users. Unlike existing works, static and
memory is also an attack surface that gets corrupted
dynamic analyses were performed on the kernel, boot-
due to malware activities. IoT malware Amnesia,
loader, file systems, and unpacked firmware images.
which belongs to the Virus category, is one exam-
The outcome of the work revealed that most firmware
ple of memory corruption in addition to attacks like
contained hard-coded addresses, username-password
DDoS and data exfiltration [94].
combinations, certificates, etc.
  MAD-IoT, proposed in [89], detects the anomalies
4. Devices: In addition to the above attack surfaces,
in IoT device memory content by placing a memory
specific components of the devices also act as the
agent in an isolated environment. In addition, due to
attack surfaces.
the heterogeneity of devices, different measurement
• Ports (S5): Ports are the communication endpoints agents are created using a portable technique called
where the network connection starts and ends. IMAGE: Integrity Measurement Agent GEneration.
Ports are mainly affected by IoT malware which The memory contents thus gathered are fed into ML
belongs to the worm category. Most existing IoT algorithms for identifying normal device operations.
malware finds vulnerabilities in the port for the • Hardware (S10): Hardware is a term used to col-
first step of infection of the device. One example lectively mention a device’s physical parts like
is the Mirai worm, which identifies open TELNET motherboard, monitor, CPU, etc. IoT malware like
TCP ports and infects the machine. Once it infects Brickerbot Backdoor affects the devices’ hardware,
the device, the malware moves to the second phase permanently making them unusable devices [76].
of the attack [97].   Usually, the hardware is affected by permanent
  A work [91] used IoTPoT as the source of IoT DoS attacks on the devices. A brief explanation
malware samples where the limited IP addresses of PDoS due to the multiple join requests from
mainly connect with Telnet-specific requests. IoT LoRaWAN protocol is discussed in [50].
malware characterization is performed in this work
by identifying the correlations in adversarial IPs and
strings. Based on the finding, the authors determined 5.5 Target devices
that some malware samples contained the keywords
“Corona” and “Covid”, demonstrating that covid In the Internet of Things, the ‘things’ refer to any devices,
related IoT malware attacks were also present in the actuators, sensors, or monitors interacting with the environ-
code-reusing situations. Moreover, results proved ment for data collection and several other purposes [167].
that the proposed method helps identify the corre- Even though the device can be user-friendly, the problem
lated IoT malware. with the IoT device is that security is not given importance

13
1396 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

compared to customer satisfaction. Due to these reasons,   In [1], different IoT malware strewed across different
the number of attacks on IoT devices increases daily. This IoT architectures, including MIPS, was considered the
attribute indicates the different IoT devices that are attacked input for IoT malware detection. Unlike other existing
by IoT malware. works, the model could also focus on various obfusca-
Routers (TD3) [48] are the most exploited device among tion attacks.
various IoT devices by different IoT malware, including 2. MIPSEL (TDA2): MIPSEL is similar to MIPS except that
Masuta, Mirai [113], Darlloz, WiFatch, Hajime, Ttint [117] MIPS has a big-endian architecture, whereas MIPSEL
Remaiten, etc. Mirai also attacks devices including print- is a little-endian architecture. Spybot, Skeeyah from the
ers (TD1) [114], CCTVs (TD5) [115], Smart TVs (TD4) Spyware category, and Echobot, Wicked from the Worm
[118], Smart Toys (TD14) [116], Video camera (TD2), category often attack devices of MIPSEL architecture.
gaming consoles (TD16), Thermostats (TD18), etc. The  [168] considers MIPSEL samples along with MIPS
open ports in IP cameras (TD8) are likewise exploitable and ARM samples for similarity-based malware clas-
and thus considered the second most prominent victim in sification. The work uses the Jaccard index and t-SNE to
IoT devices. On the other hand, IoT malware Hajime often identify the similarities and outcomes, revealing that the
affects webcams (TD7) and DVR (TD6)s, whereas the IoT proposed model performs well in malware classification.
malware Darlloz exploits the PHP vulnerabilities of set- 3. ARM (TDA3): ARM (Advanced RISC Machines) is an
top boxes(TD9). Other devices such as Modems (TD10), advanced RISC for device processors used for different
SmartPhone (TD11), Video players (TD12), storage devices environments [104]. These architectures often contain
(TD13), Smart Bulb (TD15), and NVR (TD17) are also the chips and modules linked to memory, interfaces, etc.
victims of IoT malware. Overall, it can be said that IoT mal- WiFatch belongs to the Virus category, and Luabot,
ware is not limited to any particular device, and malware which belongs to the Trojan category, are some of the IoT
can be from any category, such as Worm, Trojan, Backdoor, malware that impacts devices of the ARM architecture.
Virus, etc.   Owing to the growth of architecture-specific IoT
In [37], Raspberry Pi devices were attacked with back- malware attacks, in [99], a deep learning approach was
door scripts, whereas in [92], Raspberry Pi is considered used for malware detection based on ARM architecture
as an IoT device for analyzing their proposed penetration samples. As this was related to ARM, the authors sug-
testing tool. Similarly, [46] experimented with a smart light gested considering the model in different architectures
bulb for data exfiltration attack. [113] discussed on Mirai in future work.
and Bashlite that targets the Routers with vulnerable points. 4. X86/64 (TDA4): x86/x64 is an architecture that allows
Furthermore, [34] discussed various Ransomware attacks on 16-bit and 32-bit applications to run with the applica-
Thermostats, Smart TVs, and Smart bulbs, along with their tions of 64-bit due to the compatibility mode [112].
processes and preventive solutions. As a result, these architectures are now widely used in
Table 6 depicts the IoT malware and devices they often IoT devices, and the devices with this architecture are
target. usually called CISC processors. Satori, Sefa, Okane,
and Okiru in the Worm category are widely known for
5.6 Target device architecture attacking x86/64 architecture devices.
  As IoT malware source codes can be cross-compiled
Different device architectures exist for IoT devices, with and attacked in different devices, the researchers
specific objectives like performance. This section discusses started focusing on architecture-specific and mal-
the different target architectures of devices attacked by IoT ware-specific samples for their works. An IoT mal-
malware. ware classification model [100] that used Haralick
texture features and ML methods has considered a
1. MIPS (TDA1): MIPS (Microprocessor without Inter- dataset with Mirai and Bashlite samples which spans
locked Pipelined Stages) is a RISC ISA (Reduced their attacks on various architectures like MIPS,
Instruction Set Computer Instruction Set) [106] X86, SUPERH, etc.
present in numerous devices such as cameras, 5. Intel 80386 (TDA5): The Intel 80386 is a 32-bit micro-
routers, transmitters, etc. As devices like routers processor that speeds from 12Mhz to 40Mhz with a
and cameras can be part of the IoT system, MIPS paging translation unit and supports advanced virtual
architecture can be considered a target architecture. memory [105]. While the IoT Malware Mirai in the
WiFatch from the Virus category, Hydra from the worm category, Bashlite in the Backdoor category,
Trojan category, and Tsunami from the Backdoor etc., attacks devices of Intel 80386 architecture, some
category are the few IoT malware that affects MIPS malware source codes are cross-compiled by the
architecture devices. attackers to attack this architecture.

13
 Table 6  IoT Malware and Target Devices
Category Malware Targe Devices
TD1 TD2 TD3 TD4 TD5 TD6 TD7 TD8 TD9 TD10 TD11 TD12 TD13 TD14 TD15 TD16 TD17 TD18

Worm Mirai X X X X X X X
Hajime X X X X
Aidra X
Darlloz/Zollard X X X
Satori X X X X
Sefa X
Okane X X X
Okiru X X X
ZHtrap X X X
Persirai X X
Gitpaste-12 X X X
Moose X X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431

Shishiga X X
Mozi X X X X
Carna X X
Echobot X X
Wicked X X X
Masuta X
Tori X X X
Bushido X
JenX X X
Miori X
Sora X
Omni X X X
Fritzfrog X
TheMoon X X
Yowai X X X
OMG X X X
Owari X X X X X
Ouija X X X
Spyware VPNFilter X X
Psybot X X
Gamut X
Hide and Seek X X X X

13
1397
 Table 6  (continued)
1398

Category Malware Targe Devices

13
TD1 TD2 TD3 TD4 TD5 TD6 TD7 TD8 TD9 TD10 TD11 TD12 TD13 TD14 TD15 TD16 TD17 TD18

Xarcen/XORDDoS X
Spybot X
Skeeyah X X X
Ransomware Necurs X X
Cr1ptT0r X X
Hades X X X X
Razor X X X X
Lulz X
Muhstik X
Backdoor Bashlite X X X X
Kaiji X
Tsunami X X X X
IRCflu X X
Brickerbot X X X
IoTReaper/IoTroop X X X X X
Elknot/BillGates/Mayday X X
Gr1n X X X
Setag X X X X
Karu X X X
InterPlanetaryStorm X X
Trojan Blueborne X
ProxyM X X X X X
Luabot X
Emotet X X
AirDropBot/Cloudbot X
Leet X X X X
Pnscan X
dark_nexus X X X
Hydra X X
Demonbot X
APEP X X
Ares X X X X
Kluh X
Qbot X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431
 Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1399

  Along with MIPS, Intel 80386 was another architec-

TD18
ture considered the input samples in the IoT malware
TD17 detection model, MTHAEL [1]. The work could focus
on different feature selection algorithms followed by
an Ensemble learning model.
6. ARC (TDA6): ARC (Argonaut RISC Core) is a 32-bit
TD16

CPU family used in different SoC (system-on-chip)

devices such as mobiles, IoT applications, digital
TD15

homes, etc. [103]. Furthermore, it is known for its

good performance and code density for host SoC appli-
cations. Therefore, most IoT devices use ARC proces-
TD14

sors, and IoT malware Okiru from the Worm category

is the first malware that targets ARC devices.
TD13

  Okiru discussed in [107] was discovered to have dif-

ferent kinds of router attack exploit code hardcoded,
which is not found in IoT malware like Satori. Further-
TD12

more, 114 credentials are used for telnet attacks, unlike

other malware that uses short databases.
TD11

7. PowerPC (TDA7): PowerPC, also termed PPC, is a

X

RISC ISA used initially for PCs and now used in IoT
TD10

devices like Routers [109]. It is widely used in Apple

products such as PowerBook, iBook, and iMac. Due
to its wide usage, the attacks like Mirai and Bashlite
TD9

from worm and backdoor categories target devices of

PowerPC architectures.
TD8

  In [1], PowerPC IoT malware samples are used in

the IoT malware detection model in addition to MIPS
TD7

architecture. However, unlike other existing works,

the work focused on feature selection algorithms, ML
TD6

methods, and obfuscation attacks with these cross-

X

architecture malware samples.

TD5

8. SuperH (TDA8): SuperH, also called SH, is a 32-bit RISC

X

ISA implemented by microprocessors and microcon-

trollers embedded systems [111]. WiFatch, the IoT mal-
TD4

ware from the Virus category, targets devices of SuperH

architectures and the MIPS and ARM architectures.
TD3

X
X

 [100] has presented an IoT malware classification

Targe Devices

model that evaluated using a dataset with IoT malware,

TD2

including Mirai and Bashlite samples of SuperH archi-

tecture and the MIPS, X86, architectures. This model
TD1

created a grayscale image from these samples, then

used for feature extraction, followed by IoT malware
classification.
9. SPARC (TDA9): SPARC (Scalable Processor Architec-
ture) is a RISC ISA in which the “Scalable” keyword
indicates its ability to scale the embedded processors to
Malware

large server processors with the same core instruction

Amnesia
Wifatch

Cereal

set [110]. However, according to the reports, SPARC

Joker

HEH
Silex
Table 6  (continued)

architectures are affected by the IoT malware Mirai and

Bashlite from worm and backdoor categories similar
to PowerPC architecture.
Category

  As the IoT malware behaviour in each architecture

Virus

differs, the researchers elucidate their proposed mod-

13
1400 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

els using malware samples from different architec- to be previously known to the attacker. In addition,
tures. One such work is presented in [102], where byte this study helped discover six account-login vulner-
sequences are collected from 111K benign and 111K abilities in the smart lock, smartwatch, smart router,
malware of SPARC and several other architectures for and the sharing car.
IoT malware detection. 2. CVE Exploit (AM2): Common Vulnerabilities and
10. Motorola m68k (TDA10): This is a 16-bit or 32-bit Exposures, also known as CVE, lists publicly revealed
CISC (Complex Instruction Set Computer) micropro- computer security vulnerabilities along with CVE IDs
cessor that implements a 32-bit instruction set, with a to help the user to recognize unique vulnerabilities and
24-bit address bus, 32-bit registers, 16-bit internal data coordinate the creation of security tools and solutions
bus [108]. As it does not use memory segmentation, it [125]. Sometimes, these CVEs are exploited by IoT mal-
is more effortless to program and widely used in PCs ware which affects numerous IoT devices and enables
with GUI, including Macintosh, Amiga, etc. attackers to control devices [124]. For example, Lulz
 [101] articulated a model with malware samples and Muhstik from the Ransomware category and Bash-
from different architectures, including Motorola lite from the Backdoor category use different CVEs for
m68k architecture for the malware classification in accessing the devices.
IoT devices.   In [92], a penetration testing tool, PENTOS, is pre-
11. Renesas (TDA11): Renesas architecture devices are sented for IoT devices that communicate via Bluetooth,
fast, cheap, reliable, and eco-friendly compared to WiFi, and ZigBee. In this work, the information gath-
other architectures. However, the IoT malware attacks ered in their initial step is analyzed using the publicly
from Razor, and Lulz from the Ransomware category available CVEs in addition to Nmap and fping.
can also occur in this architecture. 3. Target-specific Access Mechanism (AM3): Sometimes,
 [31] identified various toolchains used for IoT IoT malware is created for specific targets with access
malware using samples from different architectures, mechanisms specifically for that target. For example,
including Renesas. The authors determined that 13 it might be the devices in a country [59], industry [14]
building tools present on the web were used for mal- and so on. At times, VPNFilter is spyware that targets
ware creation. Ukrainian hosts and slows down the industry activi-
ties using a C&C server that is specific for this specific
IoT Malware Mapping to Target device architectures is por- country [59].
trayed in Table 7.  [45] discussed a machine learning detection model
for detecting different IoT malware attacks, including
Spying which is the most common target-specific attack.
5.7 Device access mechanisms
Mapping of IoT Malware to Access mechanisms is illus-
As IoT devices can be accessed from Intranet and Internet, trated in the Table 7.
the IoT malware access the devices through some basic
access mechanisms. This attribute discusses the various
access mechanisms in which the IoT Malware accesses the 5.8 IoT malware characteristics
target IoT devices.
This attribute discusses the various characteristics shown by
1. Brute force Attack (AM1): In a brute force attack, an IoT malware and the usual attack behaviour.
attacker gains access to a secured system by continually
entering credentials automatically or manually [122]. 1.Detection of Virtual Environment (C1): To evade
As most IoT devices either use default credentials or detection and analysis by security personnel, certain
don’t use credentials, Telnet and SSH brute force attacks IoT Malware determines whether they are running in
cause numerous IoT attacks [123]. Interestingly, most a virtual environment such as VMWare or VirtualBox.
IoT malware, including Okane, Okiru, ZHtrap, Persirai, Once checked, the malware wipes all its evidence using
Gitpaste-12 from the worm category, VPNFilter, and certain commands [132]. Gamut, VPNFilter from Spy-
Psybot from Spyware, access the device through Brute- ware, and Necurs from Ransomware are the few IoT
force attacks. Malware that detects Virtual Environment’s presence.
 [120] applied an automatic brute-force attack to   Virtual machine detection by Amnesia is explored in
SMS authentication code to evade existing protections [169], where the malware wipes essential folders from
and crack IoT device user accounts. However, in this the file system with the Linux “rm -rf” shell command
work, the smartphone number of the user is assumed to kill any evidence they might have gathered.

13
 Table 7  Mapping of IoT Malware to Target device architectures and Access mechanisms
Category Malware Target Device Architectures Access Mechanism
TDA1 TDA2 TDA3 TDA4 TDA5 TDA6 TDA7 TDA8 TDA9 TDA10 TDA11 AM1 AM2 AM3

Worm Mirai X X X X X X X X X
Hajime X X X X
Aidra X X X X X X X
Darlloz/Zollard X X X X X X
Satori X X X X X X X X X X X
Sefa X X X X X X X
Okane X X X X X X X X X X X
Okiru X X X X X X
ZHtrap X X X X X
Persirai X X X X X
Gitpaste-12 X X X X X
Moose X X X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431

Shishiga X X X X X X X X X
Mozi X X X X
Carna X X X X X
Echobot X X X X X X X X X X X
Wicked X X X X X X X X X X
Masuta X X X X
Tori X X X X X X X X X X
Bushido X X X X X X X X X
JenX X X X X
Miori X X X X X X X X X X X
Sora X X X X X
Omni X X X X X X
Fritzfrog X X X
TheMoon X X X
Yowai X X X X X X X X X
OMG X X X X X X X X X X
Owari X X X X X X X X X X X
Ouija X X X X X X X X X X
Spyware VPNFilter X X X X X
Psybot X X X X X X X X X
Gamut X X X X
Hide and Seek X X X X X X X

13
1401
 Table 7  (continued)
1402

Category Malware Target Device Architectures Access Mechanism

13
TDA1 TDA2 TDA3 TDA4 TDA5 TDA6 TDA7 TDA8 TDA9 TDA10 TDA11 AM1 AM2 AM3

Xarcen/XORDDoS X X X X X
Spybot X X X X X X
Skeeyah X X X X X X
Ransomware Necurs X X X X
Cr1ptT0r X X X X
Hades X X X X
Razor X X X X X X X X
Lulz X X X X
Muhstik X X X
Backdoor Bashlite X X X X X X X
Kaiji X X X
Tsunami X X X X X X X X
IRCflu X X X X X X X X
Brickerbot X X X X X
IoTReaper/IoTroop X X X X X X X
Elknot/BillGates/Mayday X X
Gr1n X X X X X X X X X X X X
Setag X X X X X
Karu X X X X X X X X X X X X X
InterPlanetaryStorm X X X X X X X
Trojan Blueborne X X X X X X
ProxyM X X X X X X X
Luabot X X X
Emotet X X X
AirDropBot/Cloudbot X X X X
Leet X X X X X X X X X
Pnscan X X X X X
dark_nexus X X X X X X X X X
Hydra X X X
Demonbot X X
APEP X X X X X X X X X X X
Ares X X X X
Kluh X X X
Qbot X X X X X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431
 Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1403

2. Survive the reboot (C2): Several IoT Malware copies

AM3
Access Mechanism themselves to the directory /etc/init.d/ in the device’s
AM2 embedded GNU/Linux system, where startup programs
are stored. This is done to make sure that the malware
X

X
survives the reboot and freshly infects the device again
[137]. Brickerbot in the Backdoor category, VPNFilter,
AM1

and HNS from the Spyware category do this survival

X
X

in IoT devices.
  Mirai, an IoT malware discussed in several works
TDA11

including [26, 27, 31, 128] also survive a reboot and

freshly infects the devices.
3. Stealth (C3): Stealth is a characteristic of IoT malware
TDA10

that tries to hide its presence to avoid detection mecha-

nisms. Usually, the malware hides in files, boot sectors,
and partitions and deliberately avoids detection. Satori,
TDA9

Gitpaste-12, and Moose from the Worm category are

well-known for their stealthy behaviour.
  Since the Mirai source code was released in 2016,
TDA8

countless customized versions have been made with

X

different characteristics. One such latest advancement

in Mirai makes it stealthy and hidden from the detec-
TDA7

tion mechanisms [134].

X

4. Turns the device into a proxy server, network, or hon-

eypots (C4): Some IoT malware turns the devices into
TDA6

the network, honeypot, and proxy servers once they

X

infect the device. This characteristic is mainly exhib-

ited by ZHTrap, Moose, TheMoon, and OMG from the
TDA5

worm category.
X
X

  OMG, the Mirai variant uses an open-source soft-

ware known as 3proxy for serving as a proxy server
TDA4

once it infects the device. The setup starts by generat-

X
X
X

ing two random ports - one for the socks_proxy_port

Target Device Architectures

and the other for the http_proxy_port. Once the ports

TDA3

are created, they are notified to the CnC [139].

X
X
X
X

5. Reboot prevention (C5): Another important charac-

teristic of IoT malware is the prevention of reboot to
TDA2

discourage wiping out of the malware from the device.

X

As a reboot can solve most IoT malware infections,

malware authors have updated this mechanism in
TDA1

their recent works. Similar to reboot survival, the IoT

X
X

malware from worm categories, including Mirai and

Hajime, is also widely shown.
  The anti-reboot features in Mirai kill the watchdog
process to bypass an auto-reboot of infected device
[14]. Interestingly, it is also noted that Mirai is
the top IoT malware that mainly exhibits all these
Malware

Amnesia

advancements.
Wifatch

Cereal
Joker

HEH
Silex

6. Port closing (C6): Usually, unused ports are closed to

Table 7  (continued)

reduce security issues, thereby reducing the attacks.

However, a few IoT malware consider the port closing
to ensure that no other malware is trying to access the
Category

port for the attack. For example, Persirai and Carna

Virus

belong to the worm category and exhibit port closing.

13
1404 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

 [138] discuss Darlloz malware which scans for sam-  [15] explains this characteristic in their work, along
ples of Aidra malware in IoT devices. If any related with examples of IoT malware.
files are identified, it is deleted and tried to close the 12. Periodic Command Execution (C12): Periodic command
communications port used by it. execution is like a CRON job that performs specific
7. Creation of new variants (C7): Developing a new mal- command executions during a certain interval. Elknot
ware is time-consuming and takes effort. Nevertheless, Backdoor, amnesia virus and Gitpaste-12 worm are the
as a solution to this problem, malware authors release few IoT malware trigger periodic command execution.
their source codes to the public so that other attackers  [131] explains how Gitpaste-12 negotiates and brute
can make new variants with additional features. The forces the systems before setting up a CRON job that it
best example is the release of the worm Mirai’s source downloads from Pastebin. Once this is done, the same
code, from which several other malware was created. script will be called again every minute.
 [135] elucidated on Mirai malware which has cre- 13. Binary Removal (C13): Binary removal is another
ated several variants that target different CPU archi- behaviour IoT malware shows once the execution
tectures. It also discusses the emergence of Okiru, the starts. This is done so that malware needs to reside
variant of Mirai, and how it targets the second most in the device’s Random Access Memory, and it pre-
prevalent type of architecture - ARC processors. vents the detection mechanisms. Persirai, Hajime from
8. Provide services like DDoS-for-hire, Ransomware (C8): the Worm category, and Psybot from spyware do this
As mentioned in the above sections, IoT malware is behaviour once they start the execution.
widely used for attacks, including DDoS attacks. Nev-   Binary removal is mentioned in [15] along with vic-
ertheless, some IoT malware provides DDoS and Ran- tim device architecture detection as a characteristic.
somware as a service rather than performing the attack. This is considered a critical behaviour as it affects the
Muhstik, the Ransomware, and Bashlite, the Backdoor, detection mechanisms.
are the IoT malware that offers these services. 14. Name stealing (C14): Similar to stealth and binary
  JenX botnet discussed in [133] offers a DDoS ser- removal characteristics, name stealing is also a feature
vice with an assured 290-300Gbps bandwidth. Yet, where the malware steals a process’s name, thereby
security officials can take down this malware as it uses preventing it from anti-malware techniques. However,
a centralized architecture. it is a rare characteristic used by a few malware, includ-
9. Huge Packet Size (C9): During the malware attack in ing Echobot, a worm categorized as IoT malware.
IoT devices, the network traffic will have malicious   Echobot is a well-known Mirai variant that targets
characteristics. One such behaviour is the huge packet corporates and enterprise management systems. Based
size of the traffic. All IoT malware does not show this on the studies, the researchers found that Echobot
unusual size, which is why it is considered a specific remains a threat and will not slow down quickly [130].
characteristic by Leet, the Trojan malware. 15. Name assignment (C15): Name assignment is simi-
  The attack caused by Leet is presented in [129], lar to name stealing except that instead of stealing
which explains the 650 Gbps DDoS flood with pack- the name, a random name is given to the process for
ets greater than 150 million per second (Mpps). The the malware. Mirai and JenX, the IoT malware that
attack bursts initiated from spoofed IPs made tracing belongs to the worm category, perform name assign-
the botnet’s location impossible. ments for their processes.
10. Use only one exploit (C10): Exploits take advantage   Mirai’s various characteristics are explained in
of the security flaws or vulnerabilities in the devices. works including [31, 128]. Several studies found that
As most IoT malware considers various exploits while Mirai is one of the malware that exhibits a wide range
attacking the devices, some use only one exploit. of characteristics added to the attacks.
 [170] discusses the BotenaGo IoT malware that tar- 16. UPX header insertion (C16): Malformed UPX (Ulti-
gets devices with more than 30 Exploits. Once the vul- mate Packer for Executables) headers are inserted by
nerability is successfully exploited, the malware will IoT malware authors to make the analysis complex,
execute remote shell commands. thereby preventing the security analysts from discover-
11. Victim device architecture detection (C11): Victim ing it. Hajime and Elknot from the worm and backdoor
device architecture detection is another characteristic category are the two malware that primarily displays
where the malware sends the payload corresponding to this characteristic.
the device’s architecture. This is exhibited mainly by   In [127], the researchers realized that the Hajime
the IoT malware, which belongs to the worm category, malware binary was compressed with an altered ver-
including Mirai and Echobot. sion where the UPX header is changed from its default

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1405

value. The authors also identified that this was done to with the help of a virtual terminal connection [152].
restrict the reverse-engineering techniques. Telnet is considered the most insecure communication
17. DGA algorithm (C17): Domain generation algorithms protocol among various protocols as most IoT malware
are shown by various IoT Malware for generating targets this, including malware from Worm, Trojan, and
many domain names as rendezvous points with their Backdoor categories.
C&C servers. Among IoT Malware, Mirai in worm   A P2P IoT malware HEH is introduced in [155],
and VPNFilter in Spyware categories are the ones that which targets various IoT devices with exposed telnet
exhibit DGAs. services. Moreover, the researchers also discovered that
  In [136], security researchers alert that recent vari- the attack is irrespective of the MIPS, x86, PPC ARM,
ants of the Mirai have domain generation algorithm or any other architecture.
(DGA) features not shown in previous Mirai samples. 2. TCP (P2): Transmission Control Protocol is a transport
Moreover, they have also mentioned that Mirai shows protocol used on top of Internet Protocol to provide reliable
certain other behaviour in addition to this. packet transmission [171]. In IoT, Cybersecurity research-
ers disclosed various flaws in embedded TCP/IP stacks
IoT malware that exhibits these characteristics is illustrated affecting millions of IoT devices [140]. Some IoT malware
in Table 8. includes Persirai and Satori from the worm category.
 [151] discusses how researchers detected IP cameras
vulnerable to Persirai malware. Unfortunately, as many
5.9 Programming languages users are unaware of the vulnerabilities, it is easier for
attackers to access the IP Camera interface through TCP
IoT security researchers articulate that malware develop- Port 81.
ers increasingly diverge to unique or unfamiliar program- 3. FTP (P3): File transfer protocol (FTP) is a communi-
ming languages to impede reverse engineering and analysis cation protocol that helps file transfer between devices
efforts. Moreover, it is identified that each of these languages over a network [141]. However, IoT malware like Mirai
is relatively new, supporting cross-platforms and avoiding targets this protocol for attacking the devices.
traditional signature-based detection tools. Top malware pro-   According to researchers, 14.6% of all routers had
gramming languages used in IoT malware are selected based either FTP or Telnet services open, which are also vul-
on the information gathered from various sources, including nerable to Bruteforce attacks [142]. One such example
[158, 160, 161]. is the TP-Link routers, with 9.3% of them having an FTP
Mirai, one of the most widely known IoT malware, uses service open to the internet, with 55% operating with a
two programming languages, including C (L1) [161] and weak password.
Go (L2) [161] where the former is used for the agent, and 4. SSH (P4): Secure Shell Protocol is a cryptographic net-
the latter is used for the controller. Hajime [159], Sefa, and work protocol to operate network services securely in an
Okane are other malware that uses C as their programming unsecured network with applications including remote
language. As mentioned in [11], Luabot, an IoT malware, login and command-line execution [156]. Like other
uses Lua (L5) programming language. In contrast, a list of protocols, SSH is also used for attacking devices by IoT
commonly used IoT malware programming including [13], Malware, including IRCflu, Brickerbot, IoTReaper, and
PHP (L3) [157], Perl (L4) [164], VisualBasic (L6) [163], Elknot from the worm category.
C++ (L7) [162], Delphi (L8) [13], and Shell commands (L9)   Kaiji, one of the IoT Malware, performs brute-force
[13] are also used by different IoT Malware. attacks against IoT devices with open SSH ports. Once
More details on the programming language used by IoT infected, the C&C servers go offline, exposing the
malware are discussed in Table 8. infected devices to other attackers [149].
5. HTTP (P5): Hypertext Transfer Protocol is an applica-
5.10 Protocols tion-layer protocol mainly designed to communicate
between web servers and browsers [144]. Shishiga and
This attribute discusses the different protocols used by IoT OMG from the worm category are the two IoT malware
malware to infect the devices. Protocols are a set of rules that targets HTTP protocol.
followed for communication between two entities. As each   Shishiga malware targets IoT devices using four proto-
IoT malware behaves differently, the protocols they target cols: SSH, Telnet, HTTP, and BitTorrent. Like other IoT
also differ. malware, the infection vector of Shishiga is prevalent:
brute-forcing weak credentials [147].
1. Telnet (P1): Telnet is an application protocol for offering 6. BitTorrent (P6): BitTorrent is a communication protocol
a bidirectional interactive text-oriented communication for P2P file sharing, which allows users to transfer data

13
 Table 8  IoT Malware-Characteristics, Protocols and Programming Languages
1406

Category Malware Characteristics Protocols Programming Language

C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13 C14 C15 C16 C17 P1 P2 P3 P4 P5 P6 P7 P8 L1 L2 L3 L4 L5 L6 L7 L8 L9

13
Worm Mirai X X X X X X X X X X
Hajime X X X X X X X
Aidra X X X
Darlloz/Zollard X X X
Satori X X X X X X
Sefa X X X
Okane X X X
Okiru X X X
ZHtrap X X X
Persirai X X X X X X
Gitpaste-12 X X X X
Moose X X X X
Shishiga X X X X X X
Mozi X X X X
Carna X X X
Echobot X X X X X X X
Wicked X X X
Masuta X X X
Tori X X X
Bushido X X X
JenX X X X X X
Miori X X X X
Sora X X X
Omni X X X X
Fritzfrog X X X X
TheMoon X X X X
Yowai X X
OMG X X X
Owari X X X
Ouija X X X
Spyware VPNFilter X X X X X X X X X
Psybot X X X X X X X
Gamut X X X
Hide and Seek X X X X X X
Xarcen/XORDDoS X X X X X
Spybot X X X X
Skeeyah X X X
Peer-to-Peer Networking and Applications (2023) 16:1380–1431
 Table 8  (continued)
Category Malware Characteristics Protocols Programming Language

C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13 C14 C15 C16 C17 P1 P2 P3 P4 P5 P6 P7 P8 L1 L2 L3 L4 L5 L6 L7 L8 L9

Ransomware Necurs X X X X
Cr1ptT0r X X X
Hades X X X

Razor X X X
Lulz X X X
Muhstik X X X
Backdoor Bashlite X X X X
Kaiji X X X X
Tsunami X X X
IRCflu X X X
Brickerbot X X X X
IoTReaper/IoTroop X X X X X X X
Elknot/BillGates/ X X X X X X
Mayday
Peer-to-Peer Networking and Applications (2023) 16:1380–1431

Gr1n X X X X
Setag X X X
Karu X X X
InterPlanetaryStorm X X X
Trojan Blueborne X X X
ProxyM X X X
Luabot X X X
Emotet X X X
AirDropBot/ X X X
Cloudbot
Leet X X X
Pnscan X X X X
dark_nexus X X X
Hydra X X X X
Demonbot X X X
APEP X X X
Ares X X X
Kluh X X X
Qbot X X X X
Virus Silex X X X X
Amnesia X X X X X
Wifatch X X X X
Joker X X X
HEH X X X X

13
1407
1408 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

or files in a decentralized manner [146]. Nevertheless, second part downloads, contact the P2P network and
this is also affected by IoT Malware like Shishiga. initiates a mass vulnerability scan [177].
  Shishiga [147] uses four protocols, including BitTorrent, 3. Aidra: Aidra, an IoT malware, is known as an “IRC-
for infecting the devices. In this malware, the infection vec- based mass router scanner exploit” with an open-
tor is the prevalent brute-forcing attack [147]. source code [178]. It is responsible for new malware
7. UPnP (P7): Universal Plug and Play (UPnP) is a pro- like IRCTelnet as it lifts portions of source code from
tocol that permits the devices available on the network Aidra [179]. Researchers name it Aidra, and the mal-
to open as well as close ports automatically to connect ware author calls it LightAidra. Aidra is known for
to each other [154]. Even though UPnP is not widely executing DDoS attacks and coin mining. The malware
attacked by IoT malware, Persirai, one worm malware, requires two servers, one for binary hosting and the
uses this protocol to affect IoT devices. other to issue commands to the botnet. As persistence
  Persirai malware targets IP cameras with open Univer- is not supported, a device reboot can remove the mal-
sal Plug and Play (UPnP) ports, and once it is infected, ware [180].
it connects them to a command and control server [150]. 4. Darlloz/Zollard: Darlloz infects the IoT devices by
To avoid these attacks, researchers usually suggest disa- exploiting a PHP vulnerability, CVE-2012-1823
bling UPnP services. [181–183] and scans the device to check the presence
8. Customized protocols (P8): Sometimes, the IoT mal- of another IoT malware, Aidra. If any related files are
ware creates a communication protocol with the help discovered, the malware deletes them and blocks the
of binary commands. These customized protocols are ports used by Aidra [138]. Another version of Darlloz,
mainly created by IoT malware belonging to the worm “cpuminer,” mines coins like Mincoins or Dogecoins
category, including Persirai, TheMoon, etc. from the device [184].
  In [15], customized protocols and other communi- 5. Satori: Satori is a Mirai variant that exploits vulnera-
cation protocols used by IoT malware are discussed. bilities like CVE-2014-8361), Remote Code Execution
Moreover, the authors have mapped the IoT malware vulnerability [185] in IoT devices like routers. Since
that uses these protocols. this malware is a Mirai variant, some attack libraries
from Mirai are taken for performing UDP Flood, SYN
IoT malware and its mapping to protocols are illustrated in Flood, TCP ACK Flood, and GRE Flood attacks [186].
Table 8. Moreover, Satori malware is responsible for mining
Ethereum [95].
6. Sefa: ThinkPHP is a Chinese open-source PHP frame-
work, and the remote code execution vulnerability
6 IoT malware within this framework results in various malware
attacks on IoT devices [187]. Among the IoT malware
1. Mirai: Mirai is a self-propagating worm which infects that exploits ThinkPHP vulnerability, BlueHero and
vulnerable IoT devices by exploiting CVE-2020- Sefa are the widely known [188]. WORD, a member
10173, CVE-2020-5902, CVE-2020-7115, CVE-2020- of the KS hacking group, has previously worked with
7209 [172] etc. Once infected, the malware controls WICKED malware, later focused on the SEFA botnet
the devices using command and control (C&C) serv- for a comprehensive attack [189].
ers and claims the device as its own by removing the 7. Okane: Okane is an IoT malware propagating similar to
existing malware from it [173]. Mirai has a replication Mirai where weak credentials are brute-forced, or 0-day
module and an attack module, where the replication exploits are used on vulnerable IoT devices [190]. In
module focuses on spreading the malware. The attack addition to the existing DDoS attacks, two new DDoS
module executes various attacks like DDoS attacks, methods, including attack_method_tcpxmas and attack_
click fraud [174] etc. Interestingly, the malware uses a method_std, are also considered in this malware. More-
few Russian strings in its samples. over, some unusual entries root/t0talc0ntr0l4!, admin/
2. Hajime: Hajime is a Mirai variant which scans TCP adc123 and mg3500/merlin were uncovered on the brute
port 8291 and leverages vulnerabilities like CVE- force lists of the malware [191].
2018-14847 and CVE-2018-7445 for attackers to 8. Okiru: Okiru, a Mirai variant, is considered the first
read and write arbitrary files. Furthermore, it can also malware to target IoT devices with Argonaut RISC Core
perform brute-force attacks [175, 176]. According to (ARC) processors. This malware adds a more extensive
researchers and industrialists, the malware uses a two- set of credentials and an encrypted brute force mod-
part system where the first part is a file transfer that ule in addition to the existing functionalities of Mirai
copies a more considerable download program. The malware. Moreover, it has similarities to another Mirai

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1409

variant known as Satori. It has been floating around The malware then uses these capabilities to perform
since 2018, and similar to Mirai, it is mainly for DDoS illegitimate view counts, likes and followers in various
attacks [192]. Since the malware is built upon the exist- social media accounts. Moreover, DNS hijacking and
ing Mirai malware, researchers believe it can be further Man-in-the-Middle (MitM) attacks are also executed
modified to create a new variant. by this malware citeNJCCICTh15:online. However,
9. ZHtrap: ZHtrap is an IoT malware that implements a unlike most IoT malware, Moose has no persistence
honeypot mechanism for capturing attacks from other on the target device [203].
botnets and using the gathered data to hijack their 13. Shishiga: Shishiga is an IoT malware targeting IoT
infrastructures. Vulnerabilities exploited by this mal- devices and exploiting Telnet and SSH ports using
ware includes CVE-2020-25506, CVE-2021-27561, a brute-force attack. Once the device is infected, the
CVE-2021-27562, CVE-2021-22502, CVE-2019- malware sets an HTTP server and uses a BitTorrent
19356, and CVE-2020-26919 [193, 194]. Moreover, protocol to search for new versions of Shishiga files to
ZHtrap uses a Tor C&C server to communicate with get updated with the latest version [205]. Shishiga uses
other botnet nodes and hide malicious traffic. The the Lua programming language, which offers a more
malware is known for performing DDoS attacks and flexible design [206]. Over a short period, research-
executing additional malicious payloads [195]. ers witnessed minor changes in the malware with the
10. Persirai: Persirai is an IoT malware that mainly targets rewritten module, which indicates that the malware is
vulnerable IP Cameras based on Original Equipment still creating new variants [207].
Manufacturer (OEM) products [196]. This malware 14. Mozi: Mozi is a P2P botnet that utilizes a BitTorrent-
uses various vulnerabilities, including CVE-2017- like network and targets IoT devices like DVRs and
8221, CVE-2017-8224, CVE-2017-8222, CVE-2017- networking equipment using various unpatched vul-
8223, and CVE-2017-8225, for exploiting the Univer- nerabilities and weak Telnet credentials [208]. The
sal Plug and Play (UPnP) enabled devices with open primary aim of Mozi is to launch DDoS attacks in
TCP port 81 [197]. Once infected, the device com- addition to the other attacks, including spamming, data
municates with the C&C server to download software exfiltration, cryptocurrency mining, DNS spoofing,
for being a part of the botnet that executes UDP-based HTTP session hijacking and payload execution [209,
DDoS attacks. Moreover, this malware can also deploy 210]. Researchers identified that the DHT configura-
the command injections and infect other IP Cameras tion modules in this malware could help develop the
[198]. To avoid detection, the malware deletes itself codes for new functional nodes [211].
once executed and runs only in the memory. Inter- 15. Carna: Carna is an IoT malware developed for measur-
estingly, to prevent other hackers from accessing the ing the Internet extent by naming it “Internet Census of
device, the perspire author blocks the exploit they used 2012”. Carna is named after the Roman deity to protect
and keeps the infected device to themselves [199]. inner organs and health. Like most IoT malware, devices
11. Gitpaste-12: Gitpaste-12 is an IoT malware that tar- with default passwords or no passwords are exploited
gets GitHub and Pastebin and is named after 12 known by this malware. The data collected, including the
vulnerability exploits CVE-2017-14135, CVE-2020- IPV4 addresses after the attack, was compiled into a gif
24217, CVE-2017-5638, CVE-2020-10987, CVE- depicting the internet usage for 24 h [212, 213].
2014-8361, CVE-2020-15893, CVE-2013-5948, 16. Echobot: Echobot is another variant of Mirai that uses
EDB-ID: 48225, EDB-ID: 40500, CVE-2019-10758, 70 different exploits for its infection vectors [15, 214]
CVE-2017-17215 [200] within the worm. The mal- and also is entirely modular, i.e. new exploits are added
ware performs different activities, including removing and removed by its author quite frequently. Echobot
defence mechanisms like SELinux, firewalls, attack uses exploits available in cameras, DVRs, routers,
prevention, monitoring software, etc. Furthermore, it video conferencing equipment, etc. and was built for
is used for cryptocurrency mining and other attacks, all CPU architectures. To infect the most devices pos-
mainly targeting a /8 CIDR range of IP addresses [201]. sible, this botnet employs both dictionary assaults and
12. Moose: Moose is an IoT malware that primarily tar- exploits. Latest updates to Echobot malware include
gets MIPS and ARM-based IoT devices and creates network device exploits that are more than 10+ yrs old
a botnet to steal unencrypted network traffic and pro- to target these old systems which remained in service
vide proxy services to the operator [202]. Accord- and whose vulnerabilities were never patched.
ing to the researchers, Moose spreads itself using the 17. Wicked: Unlike most IoT malware, Wicked uses
name “elan2” [203]. Researchers also discovered that known exploits like CVE-2016-6277 and CVE-2018-
the botnet could create fake social media accounts and 10561 instead of brute-forcing the vulnerable target
uses random numbers or letters as user names [204]. devices. The malware exploits the device based on

13
1410 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

ports 8080, 80, 8443, and 81 and uploads a payload 23. Priority: There are no online resources for this mal-
[215]. Since the malware’s code includes a string called ware that we can discover.
“SoraLOADER,” researchers consider it a spreader for 24. Sora: Sora is a variant of Mirai designed to exploit
the IoT malware, Sora, a Mirai variant. Moreover, it is two vulnerabilities (CVE-2017-17215 and CVE-2018-
also identified that the malicious website with the mal- 10561), allowing it to execute remote code execution
ware code contains the keyword “Owari,” and the pay- and manage the infected devices. Once the device gets
load delivered is the Omni bot. Accordingly, it would infected, In the first stage, a downloader is dropped
appear that Omni, Owari, and Sora are all related to from the C&C server for delivering and executing the
the Wicked bot [216]. Wicked also exhibits persistence, payload, and in the second stage, the attack chain is
making the devices persist the malware [217]. initiated [227].
18. Masuta: Masuta is a variant of Mirai that uses a modi- 25. Omni: Omni, an updated version of the IoTReaper, has
fied version of the Mirai botnet whose cipher is altered, the same network architecture format and is widely
which is used to initiate the attacks. Utilizing a built-in infected in the Polycom HDX devices for audio and
list of common passwords and default credentials, it video conferencing [228]. Since the open-source pack-
employs strategies similar to Mirai to circumvent the ages, including wget and busy box, are available in the
security of the targeted IoT devices [218]. devices’ embedded firmware, attackers find it easy to
19. Tori: Torii botnet is named after the Japanese word download binaries. The infected devices are then used
“gate” as it uses Tor and a network of devices to obscure to launch brute-force and DDoS attacks and as proxy
network traffic [219]. After VPNFilter and HNS(Hide devices for routing malicious communications [229].
and Seek), this is the third IoT botnet that exhibits per- 26. Fritzfrog: FritzFrog is a P2P botnet decentralized in
sistence. Its removal is possible only by resetting the nature with more than 20 variants detected in the wild
device to its default configuration [220]. The malware [230]. The malware brute-forces the SSH server of vul-
binaries are downloaded via HTTP or FTP protocols, nerable devices and executes in memory to evade detec-
and for maintaining persistence, it uses at least six tech- tion mechanisms. Moreover, the malware is capable of
niques simultaneously, including automatic execution propagating over the SSH protocol. Since the primary
through injected code into ḃashrc, “@reboot” clause in goal of FritzFrog is to mine cryptocurrency, a monero
crontab, System Daemon, modification of the SELinux miner, XMRig, is deployed and linked to the public pool
Policy Management, /etc/inittab [221]. Once this is web.xmrpool.eu through the port 5555 [231].
done, the second-stage payload is executed and con- 27. TheMoon: TheMoon is an IoT P2P worm that uses a
nected to the C&C server and performs different attacks command execution vulnerability to exploit its victims;
like exfiltrating data, encrypting communication, and it explicitly targets Linksys and Asus routers and uses a
utilizing anti-debugging techniques [222]. backdooring mechanism to ensure that other IoT botnet
20. Bushido: Bushido botnet is a variant of Mirai that offer will not infect the same device [15, 232]. The com-
a DDoS-for-hire service. It uses different combinations mand execution vulnerability allows TheMoon to send
of usernames and passwords from Mirai, allowing it to malicious UDP packages to vulnerable routers, bypass-
target other vulnerable devices that Mirai cannot affect. ing authentication processes and executing code on the
Also, it has 13 attack options, whereas Mirai has only device, taking it over from the device owner, and it will
10 [223]. add new firewall rules to make sure the adversary can
21. JenX: JenX is a DDoS botnet that uses hosted serv- access the device remotely as well.
ers to identify and infect new devices leveraging these 28. Yowai: Yowai is an IoT worm and botnet based on
three known vulnerabilities (CVE-2017-17215, CVE- Mirai exploit websites built using the ThinkPHP open-
2015-2051 and CVE-2014-8361), which have gained source framework to compromise web servers using
popularity in IoT botnet world [133, 224]. dictionary attacks on default credentials and take con-
22. Miori: Miori malware propagates in two methods: via trol of these routers for distributed denial of service
a vulnerability known as Remote code execution pre- attack [233].
sent in the ThinkPHP framework(CVE-2018-20062) or 29. OMG: OMG is a variant of IoT malware Mirai and
brute-forcing the open Telnet ports. Once the device keeps its various capabilities, including usage of brute
is infected, rather than the binary-based version for force for logging in open Telnet, SSH and HTTP ports,
communicating to the C&C server, the malware uses DoS attack, etc. However, OMG turns the devices
a text-based protocol for encryption [225]. Moreover, into proxy servers commonly used for performing
a console will be created to initiate the Telnet for per- malicious operations [234]. Once initialized, it con-
forming brute-force on other IP addresses and perform nects to the C&C port 50023 and sends a message
distributed denial of service attacks [226]. (0x00000000) to recognize itself as a new bot in the

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1411

botnet. Then, the server sends a string that mentions through the botnet’s daemonization. Second, the mal-
the command on how the device can be used as a proxy ware acquired the capability to infect Android devices
server [235]. Interestingly, OMG is the foremost Mirai through the ABD protocol. Additionally, it gained the
variant that comprises DDoS functionality and the capacity to set up Coin-Miner software and command
capability to set up proxy servers [236]. its botnet to mine the cryptocurrency Monero. This
30. Owari: Owari is a variant of Mirai that leveraged protocol uses techniques to restrict researchers’ abil-
CVE-2017-17215 to exploit more than 18,000 infected ity to analyze the network. Each peer has a maximum
devices to perform a DDoS attack. It uses a MySQL number of constantly updated peers in its list, typically
server for C&C, allowing attackers to keep interacting 512 (customized to the peer’s available memory). A full
with infected systems [237, 238]. update of the list takes about 18 h. A dedicated crawler
31. Ouija: Ouija is a botnet that uses stager script, which has to be created by researchers to speed up the scan of
is, in most cases, bash downloader scripts to download the network. However, its size cannot be estimated with
malicious payloads and execute them for infection. any certainty due to the quickly evolving nature of the
After payload execution finishes, it deletes the initial network. Also, to prevent poisoning attacks, every com-
payload from disk using rm -rf command [239]. munication and update are signed with ECDSA. Code
32. VPNFilter: The VPNFilter malware is a multi-stage, from both Mirai and Reaper is reused in Hide and Seek,
modular worm with various features to support opera- including the scanner from Mirai and certain exploits
tions for intelligence gathering and destructive cyber- from Reaper.
attacks. It was primarily used for corporate espionage 36. Xarcen/XORDDoS: XOR DDoS is a small Chinese
and not to create large-scale DDoS attacks. It can botnet targeting Linux systems (IoT and servers). It
monitor the SCADA system, map all a company’s attacks the network by producing large amounts of
local networks, and create a reverse VPN that allows data, such as nonsensical strings in the SYN and DNS
botmasters to connect remotely and target a company’s [15]. It uses XOR-based encryption for its communi-
internal network. It can also initiate a MITM attack by cations. XORDDoS is known for employing Secure
redirecting HTTPS traffic to HTTP for eavesdropping Shell (SSH) brute force attacks to take remote control
on the communication. It is a complex botnet catego- of target devices [244]. XORDDoS uses evasion and
rized as an Advanced Persistent Threat (APT). It uses persistence mechanisms that make its operations robust
HTTPS and TOR to communicate with its botmasters. and stealthy. It incorporated various evasion tactics,
It can add virus on the fly to Windows exe file in clear including hiding the malware’s activities, anti-forensic
traffic, encrypt data, and exfiltrate it [15, 240]. techniques to break process tree-based analysis, etc.
33. Psybot: Psybot is a centralized IRC botnet that operates In recent campaigns, XORDDoS conceals malicious
by brute-forcing SSH and telnet credentials using a activity by overwriting sensitive files with a null byte.
dictionary with roughly 6000 users and 13,000 pass- It is also able to support various Linux Distributions
words. It targets MIPS architecture and also uses the through multiple persistence mechanisms.
D-link bypass exploit as well. It can execute DDoS 37. Spybot: Spybot is a worm that typically infects com-
attacks using UDP, ICMP and Syn flood features as puters via peer-to-peer (P2P) file sharing, more spe-
well [11, 15]. cifically via the Kazaa file-sharing network [245]. It
34. Gamut: Gamut Botnet is a decentralized network can infect computers with weak administrative creden-
of Trojans specializing in sending spam emails that tials and spread via various standard backdoor Trojan
attempt to build rapport with the recipients. The Gamut horses. Hackers occasionally use the worm to create
Botnet malware payloads are downloaded when the simple-access programmes for IRC and FTP channels.
targeted users open the spam email. That will further 38. Skeeyah: Skeeyah is a trojan-style malware that
compromise the computer network. Currently, Necurs infiltrates computers covertly and gives cybercrimi-
and Gamut are responsible for 60, and 37 percent of nals control over compromised systems. It usually
spam email traffic generated globally [75, 241–243]. facilitates the infiltration of other malware on the
35. Hide and Seek: Hide and Seek is P2P botnet that estab- infected system by opening backdoors to the vic-
lishes communication between peers via a customized tims’ devices. This infection may result in several
P2P protocol [15]. Hide and Seek botnet is not designed issues, such as privacy concerns and subsequent
for DDoS attacks; however, espionage behaviour is computer infections [246].
observed in it. When it was first discovered and ana- 39. Necurs: Necurs is modular botnet malware capable of
lyzed, Hide’n Seek could not persist after a reboot of its various threats such as spam distribution, information
victim. However, three significant features were added theft, ransomware and disabling security services and
in October 2018: first, Hide and Seek gained persistence elements [75]. Necurs is primarily a botnet-for-hire that

13
1412 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

can spread any malware a client desires. This includes 45. Muhstik: Muhstik is another variant of Mirai that has
the well-known GameOver Zeus trojan, which over a existed since at least 2018 and is reported to infect IoT
decade ago, infected the internet, as well as the Dridex devices using web application vulnerabilities. Crypto-
malware used by Evil Corp and others. It gives its zom- mining and DDoS attack services are used to monetize
bie computers much freedom by using a domain gen- the botnet. Since its creation, Muhstik has constantly
eration algorithm, or DGA, to generate 2,048 potential used the same infrastructure and relies on IRC for
domains every four days. Necurs can prevent antivirus command and control. Although home routers are the
updates on older computers, which can have many unin- primary means of IoT device proliferation, there have
tended consequences [247]. been several attempts to propagate exploits for Linux
40. Cr1ptT0r: Cr1ptT0r is Ransomware built for embedded servers as well [252]. DD-WRT, the Tomato router,
systems targets network attached storage (NAS) equip- and the GPON home router are among the routers that
ment exposed to the internet to encrypt data available are targeted. Some of the vulnerabilities exploited by
on it [248]. The DNS-320 router created by D-link has Muhstik include Oracle WebLogic Server bugs (CVE-
been used to spread the Cr1ptT0r Ransomware. Despite 2019-2725 and CVE-2017-10271), Drupal RCE flaw
still being used by many computer users, this router has (CVE-2018-7600) and Lua sandbox escape flaw (CVE-
been decommissioned due to the numerous vulnerabili- 2022-0543).
ties it was linked to. In 2018, a hard-coded backdoor into 46. Bashlite: Bashlite is also known as BASHLITE, Gaf-
this router was discovered, giving hackers access to the gyt, Lizkebab, Torlus, LizardStresser, Qbot, Bash0day
victim’s network without authorization. and Bashdoor was developed as an IRC backdoor that
41. Hades: Hades ransomware is a human-operated ransom- searches IP address ranges for vulnerable devices
ware tool used in targeted attacks on large organizations. that run the BusyBox shell intending to infect them.
It is an extension of the WastedLocker ransomware, cre- It can perform various DDoS attacks like Syn and
ated to get around the US government’s sanctions. It was UDP Flooding [15]. The Gafgyt variants were able
later rebranded as Phoenix Locker. Hades and Wasted- to exploit multiple device vulnerabilities like CVE-
Locker share a lot of code, although Hades has some 2017-18368, CVE-2017-17215, CVE-2014-8361 etc.
minor feature additions and code obfuscation [249]. It spreads by brute-forcing passwords and usernames
42. Razor: Razor is Ransomware that encrypts files with from a built-in dictionary. The malware connects to
the “.razor” extension to prevent access to data (files, random IP addresses and makes login attempts, report-
photos, and videos). Then, it attempts to extort money ing any successful ones to the command and control
from victims by demanding a “ransom” in the crypto- server. Since it was written in C, it can target different
currency Bitcoin in exchange for access to their files computer architectures; binaries of the Bashlite family
[250]. To encrypt files, it looks for those with specific have been discovered in all IoT CPU architectures like
file extensions. Important productivity documents, pic- ARM, MIPS, SuperSH etc.
tures, videos, and files like .doc, .docx, .xls, and .pdf 47. Kaiji: Kaiji is a malware that was created expressly
are among the files it encrypts. The infection will alter to infect Linux-based servers and smart Internet of
the extension of these files to Razor when discovered, Things (IoT) devices before abusing these systems to
rendering you unable to access them. Each encrypted execute DDoS attacks [149]. The botnet is not cur-
file’s name is changed by this Ransomware to the fol- rently able to infect unpatched devices via exploits.
lowing format: name.id-ID.razor Instead, IoT devices and Linux servers that have left
43. Yagi: There are no online resources for this malware their SSH port open to the internet are targeted by the
that we can discover. Kaiji botnet’s brute-force attacks. The “root” account
44. Lulz: Lulz is a ransomware that encrypts the victim’s is only targeted because the botnet needs root access to
data with the AES-256 encryption algorithm, changes infected devices to alter raw network packets for DDoS
their wallpapers, renames the encrypted file names attacks and other operations.
and demands a payment [251]. The authors of Lulz 48. Tsunami: Tsunami is an IRC centralized botnet.
advertise it as RaaS (Ransomware-as-a-Service). Once According to Researchers, It is an evolution of Chuck
within the victim device, It encrypts 195 file types on Norris malware because their binaries include a lot of
the local and connected devices. The Ransomware common strings. Additionally, some of their C2s’ IP
is written in Golang, allowing the payload to evade addresses are the same for both pieces of malware. It
machine learning and signature-based antivirus engine uses the Tsunami/Kaiten open-source DDoS protocol
detection mechanisms. It is also designed to leave the to provide DDoS services [15].
computer once it recognizes it is running in a sandbox 49. IRCflu: IRCflu is an open-source IRC bot which has a
or virtual environment flexible message & command handler. It is currently

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1413

used as a backdoor to a compromised SSH server. The the threat, disrupt machines, and carry out destructive
IRCflu bot can, among other things, carry out shell actions anywhere they choose [258].
commands that are sent to it in an IRC private mes- 53. Gr1n: Gr1n is a botnet that uses default user and pass-
sage. Attackers probably intended to use this IRCflu word combinations to attack IoT devices through Tel-
to gain access to infected machines and maybe down- net. Researchers claim it is built in C and appears to
load further malware, like cryptocurrency miners, or deploy itself first as a downloader (through bins.sh or
to provide remote access to the botnet for sale to the getbins.sh) before downloading several executables for
highest bidder. IRCflu has never been utilized in this various CPU architectures [259].
manner, indicating that hackers vary their attack strate- 54. Setag: Setag is a backdoor that can initiate DDoS
gies by using legitimate technologies to elude detection attacks while stealing system data. It has also been
by security solutions [253]. observed utilizing an exploit for the Apache Struts 2
50. Brickerbot: BrickerBot is an IoT malware that mainly remote code execution vulnerability CVE-2017-5638.
focuses on altering the device’s firmware rather than This malware checks for tampering and can prevent
concentrating on DDoS attacks like most IoT malware. debugging. Additionally, this malware copies itself
This is done by performing dictionary attacks and run- and changes the systems tools on the afflicted system,
ning various malicious Linux commands, including moving them to the /usr/bin/dpkgd directory. It drops
altering the device’s storage and kernel parameters, a script into the /etc directory to make a copy of itself
restricting internet connection, tampering with its for persistence [260].
performance, and removing all files on the device that 55. Karu: Karu is TDSS TDL4 backdoor malware that
cause permanent damage to the device. BrickerBot alters the Master Boot Record and tracks the user’s
has two versions, one which targets IoT devices run- online behaviour. It might also download additional
ning BusyBox with vulnerable Telnet or Secure Shell malicious files, weakening the compromised system.
(SSH), and the other that targets Linux-based devices This backdoor includes mutexes to ensure that only one
which has TOR exit nodes to evade its activities [254, copy is active. For it to load before the operating sys-
255]. Since it affects the firmware, the device must be tem starts up, it alters the Master Boot Record (MBR)
replaced or reinstalled with hardware [256]. of the afflicted system. When certain strings are identi-
51. IoTReaper/IoTroop: IoTReaper is a botnet that incor- fied in the Web address, it tracks the user’s browsing
porates some code from the well-known Mirai botnet patterns and sends the data to particular URLs. Addi-
but does not crack any passwords [257]. Instead, it tionally, it alters the search engine’s returning results to
is solely concerned with exploiting vulnerabilities deceive visitors into clicking dangerous links or seeing
in IoT devices. At the moment, IoT Reaper focuses adverts [261].
on nine unique firmware flaws impacting cameras, 56. InterPlanetary Storm: InterPlanetary Storm cross-
video recorders, and home routers made by compa- platform P2P botnet infects Mac, Android devices,
nies including Linksys, D-Link, Vacron, Nuuo, Net- Windows, Linux machines and IoT devices. Threat
gear, AvTech, Maginon, and Avacom, among others. actors had used it to infiltrate targets through diction-
New vulnerabilities could be added anytime as the ary attacks on SSH servers and execute PowerShell
malware is still being tweaked and upgraded. The code on compromised targets. It is based on the Inter-
goal of the botnet and its impact were unknown at Planetary File System (IPFS), a distributed file system
the time this paper was being authored. However, the protocol for storing and exchanging data. Once com-
following cyberattacks are possible, including large- promised, the systems are set up to function as socks5
scale DDoS and the facilitation of other malware that proxies. As a result, the infected devices join a peer-
targets, disrupts, or disables the systems it is running to-peer network and communicate directly, strengthen-
on. ing the botnet’s resistance to takedown attempts [262,
52. Elknot/BillGates/Mayday: Elknot is also known as 263]. This raises the likelihood that the botnet’s devel-
the BillGates Trojan, which has been used to launch opers may charge other cybercriminals to use them as
DDoS attacks on devices with insufficient security. proxy servers for their traffic.
Both Linux and Windows platforms are susceptible. 57. Blueborne: BlueBorne, an IoT malware, can sniff or
Elknot allows its controllers to carry out any attacks redirect the traffic through “air-gapped” networks
they desire once it completely controls an infected between Bluetooth-enabled devices for accessing data
computer’s functionality. It can perform several and spreading malware laterally to adjacent devices
attacks, including HTTP Flood (Layer7), DNS reflec- [98]. The malware first locates the Bluetooth devices
tion floods, TCP Flood, ICMP Flood, and UDP Flood. and identifies the device’s MAC address, Operating
Criminals can rent Elknot to create their versions of System and adjusts its attack accordingly [264]. It can

13
1414 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

initiate a man-in-the-middle attack [265] and exploits 62. Leet: Leet is the first IoT malware that rivals the Mirai,
the devices by using 8 vulnerabilities, including CVE- and it is named after a character string in the payload.
2017-1000251, CVE-2017-1000250, CVE-2017-0785, Unlike Mirai, which uses hardcoded SYS file sizes,
CVE-2017-0781, CVE-2017-0782, CVE-2017-0783, this malware traffic was developed by regular SYN
CVE-2017-8628, CVE-2017-14315 [264]. payloads and large SYN packets of around 799 to 936
58. ProxyM: ProxyM is a malware that mainly targets bytes [272]. Moreover, this malware takes data from
Linux devices and launches a SOCKS proxy server actual system files and sends it to the target by embed-
on an infected device for anonymously performing ding it in the TCP packets used for DDoS attack [273].
malicious activities [74]. Moreover, this malware was 63. Pnscan: PNScan is an IoT Malware mainly targeting
used for relaying web traffic and hacking websites ARM, MIPS, or PowerPC architectures routers in the
using XSS (Cross-Site Scripting), SQL injections, and IP Address Block 183.83.0.0/16 by brute-forcing using
Local File Inclusion (LFI) [74]. Different variants of three sets of credentials. Once the device is infected, it
Proxym are arising, and the malware targets various forks several times and creates various files within the
architectures, including MIPS, ARM, PowerPC etc. device. Furthermore, the threat listens to the TCP ports
[266], which infects routers, set-top boxes, and other targeting the IP range and sends HTTP/1.1 requests
similar equipment. through SSL to twitter.com on port 443 to conceal
59. Luabot: LuaBot is the first trojan entirely coded in Lua its malicious network traffic [274]. Interestingly, the
language targeting Linux platforms to recruit them malware was upgraded, and the new version pnscan2
in DDoS botnet. It is capable of performing Layer 7 performs the brute-force attack using a special diction-
DDoS attacks. It is a malware that targets Linux sys- ary [275].
tems, loT devices, and web servers and is similar to 64. Dark Nexus: Dark Nexus is a botnet that infiltrates
Mirai in that it makes infected systems into bots that various devices, including routers (from Dasan Zhone,
are part of a larger botnet under the attacker’s control. D-Link, and Asus), video recorders, and thermal cam-
On the target, the basic malware sets up a SOCKS eras, by using credential stuffing attacks [276]. It
proxy. The SOCKS proxies used by this botnet’s author employs a DDoS technique that masks traffic as harm-
and operator appear to be available for purchase by less browser-generated traffic and utilizes synchro-
other malware operations so they can conceal the nous and asynchronous Telnet scanners for infection
source of their attacks [267, 268]. Luabot has the and victim reporting. It uses socks5 proxies, possibly
appearance of an ELF binary. renting access to the botnet. The device’s reliability
60. Emotet: Emotet is a Trojan propagated through spam and proper operation are maintained using a debugging
emails. Malicious scripts, document files with built-in module available in the botnet [277].
macros, or malicious links can deliver the infection. 65. Hydra: Hydra was router malware that functioned
The authors of Emotet have exploited the malware to automatically as an open-source tool. IRC handled it,
build a botnet of compromised machines to which they and its primary function was to use brute force to get
sell access using an infrastructure-as-a-service (IaaS) access to routers to launch DDoS attacks. A built-in
model, also known as MaaS (Malware-as-a-Service), list of default passwords and a D-Link authentica-
Cybercrime-as-a-Service (CaaS), or Crimeware in the tion bypass exploit might be used to gain access to
cybersecurity world [269]. Emotet is also renowned the router. Before compiling the code, the malicious
for providing ransomware operations with access to user had to alter one of the source files to add the URL
compromised systems. To avoid being discovered and for the C&C IRC server and the link to download the
analyzed, Emotet employs several techniques. Notably, malicious malware [278].
Emotet can determine whether it’s operating inside a 66. Demonbot: Similar to Mirai, DemonBot is a distrib-
virtual machine (VM) and will become inactive if it uted denial-of-service (DDoS) botnet. It does not
finds a sandbox environment [270]. behave like a worm, in contrast to Mirai, and spreads
61. AirDropBot/Cloudbot: AirDropBot malware targets via centralized servers. It can respond to commands
infecting as many IoT devices as possible and behaves to launch UDP (randomized) or TCP-based DDoS
similarly to Mirai and Gafgyt malware. Due to this rea- attacks and an STD (UDP fixed payload) attack. Addi-
son, researchers first ignored its presence. However, the tionally, it supports the STOMP command, which ini-
malware behaves in two ways where one targets small tiates an assault in sequence, starting with STD and
devices by acting as bots, and the latter acts as a vulner- moving through UDP and TCP. It specifically targets
ability scanner for larger systems. Even though it is still unprotected Apache Hadoop systems through a bug
not in the last development stage, the main objective is in Hadoop’s YARN (“Yet Another Resource Negotia-
to infect devices and eliminate its competitors [271]. tor”) component.

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1415

67. APEP: APEP is a variant of Mirai which spread by dic- configurations, flushes the IP tables, and halts the
tionary attacks via Telnet. Other than that, APEP can devices [96].
also propagate by exploiting the vulnerability CVE- 72. Amnesia: Amnesia is a centralized IRC botnet that
2017-17215, which involves another RCE vulnerabil- can launch various DDoS attacks, including UDP and
ity and affects Huawei HG532 router devices, for its HTTP floods. It is very similar to Mirai and has the
attacks [279]. same ability to identify virtualized environments and
68. Ares: The Ares Botnet spreads its malicious code by delete itself from the machine when VM is detected
searching the internet for vulnerable STBs (Set-Top using a command like “rm -rf”. This functionality is
Boxes) that use a stripped-down Android OS version. frequently found in Windows and Android malwares
The “Android Debug Bridge” must also be enabled on designed to hinder malware analysis. By taking advan-
the IoT device for the Ares Botnet malware to penetrate tage of a vulnerability in this company’s devices, it
successfully. If the Ares Botnet successfully connects a primarily targets TVT Digital DVR [15].
device to its network, it can take control of it and use it 73. Wifatch: Wifatch was a P2P botnet exploiting weak
to look for other vulnerable STBs and spread the threat credentials on telnet and SSH protocols [15]. It was
to them. It appears that the attackers are mostly mining also compiled for multiple architectures. The worm
cryptocurrency using the seized equipment. But such could look for and remove all previous infections and
a sizable botnet may also launch extremely effective add a message to the logs warning the device owner
DDoS (Distributed-Denial-of-Service) assaults [280]. and requesting that they change the IoT’s password. It
69. Kluh: Kluh is a malware that may infect Linux oper- is written in the Perl programming language. Wifatch
ating systems, and it was developed by the Chinese botnet is a whitehat botnet and is not aimed at launch-
hacker collective known as ChinaZ. Infecting Linux- ing DDoS attacks but instead to safeguard the IoT
powered routers is its primary objective. It can launch devices from other botnets, as per the explanations
DDoS attacks such as HTTP Flood, Spoofed SYN from the malware authors.
Flood, SYN Flood, and other DDoS attacks by send- 74. Joker: Joker is a malware bundled with several unsus-
ing mass requests to DNS servers [281]. pecting apps distributed via the Google Play Store and
70. Qbot: QBot is a banking Trojan used to steal banking other platforms. The malware secretly engages with
information (banking passwords, information about ad networks to click on banner ads and sign up for
online banking sessions, victims’ personal informa- premium subscription services. Joker can read the vic-
tion, etc.). It is also called Qakbot, QBot, QuackBot, tim system’s SMS messages, contact lists, and device
and PinkslipBot [282]. Qbot infects targets through a data. It gathers information from compromised net-
variety of attack vectors. Phishing emails with mali- works, listens to private conversations, and sends it
cious files, attachments, or password-protected fold- to a remote attacker [286] because it has a small code
ers with the files attached are used to spread QBot. footprint and is, therefore, difficult to detect.
However, its creators have also created features that 75. Exo: Exo, sometimes known as Exobot, is an Android
let QBot spread itself, avoid detection and debugging, trojan that can steal SMS messages, lock devices with
and put other malware on infected computers. A drop- a password (behaving like ransomware), and more.
per like Emotet has been seen to spread some malware Exo is compatible with Android 4, 5, and 6. More-
variants. Most Qbot variants are VM-aware, and some over, malware buyers advertise that Exo can oper-
feature polymorphic skills [283]. One of Qbot’s more ate without root access and that consumers cannot
recent tactics is that after infecting a computer, it acti- remove it directly, necessitating a full phone reflash
vates a unique “email collector module” that harvests to remove it [287].
all email threads from the victim’s Outlook client and 76. Cereals: Cereals is an IoT malware known for its
uploads them to a predefined remote server. Since the peculiar characteristic of exploiting one vulnerability
spam email pretends to continue an ongoing genuine that resides in the message notification feature of the
email conversation, it is easier to fool consumers into D-Link firmware of NAS and NVR devices. Using this
clicking on infected files. Then these stolen emails are vulnerability, attackers send malformed HTTP requests
used for subsequent malspam operations [284]. to the in-built server of the device and execute com-
71. Silex: Silex is a destructive malware that spreads and mands with root privileges. Moreover, the malware
wipes devices’ firmware, requiring a whole firmware tries to patch the devices to prevent them from further
reinstallation to restore the device. The malware tar- hijacking [288].
gets devices with ARM architecture and UNIX-like 77. HEH: Unlike most IoT malware, HEH does not exhibit
OS that uses default credentials [285]. The infec- attacks like DDoS or coin mining; instead runs shell
tion also drops the firewall rules, removes network commands for wiping all the device partitions. This

13
1416 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

malware exploits the devices with open Telnet ports  [292] developed a web traffic detection system-Owl-
23, 2323, and SSH ports by brute-forcing the creden- Eye that uses HMM (Hidden Markov Model) methods
tials [289]. This is done to spread the malware and to calculate the web request’s malicious score. The input
attain its activation mechanism [290]. web request was preprocessed, and the key-value pair
was generated using a key handler and value handler.
The extracted feature vectors are fed into four trained
HMM modules: normality detection, abnormality detec-
7 IoT malware detection methods
tion, WAF (Web Application Firewall), and customized
specific APIs detection modules. If a web request is
Nowadays, IoT device security is ensured by using malware
found, the difference between an abnormal score and a
detection mechanisms and prevention methods. In this, we
normal score is calculated, and if it is greater than the
focus on two types of detection methods, including traditional
threshold, it is considered an attack.
detection methods and Learning-based detection methods.
2. Dynamic analysis-based detection methods: Non-graph-based
The best way to classify traditional IoT malware detec-
methods mainly deal with opcodes images as features and
tion approaches is by considering two analysis techniques:
consider algorithms other than AI-based techniques.
dynamic and static. Even though these analysis mechanisms
 [293] introduced a dynamic analysis-based malware
are also used in learning systems, we focus on the subtypes of
detection tool for a router called C500-toolkit, which
machine and deep learning-based learning systems.
emulates and analyzes both the web interface and OS
of the firmware image of the router. This tool had three
7.1 Traditional detection models components: C500-Extractor, which extracts the firmware
image extractor component, C500-Standardization, which
1. Static analysis-based detection methods: The static standardizes the firmware image; and C500-Detector,
approach is conducted by examining the input samples which detects the malware in router firmware.
without executing them so that the structure and differ-  [294] presented an automatic IoT runtime platform
ent characteristics of the malware can be identified. where users upload suspicious ELF files and dynami-
  Static-based disassembly analysis is developed by cally analyze for malicious behaviour identification. This
[168] for calculating similarities in the malware for work emulates various architectures with QEMU (Quick
classification. Disassembly won’t work well if the sam- EMUlator)), and the malicious files are identified. More-
ples are packed, so they were checked first to determine over, the uploaded file’s traffic logs and system calls are
whether they are packed. The similarity is calculated also generated.
for non-packed samples using the Jaccard index by
extracting the samples’ opcodes based on the opcode’s
7.2 Learning‑based detection models
N-grams. Once identified, a similarity matrix is cre-
ated and based on it, and samples are visualized in a
As mentioned above, malware detection mechanisms are
2-D plane with t-SNE. Results proved that disassembly
not limited to traditional methods. Due to the promising
worked well as similar samples are mapped closely, and
advancement, researchers and industrialists have become
distinct samples are mapped far.
more interested in IoT malware detection using deep learn-
  A modular framework is introduced by [291] for auto-
ing and machine learning.
matic analysis and clustering of malware samples using
various components, including eOrchestrator, Static
1. Machine Learning-based methods: Machine learning
analysis, deployment module, connection, dynamic anal-
involves complex algorithms automatically learning
ysis, clustering samples, and visualization. eOrchestrator
and refining patterns from vast data. As it can enhance
is the main module that makes a pipeline that connects
performance and develop ’intelligence’ over time, it is
the rest of the modules. Once the sample is received, a
widely used in most detection algorithms.
static analysis module gets the information. The deploy-
  In Machine learning methods, feature extraction is
ment module checks the analyzed file architecture, and
considered one of the most important steps as it deter-
the virtual machine activates if the architecture is sup-
mines the model’s performance. Therefore, in this sec-
ported. Then the dynamic analysis is done by executing
tion, we classify different ML detection methods based
the file for a certain amount of time, and the execution
on the type of features. It includes:
traces obtained are parsed. The similarity is identified
with other obtained samples based on a threshold value • Images: As images possess thousands of pixel val-
and added to a similar cluster. In case the threshold is ues, their relationship and correlation can help detect
not reached, a new cluster is created. IoT malware.

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1417

  An IoT malware classification using Haralick tex- which is trained using the different ML algorithms
ture features and machine learning methods such with feature vectors and labels collected from the
as KNN (K-nearest neighbour), NB (Naive Bayes), Packet Traffic Feature Database. When the number
and RF (Random Forest) is proposed in [100] where of devices is higher, the sub-sampling module is used
the dataset is converted into a grey-scale image fol- where only a fraction of incoming traffic is consid-
lowed by the creation of a GLCM (Gray Level Co- ered. If some malicious activity is detected, based
occurrence Matrix). Then, the textual features from on the policies in the Policy Module, the network
the image were extracted using the five Haralick fea- administrator determines the following actions to be
tures, and ML methods were applied to them. Results taken, like blocking traffic, etc.
proved that RF is the best classification method, • Hybrid features: As static and dynamic features can
which can be applied in all platforms and environ- help detect malware, a hybrid of these features is
ments as images are used for detection. used for better effectiveness and performance.
• Opcodes: Opcodes, also known as instruction codes,   In [296], static features like permissions, API
are a part of machine language instruction that tells calls, etc., were extracted using the Androguard tool.
the processor the job to be done. Dynamic features like system calls were extracted by
  Opcodes are used as features in [295] where a running the application in the Genymotion emula-
classification method known as a Fuzzy pattern tree tor. In this work, two novel techniques based on the
is applied to detect malware using four datasets: IoT, distance from the malware cluster centre (Euclid-
Vx-Heaven, Kaggle, and Ransomware. The opcode ean distance and l1-norm are used) and based on
sequence from the data set identified the benefi- probability measures derived from kernel-based
cial features using the Class-wise information gain learning (KBL) are considered for the selection of
approach and control flow graph and applied with adversarial samples. Three ML algorithms, such as
the Fuzzy pattern tree and Fast fuzzy pattern tree. SVM, RF, and Bayesian, were also used to identify
To assess the model’s competency, the authors com- the approach’s effectiveness, proving that the KBL
pared it with state-of-the-art ML methods. Another technique is better in all these algorithms.
work [101] also considers opcodes as their features
2. Deep Learning-based IoT Malware detection methods: As
from the malicious and benign samples, and the fea-
machine learning algorithms need a separate feature extrac-
tures extracted from the benign samples were saved
tion process, deep learning algorithms extract the features
in the detection dataset directly. In contrast, the fea-
automatically. Therefore, this section discusses the top
tures of labelled malicious samples were preserved
deep-learning algorithms used for IoT malware detection.
in both the detection and classification dataset. Once
the preprocessing is done, the detection model iden- • CNN: Convolutional Neural Network, also known
tifies whether the new unknown samples entering as Convnets, consists of numerous layers that pro-
the system are malicious. If malicious, it will be cess and extract features. The main advantage of this
stored in the classification model to find the mal- algorithm is its less computation than a regular neu-
ware family, and the result will show the malware ral network without losing the essence of the data.
family. The model was compared with the existing   A hybrid intelligent architecture using Autoencoder
works and proved that the performance is better than and CNN is analyzed in [297] with the initial and
the current models. training phases. Features of ransomware-related mal-
• ELF: Executable and Link Format is a file format for ware collected from different IoT devices are extracted
executables, DLLs, and shared objects in a Linux- using the Autoencoder to identify the essential fea-
based system that stores machine-independent and tures that contribute to malware detection. Then, hid-
machine-dependent features. den layer results were exfoliated in the Autoencoder
  ELFs are considered features in [101] along with environment, and random rules were used to make it
opcode features. This work finds characteristics from available to CNN, which trains the data for malware
both types of features to make the model robust and classification. CNN is also used in the IoT malware
get an accurate result. detection-based model MTHAEL [1]. The opcodes
• Network Traffic: Traffic moving across a network from ELF files were disassembled using the object
captured during dynamic analysis is the most promi- dump tool, and the opcode sequences thus obtained
nent feature in IoT malware detection. were applied with feature extraction models and fed
  EDIMA, proposed in [87] extracts the features into the Ensemble learner with CNN and RNN mod-
from the incoming network traffic samples and els. [298] presents a dynamic analysis for IoT malware
classifies them using the ML Model Constructor, detection, DAIMD, which uses the CNN algorithm

13
1418 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

for analyzing the images created from the behavioural cess, the testing was done. LSTM is used along with
data obtained from dynamic execution. Unlike most RNN in [300] for the malicious network connection.
existing works, memory, system call, network, pro- Bi-LSTM deep learning model is presented in [118]
cess, and virtual file system behaviours were analyzed for server-side malicious traffic monitoring. The
in this work. The behaviours thus identified were com- packets captured are parsed by the network analyzer,
pressed during feature preprocessing and converted extracting packet-level features, basic statistical fea-
into an image type. The outcome of the experiments tures, and NetFlow-level features often observed for
indicated that the DAIMD model could accurately malware and benign programs. Once the extracted
detect variant malware that risks IoT devices. feature vectors are saved, they are used as inputs
• RNN: Recurrent Neural Network handles sequential to train the Bi-LSTM deep learning model for mal-
data and considers current and previously received ware detection. A hybrid obfuscated IoT malware
input. The previous input is remembered in RNN due detection method, HyMalD is proposed in [302],
to its internal memory. which uses a bidirectional long short-term memory
 [299] used an RNN-based deep learning approach (Bi-LSTM) and spatial pyramid pooling network
for IoT malware detection on ARM-based malware (SPP-Net) for static and dynamic analysis. In this
files and benign files collected from the VirusTotal work, the Shannon entropy is first calculated as it
threat intelligence platform. However, a linguistics is an indicator of obfuscated IoT malware. If it is
process was used in this work to convert every sample less than the threshold, static analysis is performed
into a numerical sequence. Moreover, rather than the by considering three steps: feature extraction, vec-
standard RNN model, Bidirectional Neural Networks tor creation, and classification. However, suppose
were also evaluated. RNN is also applied in MTHAEL the Shannon value is less than the threshold. In that
[1] as a base learner in the Ensemble model. [300] case, dynamic analysis is performed where similar
investigated the malicious network connections using stages are followed like static analysis, except in the
an RNN-LSTM method which supports the firewall in second stage, where an image is created instead of
the system. The malicious data is updated in the data- a vector. This is done by executing the obfuscated
base for retraining the RNN using the NAdam Train- malware files in a virtual environment.
ing Algorithm. Moreover, the firewall is also updated, • Autoencoder: Autoencoder is trained to learn effi-
and the connection is blacklisted. On the other hand, cient representations of the input data by reduc-
if the connection is benign, it is added to the whitelist ing the size of inputs into a smaller representation.
connections neurons are applied to do it. Unlike PCA, this algorithm is more efficient and
• LSTM: Long Short-Term Memory network is simi- learns underlying patterns.
lar to RNN except that the operations within LSTM   Autoencoder is used along with CNN in [297]
cells allow the LSTM to keep or forget informa- where the results of the hidden layer were exfoliated
tion. Moreover, it tackled the problem of long-term using Autoencoder and applied with random rules for
dependencies of RNNs. making it available to CNN for malware classification.
 [99] used an LSTM-based deep learning approach • DBN: Deep Belief Network uses probabilities and
for malware detection where 32-bit ARM-based unsupervised learning to produce outputs contain-
malware files and benign files of ELF format were ing undirected and directed layers.
fed into the object dump tool for decompiling, and  [9] that uses two different deep learning
the decompiled code was then pruned to extract approaches based on Deep Belief Network, such
the opcode sequence in each sample. Text mining as CDT-DBN and DDT-DBN, also has a separate
based on TF-IDF was used to create feature vec- feature extraction process. Components of the
tors and fed into the LSTM model for classification. model include malware triggering, behavioural log
Another work [301] used a fastText model with two collection, preprocessing, feature extraction, DBN
phases, such as (i) the learning phase, where a fast- training, and malware detection. The models were
Text model and Bi-LSTM perform learning on the analyzed based on the number of hidden units and
dataset and (ii) the execution phase, where malware epochs. Results found that DDT-DBN performs bet-
is classified based on the learning. Here, the opcodes ter in a higher number of epochs with fewer hidden
and API function names were embedded using the units, and CDT-DBN performs better when a lower
fastText model, and labels were embedded with one- number of epochs and lower hidden units.
hot encoding. This multidimensional vector created
3. Hybrid detection methods: In the hybrid detection
in the preprocessing stage was passed to the input
method, two or more algorithms are combined for IoT
layer of Bi-LSTM and based on the learning pro-

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1419

malware detection to rectify the drawbacks of one algo- the phase that produces IoT Mirai zombies on IoT networks.
rithm by uniting it with another algorithm. Even though In the infection phase of traditional Mirai malware, bots
some works don’t yield good results when combined, directly control the phase. Nevertheless, from an Internet
researchers still use them to try new models. of Things (IoT) perspective, the Mirai zombie task merely
  In [128], a local IoT detection system is implemented scans the network for insecure devices to notify the Com-
in IoT clients using CNN, and a remote cloud classifica- mand & Control (C&C) server. IoT Mirai zombies do, in
tion system is assumed to be implemented with some fact, simply notify the C&C server of the prospective zom-
ML algorithms in a cloud server. The malware binary bies, and infection happens through communication with the
is translated as a sequence of 8 bits and converted to a C&C server [304]. Table 9 summaries some of the difference
grey-scale image, then re-scaled into 64x64 for feed- between PC and IoT Malware.
ing to the input layer. The model’s performance is then A study on the existing IoT malware detection approaches
compared using two-class and three-class classifications, proves that researchers and industrialists are focusing on var-
which shows that the two-class classification showed an ious ways to fill the security gaps in IoT. However, there are
accuracy of 94.0%, better than the three-class classifi- still various challenges in IoT Malware detection techniques
cation. The classification result is then delivered to the that can be considered when developing novel methods in
remote Cloud server for deeper analysis, which updates the future.
and distributes newly trained detectors to the IoT clients
in a periodic manner. • Availability of dataset: Dataset is the most critical
  A work by [303] has two stages: training and Infer- and primary aspect of malware detection techniques.
ence phases. In the training phase, the latent representa- In machine learning and deep learning techniques, the
tion, a compressed form of the input data, is constructed, larger the data provided, the quicker the model can
which helps in the binary classification methods such as learn and improve [113]. However, there exists a severe
SVM (Support Vector Machines), KNN, DT, etc. Test lack of valid datasets for IoT Malware. IoTPOT and
data is fed into the encoder in the inference phase, and IoT-23 are the current benchmark IoT datasets in most
the output is passed to the classifier. As Autoencoder IoT malware works. However, as most of the work uses
works similarly to PCA and t-SNE, those two methods the same dataset, any defects present within the dataset
are compared to identify whether the proposed model could impact the whole model. Moreover, the focus
performs better. Moreover, the authors have combined of each dataset might be specific, which might not be
three types of malware categories from different IoT helpful in the proposed model. For example, IoTPoT is
devices to determine any difference in malware behav- deployed on a restricted number of IP addresses, spe-
iour in other devices. cifically interacting with Telnet requests [91]. There-
fore, the generation of a dataset that is more realistic
for real-world attacks is much more crucial.
8 Challenges and research opportunities  Future Scope: Generate a dataset by executing IoT
malware samples in a group of real IoT devices with
Security in IoT has been a matter of concern, and most of different architectures and operating systems.
the issues are identified as the lack of security standards • Presence of diverse malware: One of the interesting
and hardware issues. However, this section focuses on the facts is that there is no universal naming for IoT mal-
challenges and future research directions in IoT Malware. ware, and the alias for some malware might be confusing.
Instead of minor data theft, the primary objective of Various researchers follow distinct naming conventions
infecting IoT devices with malware is often to prepare for for the collected malware samples that cause assigning
a big attack in the future. In contrast to Personal Computer diverse names for the identical samples, which makes the
(PC) malware samples, which typically target a single- detection model complicated [305].
machine type, IoT malware samples usually support a vari-  Future Scope: Once the malware samples are col-
ety of CPU architectures. Even though malware detection lected, consider hashing, a standard technique used to
for Windows has been extensively investigated, it presents identify malware uniquely so that the malware samples
several difficulties for the IoT industry. Although, the differ- are not repeated with different names. In addition, it
ences between PC and IoT malware in behavioural manners should include malware from various categories, such
depend on the specific type of malware individually. There as worms, viruses, rootkits, spyware, etc.
exist differences in the source code and architecture and in • Lack of Real-world experiments: In dynamic analysis
the operations as well, such as Mirai, a popular malware that methods, as some IoT malware easily recognizes their
compromises IoT devices. The infection phase that creates execution in a virtual machine, they may bypass mal-
Mirai botnets in a traditional infection phase is distinct from ware detection systems [298]. Even though the analysis

13
1420 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

in real devices is more challenging and complex, the • Emphasis of Adversarial Attacks: Adversarial attacks
best detection approach needs to evaluate in a real- which contaminate the data are a specific way to get an
world environment. inaccurate result from the model [1]. Nevertheless, the
 Future Scope: Consider real devices to better analyse detection mechanisms that consider adversarial attacks
and evaluate the proposed model’s effectiveness. Moreover, are very few.
anti-VM detection techniques should also be developed.  Future Scope: While implementing the detection
• Scalability of detection methods: As IoT involves a model, experimenting with adversarial attacks can
group of heterogeneous devices with various abilities and improve the detection model.
requirements, the detection mechanisms need not focus • Absence of cross-platform detection methods: In most
on a particular architecture or operating system. During of the existing works, ARM-based IoT malware samples
an IoT malware attack, the devices can be bots irrespec- are used even though there exist different IoT devices of
tive of their architecture and operating system, making Intel, ARC, SPARC, MIPS architectures [99]. Focusing
the attack more complex. Moreover, as the malware vari- on a particular type of architecture won’t solve the secu-
eties are also increasing, IoT malware detection could be rity issues in a group of IoT devices.
challenging if the mechanism considered is not scalable.  Future Scope: Develop IoT malware detection methods
 Future Scope: Develop module-based detection that consider cross-architecture malware samples rather
approaches that can be extended later when new malware than concentrating on one type.
of different architectures or operating systems are evolved. • Selection of features: The detection approaches usually
• Experimental Environment: Working on real devices focus on static or dynamic analysis for the proposed mecha-
is expensive and time-consuming as the hardware and nisms. Even though dynamic analysis is considered, most
software aspects must be studied before the implemen- works focus on network traffic, which might not be relevant
tation. In this situation, most detection mechanisms for IoT malware that focuses on attack types such as data
prefer working in simulation environments that are exfiltration and Permanent DoS attacks.
cost-effective and flexible. However, the robust mal-  Future Scope: Consider memory-related features [298]
ware detection methods in the simulation environment and log files for malware detection in addition to the
might not be ideal for real devices. Furthermore, its widely used network features and opcode sequences.
effectiveness in a virtual environment cannot confirm • Determination of Evaluation metrics: This study has
that the model is efficient. identified that nearly all machine learning or deep learning
 Future Scope: Cost-effective approaches, including algorithms have been used in state-of-the-art works. Fur-
testbed-as-a-service [306] and re-usage of old IoT devices, thermore, ensemble learning, like stacking, boosting, etc.,
can be considered while working with real testbeds. has also been introduced, producing better accuracy results.
• Lack of Honeypots: Honeypot is a security means that However, the evaluation metrics are limited to accuracy,
makes a virtual trap to attract attackers to capture their which might not efficiently reflect the performance.
behaviour patterns, attack vectors, and security issues  Future Scope: Introduce novel evaluation metrics and
[307]. However, there are fewer existing honeypots for focus on multiple metrics rather than concentrating on one.
capturing IoT malware behaviour. As a result, there is • Absence of software tools: Most detection methods are
a lack of behavioural patterns or rules that can be used not software-based approaches that can be applied in real
in detection tools or mechanisms. devices [87].
 Future Scope: Implement Honeypots that handle  Future Scope: Create a software-based implementation
massive data and support more protocols and increased to be integrated into actual devices, reducing the security
IoT devices to capture the behaviour of IoT malware. issues in IoT devices.
• Presence of obfuscation: Usually, malware authors pre-
vent malware detection by performing various obfusca-
Table 9  PC Malware Vs IoT Malware tion methods, including packing, encryption, etc., and
PC Malware IoT Malware only a few works like [302] consider the obfuscated mal-
ware detection in IoT. As most detection methods con-
Platform heterogeneity Low High
sider features like opcodes, obfuscation in IoT malware
Malware family plurality High Low
is still challenging.
Detection on the system Easy Hard
 Future Scope: Consider the measure of randomness
In-vivo analysis Easy Very Hard
techniques in the model so that code obfuscation and data
Sandbox execution Easy Hard
compression can also be detected.
Removal Medium Hard to impossible
• Selection of ML Algorithms: Selecting appropriate
Vulnerability assessment Medium Very Hard
algorithms is crucial since picking the wrong algorithm

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1421

would produce incorrect output and waste time, effort, number of IoT devices and lack of security mechanisms have
and accuracy. Similarly, choosing a bad data set will resulted in different oblivious attacks, including hacking,
yield incorrect input and erroneous outcomes. Thus, spying, intrusion mechanisms, malware attacks, etc. Most
using the relevant data sets and techniques, which may attacks are due to weak credentials, a lack of security stand-
be investigated using machine learning to secure IoT ards, and user security awareness.
environments, is crucial [308]. Researchers and security personnel started focusing on
 Future Scope: Review the dataset, ML algorithm use cases different detection and prevention mechanisms to solve this.
and task details before choosing the most appropriate one. Nevertheless, the absence of information and the growth
• Lack of Intrusion Detection System (IDS): An intrusion of IoT Malware obstructs the perfect solutions for security
detection system is a hardware or software application that attacks in IoT devices.
monitors and watches out for malicious behaviour or bro-
ken rules on a network or system. 9.1 Future scope of IOT malware analysis
 Future Scope: Create a Software based IDS that moni- and detection strategies
tors the IoT device based on the behaviour of the device
in real-time. • Making Reverse Engineering methods difficult: Authors
• Data Collection Issues: Data collection is one of the biggest of malwares repackage the software binaries after
challenges in the IoT environment. Data-related problems deconstructing them to incorporate harmful code. We
include policies governing the privacy and protection of user could utilize the crypto techniques to render it more
information, Data in various forms or with ambiguous val- difficult to decipher any application’s code and employ
ues, missing values, outliers, and incorrect data [309]. encryption techniques to make its code unconditionally
 Future Scope: Create standards, policies and data for- incomprehensible [311].
mats for data collection, retention and storage to address • Holistic Hybrid Analysis Tool: Utilizing a powerful
the issues mentioned above. and effective tool to evaluate IoT device data and alert
• Lack of Reliable and Detailed IoT Security Protocol users if it includes malicious code that triggers harmful
Stack: A reliable, detailed, well-tested, and interoperable IoT behaviours is necessary [311].
Security Protocol Stack is presently under research. Due to • Model to Identify Zero-day Attacks: We need clever and
immaturity, these comprehensive security features for pro- lightweight ML or DL-based models to identify mali-
tocols and standards are considerably behind reality [308]. cious behaviour in applications in real-time or runtime
 Future Scope: Design and develop a reliable, scalable, and prevent zero-day attacks. We need a strong research
maintainable and well-tested IoT Security protocol stack. orientation in this area because creating these detecting
• Lack of Authentication and Access Control mecha- models is not so straightforward [311].
nisms: IoT devices may be secured against unwanted • Standardized and Updated Dataset: To efficiently
access with the help of access control mechanisms. The accomplish malware detection analyses, we require
IoT ecosystem, however, calls for access control systems standardized and updated datasets, which should be
that are more context-sensitive and fine-grained. Stud- frequently updated with the latest discovered malware
ies demonstrate the potential for context awareness and samples [311].
granularity in attribute-based access control models. It • Laws and Regulations: Countries should enact laws
is possibly better to map current systems to alternative enforced globally to address issues with information
access control models to understand the advantages and security and cybersecurity-related threats [311]. Fed-
hazards of access control. This will help to create solu- eral Bureau Investigation (FBI) declared cybersecurity
tions that are more context-aware [310]. Such solutions law for the internet of things (IoT) devices in which
are not, however, included in the existing IoT application they state that “if you found any toy is being compro-
protocols MQTT and CoAP. mised security terms then you have to report it”. To
 Future Scope: Design and develop reliable, scalable, guarantee a particular degree of security is maintained
maintainable and well-tested Authentication and Access for all devices, whether open source or proprietary,
Control schemes for IoT environments. national or international security standards for the
devices might be introduced [312].
• Lightweight and Robust Trust Management and Secu-
9 Conclusion and future work rity System: Further research must be done to develop
and standardize a lightweight and robust trust manage-
IoT, the third industrial revolution, has benefited the econ- ment system; along with it, all layers of IoT devices
omy through various digitalizing fields such as education, should be ensured with IDS, physical security and risk
military, healthcare, tourism, etc. However, the surging management. It is necessary to have this standard can

13
1422 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

be applied to a variety of applications, enterprises, internal structure and algorithm. White-box is the second
and industries. However, it may not be possible due situation, where the malware authors know the model’s
to many constraints on the IoT device. IoT devices internal structure and algorithm adequately. The effort
with similar restrictions might be grouped, and dis- needed to dodge a model can be increased by implement-
tinct standard security features could be developed for ing training techniques and rules that consider this. Thus
each group [313]. resulting in a better and more robust model [316].
• Training on Real-world Datasets: Training of ML and • Defining IoT Device Security Levels: Identifying the most
DL-based models should be done using real-world data- prevalent security risks to which IoT devices are exposed
sets, and also the selection of appropriate ML and DL is is crucial. To establish this device’s security level, devel-
crucial based on the task and available data set. A prior- opers should write tests against these vulnerabilities and
ity-based learning algorithm may be created to catch new use the information they get in the process [312].
malware and consider the attacks’ frequency and severity.
Further study should be done to develop hybrid ways of To help the researchers and industrialists focus on this
analyzing and detecting malware [313]. direction., our work is presented, including four mani con-
• Planning and Strategies for Deployments: While deploy- tributions. First, we have conducted a study on multiple
ing IoT applications on public platforms, proper plans aspects of IoT malware, including 6 IoT malware catego-
and strategies are crucial for protecting against malware, ries, 16 attack types, 10 attack surfaces, 2 malware distri-
such as data encryption, before storing or transferring to bution architectures, 18 victim devices, 11 victim device
the IoT device [313]. architectures, 17 characteristics, 3 access mechanisms, 9
• Transfer Learning: It is defined as the ability to use a programming languages, and 8 protocols.
pre-trained model for different yet similar work. Transfer Second, a detailed analysis was done on 77 IoT mal-
learning can enhance the existing ML or DL models with ware between 2008 and 2022 by mapping the categories
better results and less time [314]. More research can be as mentioned above. Interestingly, we identified that some
conducted to use transfer learning in Malware analysis malware targeting PCs and Android devices evolved into
and detection as there is none on it. targeting IoT devices.
• Incremental Learning: The effectiveness and reliabil- Third, we reviewed various IoT malware detection
ity of ML or DL models may also be improved through methods, including traditional and learning-based ones.
incremental learning. A model may be trained on a very On the one hand, the traditional techniques were classified
different set from the actual validation set since the data based on the analysis type, including static and dynamic
in a real-world scenario is constantly changing. Better analysis. On the other hand, learning-based detection
outcomes may be obtained by combining the advantages methods were classified into machine learning-based
of incremental and deep learning. The model may be methods, deep learning-based methods, and hybrid meth-
altered under newly added features, making incremental ods. The reviewed works were also compared based on
learning a viable option for real-time analysis. The sig- the features, algorithms, testbed, dataset, and limitations.
nificant older findings can be set aside to extract informa- Fourth, we identified 11 challenges that remain unad-
tion for forthcoming similar data [314]. dressed due to IoT malware’s evolving nature and the
• Explainable AI(XAI): Explainable artificial intelligence future research scopes that can solve the same.
(XAI) is a set of processes and methods that allows human Even though we have collected more than 150 IoT mal-
users to comprehend and trust the results and output cre- ware families, only 77 could map to different attributes
ated by machine learning algorithms [315]. It may be used based on the information collected from various sources;
to characterize the model’s decision-making process. Mal- websites, journal articles, news feeds, tweets by IoT mal-
ware analysts and ML developers might use these to adjust ware analysts, etc. Furthermore, it was challenging to map
the hyperparameters, determine the scope of detection, and the attribute as different sources mentioned different infor-
spot any possible overgeneralization or overfitting that mation. In that case, we have selected the appropriate one
might lead to false positives or negatives. For a malware based on the explanations given in the sources. Another
analyst to comprehend the interpretation, the model expla- challenge was the inconsistency in naming the malware
nation must be described in simple malware behaviours families, where two different sources considered the same
rather than machine learning characteristics [315]. malware family with two different names. We welcome
• Anti-Adversarial Malware Strategies: These should be any modifications and recommendations related to the
used to measure the effectiveness of the ML models. It data. In the future, we plan to address these challenges
has two settings. First is the black box, where malware and also, develop a robust and generalized IoT malware
authors have little to no understanding of the model’s detection model.

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1423

Author contribution Princy Victor and Arash Habibi Lashkari sur- 11. De Donno M, Dragoni N, Giaretta A, Spognardi A (2017) Analy-
veyed IoT malware with 100 attributes based on IoT malware catego- sis of DDoS-capable IoT malwares. In: 2017 Federated Confer-
ries, attack types, attack surfaces, malware distribution architecture, ence on Computer Science and Information Systems (FedCSIS),
victim devices, victim device architecture, characteristics, access IEEE, pp 807–816
mechanisms, programming languages, and protocols. Rongxing Lu and 12. Hallman R, Bryan J, Palavicini G, Divita J, Romero-Mariona
Tinshu Sasi conducted a detailed analysis of 77 IoT malware between J (2017) Ioddos - the internet of distributed denial of sevice
2008 and 2022 based on the categories. Pulei Xiong and Shahrear attacks. In: 2nd International Conference on Internet of Things,
Iqbal summarized the existing challenges and future research scopes Big Data and Security. SCITEPRESS, pp 47–58
in IoT malware. Princy Victor wrote the manuscript with support from 13. Shobana M, Rathi S (2018) IoT malware: an analysis of IoT
Arash Habibi Lashkari, Rongxing Lu, Tinshu Sasi, Pulei Xiong, and device hijacking. International Journal of Scientific Research in
Shahrear Iqbal. All authors discussed the results and contributed to Computer Science, Engineering and Information Technology
the final manuscript. 14. Vignau B, Khoury R, Hallé S (2019) 10 years of IoT malware: a
feature-based taxonomy. In: 2019 IEEE 19th International Con-
Funding This project was partly supported by collaborative research ference on Software Quality, Reliability and Security Companion
funding from the National Research Council of Canada’s Artificial (QRS-C), pp 458–465. https://​doi.​org/​10.​1109/​QRS-C.​2019.​00088
Intelligence for Logistics Program. 15. Vignau B, Khoury R, Hallé S, Hamou-Lhadj A (2021) The evo-
lution of IoT malwares, from 2008 to 2019: Survey, taxonomy,
Data availability Not applicable. process simulator and perspectives. J Syst Architect 102143
16. Emotet malware starts to use IoT devices as proxy - SOC prime.
Declarations https://​socpr ​ime.​com/​news/​emotet-​malwa​re-​starts-​to-​use-​iot-​
devic​es-​as-​proxy/. Accessed 23 May 2022
Ethics approval Not applicable. 17. IoT and ransomware: a recipe for disruption - Security News.
https://​www.​trend​micro.​com/​vinfo/​us/​secur​ity/​news/​inter​net-​
Consent to publish Not applicable. of-​things/​iot-​and-​ranso​mware-a-​recipe-​for-​disru​ption#:​~:​text=​
IoT%2​ 0rans​ omwar​ e%2​ 0is%2​ 0a%2​ 0rans​ omwar​ e,that%2​ 0shif​ ted%​
20to%​20sma​rt%​20TVs. Accessed 23 May 2022
Conflict of interest We declare that no known conflicts of interest are 18. Bytes M. Malware. https://​www.​malwa​rebyt​es.​com/​malwa​re.
associated with this publication. Accessed 10 Dec 2021
19. Kaspersky: 1980s | Kaspersky IT Encyclopedia. https://​encyc​loped​ia.​
kaspe​rsky.​com/​knowl​edge/​years-​1980s/. Accessed 10 Dec 2021
References 20. India A. What is IoT? Defining the Internet of Things (IoT) | Aeris. https://​
info.​aeris.​com/​infog​raphic-​what-​is-​iot. Accesed 12 May 2022
1. Vasan D, Alazab M, Venkatraman S, Akram J, Qin Z (2020) 21. Wikipedia. Internet of Things - Wikipedia. https://​en.​wikip​edia.​
Mthael: Cross-architecture IoT malware detection based on org/​wiki/​Inter​net_​of_​things. Accessed 12 May 2021
neural network advanced ensemble learning. IEEE Transac- 22. Bertino E, Islam N (2017) Botnets and Internet of Things secu-
tions on Computers 69(11):1654–1667. https://​d oi.​o rg/​1 0.​ rity. Computer 50(2):76–79
1109/​TC.​2020.​30155​84 23. Malware is a growing threat to IoT devices- find out how to protect
2. State of IoT 2021: Number of connected IoT devices growing your device! https://​www.​einfo​chips.​com/​blog/​malwa​re-​is-a-​growi​ng-​
9% to 12.3 B. https://​IoT-​analy​tics.​com/​number-​conne​cted-​IoT-​ threat-​to-​IoT-​devic​es-​find-​out-​how-​to-​prote​ct-​your-​device/. Accessed
devic​es/. Accessed 9 Jan 2022 10 May 2022
3. Security HN. IoT malware attacks rose 700% during the pan- 24. Specht S, Lee R (2003) Taxonomies of distributed denial of ser-
demic. https://​w ww.​h elpn​e tsec​u rity.​c om/​2 021/​0 7/​2 0/​I oT-​ vice networks, attacks, tools and countermeasures. CEL2003-03,
malwa​re-​attac​ks-​rose. Accessed 10 Dec 2021 Princeton University, Princeton, NJ, USA
4. Mary DRK, Ko E, Kim SG, Yum SH, Shin SY, Park SH (2021) 25. O’Donnell L. Gitpaste-12 worm targets linux servers, IoT devices
A systematic review on recent trends, challenges, privacy | Threatpost. https://​t hrea​tpost.​com/​gitpa​ste-​12-​worm-​linux-​
and security issues of underwater internet of things. Sensors serve​rs-​IoT-​devic​es/​161016/. Accessed 21 Dec 2021
21(24). https://​doi.​org/​10.​3390/​s2124​8262, https://​www.​mdpi.​ 26. Yamaguchi S, Leelaprute P (2019) Hajime worm with lifespan
com/​1424-​8220/​21/​24/​8262 and its mitigation evaluation against Mirai malware based on
5. Costin A, Zaddach J (2018) IoT malware: Comprehensive sur- agent-oriented petri net pn 2. In: 2019 IEEE International Con-
vey, analysis framework and case studies. BlackHat USA ference on Consumer Electronics (ICCE), IEEE, pp 1–4
6. Smith C, Miessler D (2014) Internet of Things HP security 27. Zhang X, Upton O, Beebe NL, Choo KKR (2020) IoT botnet
research study. https://d-​r ussia.​r u/​wp-​conte​nt/​uploa​ds/​2015/​ forensics: a comprehensive digital forensic case study on mirai
10/​4AA5-​4759E​NW.​pdf botnet servers. Forensic Sci Int: Digit Invest 32:300926
7. Chaabouni N, Mosbah M, Zemmari A, Sauvignac C, Faruki P 28. Johansen AG. What is a Trojan? Is it a virus or is it malware?
(2019) Network intrusion detection for IoT security based on learn- https://u​ s.n​ orton.c​ om/i​ ntern​ etsec​ urity-m
​ alwar​ e-w​ hat-i​ s-a-t​ rojan.​
ing techniques. IEEE Commun Surv Tutor 21(3):2671–2701 html. Accessed 10 Dec 2021
8. Kenny L (2017) IoT: The internet of trouble. https://​secur​ityin​ 29. Babu PD, Pavani C, Naidu CE (2019) Cyber security with IoT.
telli​gence.​com/ In: 2019 Fifth International Conference on Science Technology
9. Huda S, Miah S, Yearwood J, Alyahya S, Al-Dossari H, Doss Engineering and Mathematics (ICONSTEM), vol. 1, pp 109–113.
R (2018) A malicious threat detection model for cloud assisted https://​doi.​org/​10.​1109/​ICONS​TEM.​2019.​89187​82
Internet of Things (COT) based industrial control system (ICS) 30. Grimes RA. 9 types of malware and how to recognize them.
networks using deep belief network. J Parallel Distrib Comput https://w​ ww.c​ soonl​ ine.c​ om/a​ rticl​ e/2​ 61592​ 5/s​ ecuri​ ty-y​ our-q​ uick-​
120:23–31 guide-​to-​malwa​re-​types.​html. Accessed 10 Dec 2021
10. Parra GDLT, Rad P, Choo KKR, Beebe N (2020) Detecting Internet 31. Akabane S, Okamoto T (2020) Identification of library func-
of Things attacks using distributed deep learning. J Netw Comput tions statically linked to linux malware without symbols. Proce-
Appl 163:102662 dia Comput Sci 176:3436–3445. 10.1016/j.procs.2020.09.053.

13
1424 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

Knowledge-Based and Intelligent Information & Engineering Sys- 51. Munshi A, Alqarni NA, Almalki NA (2020) Ddos attack on IoT
tems: Proceedings of the 24th International Conference KES2020 devices. In: 2020 3rd International Conference on Computer
32. Bocetta S. Spyware in the IoT - this year’s biggest security threat. Applications & Information Security (ICCAIS), IEEE, pp 1–5
https://i​ nform
​ ation​ secur​ itybu​ zz.c​ om/a​ rticl​ es/s​ pywar​ e-i​ n-t​ he-I​ oT-​ 52. Murphy M (2017) The Internet of Things and the threat it poses
this-​years-​bigge​st-​secur​ity-​threat/. Accessed 27 Dec 2021 to dns. Netw Secur 2017(7):17–19
33. Elmalaki S, Ho BJ, Alzantot M, Shoukry Y, Srivastava M (2019) Spy- 53. Razzak F (2012) Spamming the Internet of Things: a possibility
con: Adaptation based spyware in human-in-the-loop IoT. In: 2019 and its probable solution. Procedia Comput Sci 10:658–665
IEEE Security and Privacy Workshops (SPW), IEEE, pp 163–168 54. Shiaeles S, Kolokotronis N, Bellini E (2019) IoT vulnerability
34. Zahra SR, Chishti MA (2019) Ransomware and internet of data crawling and analysis. In: 2019 IEEE World Congress on
things: a new security nightmare. In: 2019 9th International Services (SERVICES), IEEE, vol. 2642, pp 78–83
Conference on Cloud Computing, Data Science & Engineering 55. Wang B, Dou Y, Sang Y, Zhang Y, Huang J (2020) IoTcmal:
(Confluence), IEEE, pp 551–555 Towards a hybrid IoT honeypot for capturing and analyzing
35. Alshammari TB, Alanazi AS (2021) Security threats against malware. In: ICC 2020-2020 IEEE International Conference on
the Internet of Things at home. In: 2021 International Confer- Communications (ICC), IEEE, pp 1–7
ence on Electrical, Communication, and Computer Engineering 56. Zahra A, Shah MA (2017) IoT based ransomware growth rate
(ICECCE), pp 1–5. https://d​ oi.o​ rg/1​ 0.1​ 109/I​ CECCE ​ 52056.2​ 021.​ evaluation and detection using command and control blacklist-
95142​58 ing. In: 2017 23rd International Conference on Automation and
36. Perry JS. IoT malware - anatomy of an attack - IBM developer. Computing (ICAC), IEEE, pp 1–6
https://​devel​oper.​ibm.​com/​techn​ologi​es/​IoT/​artic​les/​IoT-​anato​my-​ 57. Zolanvari M, Teixeira MA, Jain R (2018) Effect of imbalanced
IoT-​malwa​re-​attack/ datasets on security of industrial IoT using machine learning. In:
37. Yoon J (2020) Deep-learning approach to attack handling 2018 IEEE International Conference on Intelligence and Security
of IoT devices using IoT-enabled network services. Internet Informatics (ISI), IEEE, pp 112–117
Things 11:100241 58. Arsene L. Hold my beer Mirai - Spinoff named ‘LiquorBot’
38. Wurm J, Hoang K, Arias O, Sadeghi AR, Jin Y (2016) Security incorporates cryptomining - Bitdefender Labs. https://​l abs.​
analysis on consumer and industrial IoT devices. In: 2016 21st bitde​fender.​com/​2020/​01/​hold-​my-​beer-​mirai-​spino​ff-​named-​
Asia and South Pacific Design Automation Conference (ASP- liquo​rbot-​incor​porat​es-​crypt​omini​ng/. Accessed 27 Dec 2021
DAC), IEEE, pp 519–524 59. Barbaschow A. Talos finds new VPNFilter malware hitting
39. Li W, Jin J, Lee JH (2019) Analysis of botnet domain names 500k IoT devices, mostly in Ukraine | ZDNet. https://​www.​
for IoT cybersecurity. IEEE Access 7:94658–94665 zdnet.​com/​artic​le/​t alos-​finds-​new-​vpnfi​lter-​malwa​re-​hitti​ng-​
40. Wainwright P, Kettani H (2019) An analysis of botnet models. 500k-​IoT-​devic​es-​mostly-​in-​ukrai​ne/. Accessed 27 Dec 2021
In: Proceedings of the 2019 3rd International Conference on 60. Bisson D. New ‘Kaiji’ Linux malware targeting IoT devices. https://​
Compute and Data Analysis, pp 116–121 secur​ityin​telli​gence.​com/​news/​new-​kaiji-​linux-​malwa​re-​targe​ting-​
41. Yin L, Luo X, Zhu C, Wang L, Xu Z, Lu H (2019) Connspoiler: IoT-​devic​es/. Accessed 21 Dec 2021
Disrupting C&C communication of IoT-based botnet through 61. CenturyLink. New Mozi malware family found. https://​www.​
fast detection of anomalous domain queries. IEEE Trans Ind prnew​s wire.​c om/​n ews-​r elea​s es/​n ew-​m ozi-​m alwa​r e-​family-​
Inform 16(2):1373–1384 found-​30104​0703.​html. Accessed 11 May 2021
42. (1) New Messages! https://w ​ ww.c​ rowds​ trike.c​ om/c​ ybers​ ecuri​ ty-​ 62. Cimpanu C. IoT botnet retooled to send email spam. https://​
101/​botne​ts/. Accessed 17 Nov 2021 www.​bleep​ingco​mputer.​com/​news/​secur​ity/​IoT-​botnet-​retoo​led-​
43. Acar G, Huang DY, Li F, Narayanan A, Feamster N (2018) Web- to-​send-​email-​spam/. Accessed 27 Dec 2021
based attacks to discover and control local IoT devices. In: Proceed- 63. Cimpanu C. New Imeij IoT malware targets AVTech equipment.
ings of the 2018 Workshop on IoT Security and Privacy, pp 29–35 https://​www.​bleep​ingco​mputer.​com/​news/​secur​ity/​new-​imeij-​
44. Alzahrani H, Abulkhair M, Alkayal E (2020) A multi-class IoT-​malwa​re-​targe​ts-​avtech-​equip​ment/. Accessed 11 May 2021
neural network model for rapid detection of IoT botnet attacks. 64. Cimpanu C. Prowli malware operation infected over 40,000 serv-
IJACSA ers, modems, and IoT devices. https://​www.​bleep​ingco​mputer.​
45. Bedi P, Mewada S, Vatti RA, Singh C, Dhindsa KS, Ponnusamy M, com/​news/​secur​ity/​prowli-​malwa​re-​opera​tion-​infec​ted-​over-​40-​
Sikarwar R (2021) Detection of attacks in IoT sensors networks using 000-​serve​rs-​modems-​and-​IoT-​devic​es/. Accessed 21 Dec 2021
machine learning algorithm. Microprocess Microsyst 82:103814 65. Cyware. FritzFrog P2P botnet already breached 500 SSH servers |
46. Carpentier E, Thomasset C, Briffaut J (2019) Bridging the gap: Cyware Alerts - Hacker News. https://​cyware.​com/​news/​fritz​frog-​
Data exfiltration in highly secured environments using bluetooth p2p-​botnet-​alrea​dy-​breac​hed-​500-​ssh-​serve​rs-​05e7f​e5e. Accessed
IoTs. In: 2019 IEEE 37th International Conference on Computer 27 Dec 2021
Design (ICCD), IEEE, pp 297–300 66. Design ACW. What is website ‘hacking’? And Am I at risk?
47. Chen YW, Sheu JP, Kuo YC, Van Cuong N (2020) Design and https://​www.​anora​kcat.​co.​uk/​blog/​what-​is-​websi​te-​hacki​ng-​and-​
implementation of IoT DDoS attacks detection system based on am-i-​at-​risk/. Accessed 18 Oct 2021
machine learning. In: 2020 European Conference on Networks 67. Dickson B. The IoT ransomware threat is more serious than you think -
and Communications (EuCNC), IEEE, pp 122–127 IoT security foundation. https://​www.​IoTse​curit​yfoun​dation.​org/​the-​
48. Dua A, Tyagi V, Patel N, Mehtre B (2019) Iisr: A secure router for IoT-​ranso​mware-​threat-​is-​more-​serio​us-​than-​you-​think/. Accessed
IoT networks. In: 2019 4th International Conference on Information 16 Jan 2022
Systems and Computer Networks (ISCON), IEEE, pp 636–643 68. Fruhlinger J. DDoS explained: How distributed denial of service
49. Hussain F, Abbas SG, Husnain M, Fayyaz UU, Shahzad F, Shah attacks are evolving | CSO Online. https://​www.​csoon​line.​com/​
GA (2020) IoT DoS and DDoS attack detection using resnet. In: artic​le/​32220​95/​ddos-​expla​ined-​how-​denial-​of-​servi​ce-​attac​ks-​
2020 IEEE 23rd International Multitopic Conference (INMIC), are-​evolv​ing.​html. Accessed 22 Feb 2022
IEEE, pp 1–6 69. imperva: Command injection. https://​www.​imper​va.​com/​learn/​
50. Krejčí R, Hujňák O, Švepeš M (2017) Security survey of the appli​cation-​secur​ity/​comma​nd-​injec​tion/. Accessed 18 Oct 2021
IoT wireless protocols. In: 2017 25th Telecommunication Forum 70. Kenton W. Click fraud. https://​www.​inves​toped​ia.​com/​terms/c/​
(TELFOR), IEEE, pp 1–4 click-​fraud.​asp. Accessed 18 Oct 2021

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1425

71. Labs AP. Katana: a new variant of the Mirai botnet | Avira Blog. https://​ International Seminar on Intelligent Technology and Its Appli-
www.​avira.​com/​en/​blog/​katana-​a-​new-​varia​nt-​of-​the-​mirai-​botnet. cations (ISITIA), IEEE, pp 205–209
Accessed 18 Jan 2022 91. Torabi S, Dib M, Bou-Harb E, Assi C, Debbabi M (2021) A strings-
72. Lord N. What is data exfiltration? | Digital Guardian. https://​ based similarity analysis approach for characterizing IoT malware
digit​algua​rdian.​com/​blog/​what-​data-​exfil​trati​on. Accessed 21 and inferring their underlying relationships. IEEE Netw Lett
Dec 2021 92. Visoottiviseth V, Akarasiriwong P, Chaiyasart S, Chotivatunyu
73. Nadeau M. What is cryptojacking? How to prevent, detect, and recover S (2017) Pentos: Penetration testing tool for Internet of Thing
from it | CSO Online. https://​www.​csoon​line.​com/​artic​le/​32535​72/​ devices. In: TENCON 2017–2017. IEEE Region 10 Conference,
what-​is-​crypt​ojack​ing-​how-​to-​preve​nt-​detect-​and-​recov​er-​from-​it.​ IEEE, pp 2279–2284
html. Accessed 5 Nov 2022 93. Firewall (computing) - Wikipedia. https://e​ n.w ​ ikipe​ dia.o​ rg/w
​ iki/​
74. Paganini P. Linux.ProxyM IoT botnet now used to launch hack- Firew​all_​(compu​ting). Accessed 20 Oct 2021
ing attacks against websitessecurity affairs. https://s​ ecuri​ tyaf​f airs.​ 94. IoT amnesia botnet puts at risk hundreds of thousands of DVRs due to
co/​wordp​ress/​66537/​malwa​re/​linux-​proxym-​IoT-​botnet.​html. unpatched flawsecurity affairs. https://​secur​ityaf​f airs.​co/​wordp​ress/​
Accessed 18 Jan 2022 57803/​malwa​re/​iot-​amnes​ia-​botnet.​html. Accessed 8 Nov 2021
75. Porgram HC. Botnet threat to the healthcare industry. https://​ 95. Satori: The new malware family that affects cryptocurrencies -
www.​hhs.​gov/​sites/​defau​lt/​files/​botnet-​t hreat-​to-​healt​hcare-​ Swascan. https://​www.​swasc​an.​com/​swasc​an-​satori/. Accessed
indus​try.​pdf?​langu​age=​en. Accessed 16 Jan 2022 8 Nov 2021
76. Radware. BrickerBot results in permanent denial-of-service. https://​ 96. Cimpanu C. New Silex malware is bricking IoT devices, has
www.​radwa​re.​com/​secur​ity/​ddos-​threa​ts-​attac​ks/​brick​erbot-​pdos-​ scary plans | ZDNet. https://​www.​zdnet.​com/​artic​le/​new-​silex-​
perma​nent-​denial-​of-​servi​ce/. Accessed 11 May 2022 malwa​re-​is-​brick​ing-​IoT-​devic​es-​has-​scary-​plans/. Accessed 21
77. Trendmicrocom. PyRoMineIoT targets, infects, and spreads to Dec 2021
vulnerable IoT devices - Security News. https://w ​ ww.t​ rendm ​ icro.​ 97. hakdefnet.org. Mirai updates from partners - HakDefNet.
com/​vinfo/​in/​secur​ity/​news/​cyber-​attac​ks/​pyrom​ineIoT-​targe​ts-​ https://​hakde​fnet.​org/​2019/​01/​01/​mirai-​updat​es-​from-​partn​ers/.
infec​ts-​and-​sprea​ds-​to-​vulne​rable-​IoT-​devic​es. Accessed 21 Dec Accessed 11 May 2022
2021 98. Millman R (2017) Security researchers warn of ‘airborne’ IoT
78. Cloudflare Website. What is a malicious payload? | Cloud- malware. Blueborne. https://​inter ​netof​busin​ess.​com/​secur ​ity-​
flare. https://​www.​cloud​f lare.​com/​learn​ing/​secur ​ity/​gloss​ary/​ resea​rchers-​warn-​over-​blueb​orne-​IoT-​malwa​re/. Accessed 11
malic​ious-​paylo​ad/. Accessed 16 Jan 2022 May 2022
79. Cloudflare Website. What is DNS? | How DNS works | Cloud- 99. HaddadPajouh H, Dehghantanha A, Khayami R, Choo KKR (2018)
flare. https://​www.​cloud​flare.​com/​learn​ing/​dns/​what-​is-​dns/. A deep recurrent neural network based approach for internet of
Accessed 16 Jan 2022 things malware threat hunting. Future Gener Comput Syst 85:88–96
80. Website C. What is the Mirai botnet? | Cloudflare. https://​www.​ 100. Karanja EM, Masupe S, Jeffrey MG (2020) Analysis of inter-
cloud​flare.​com/​learn​ing/​ddos/​gloss​ary/​mirai-​botnet/. Accessed net of things malware using image texture features and machine
10 Mar 2021 learning techniques. Internet Things 9:100153
81. Website H. What is a spam attack? | Support | Hornet, the gay 101. Tien CW, Chen SW, Ban T, Kuo SY (2020) Machine learning
social network. https://​hornet.​com/​contr ​ibuto​rs/​suppo​rt/​artic​le/​ framework to analyze IoT malware using elf and opcode features.
spam-​attack. Accessed 18 Jan 2022 Digit Threats: Res Pract 1(1):1–19
82. Website I. What is DNS spoofing | Cache poisoning attack exam- 102. Wan TL, Ban T, Cheng SM, Lee YT, Sun B, Isawa R, Takahashi
ple | Imperva. https://​www.​imper​va.​com/​learn/​appli​cation-​secur​ity/​ T, Inoue D (2020) Efficient detection and classification of Inter-
dns-​spoof​i ng/. Accessed 21 Dec 2021 net-of-Things malware based on byte sequences from executable
83. Zhang L. CERT analysis on IoT botnet and DDoS attacks - files. IEEE Open J Comput Soc 1:262–275
DZone IoT. https://​dzone.​com/​artic​les/​cert-​analy​sis-​on-​IoT-​bot- 103. ARC (processor) - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​
net-​and-​ddos-​attac​ks. Accessed 11 May 2022 ARC_​(proce​ssor). Accessed 27 Dec 2021
84. Zhong W. Command injection | OWASP. https://​owasp.​o rg/​ 104. Arm architecture - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​
www- ​ c ommu ​ n ity/ ​ a ttac​ k s/ ​ C omma ​ n d_ ​ I njec​ t ion#: ​ ~ : ​ t ext=​ ARM_​archi​tectu​re. Accessed 27 Dec 2021
Comma​nd%​20inj​ection%​20is%​20an%​20att​ack,.)%​20to%​20a%​ 105. Intel 80386 – Wikipédia. https://​fr.​wikip​edia.​org/​wiki/​Intel_​
20sys​tem%​20she​ll. Accessed 27 Dec 2021 80386. Accessed 27 Dec 2021
85. Alnahari W, Quasim MT (2021) Authentication of IoT device 106. MIPS architecture - wikipedia. https://​en.​wikip​edia.​org/​wiki/​
and IoT server using security key. In: 2021 International Con- MIPS_​archi​tectu​re. Accessed on 27 Dec 2021
gress of Advanced Technology and Engineering (ICOTEN), pp 107. Mirai variant targets arc CPU-based devices | securityweek.com.
1–9. https://​doi.​org/​10.​1109/​ICOTE​N52080.​2021.​94934​92 https://​www.​secur​itywe​ek.​com/​mirai-​varia​nt-​targe​ts-​arc-​cpu-​
86. Kagita MK, Bojja GR, Kaosar M (2021) A framework for intel- based-​devic​es. Accessed 13 Jan 2022
ligent IoT firmware compliance testing. Internet Things Cyber 108. Motorola 68000 - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​
Phys Syst 1:1–7 Motor​ola_​68000. Accessed 27 Dec 2021
87. Kumar A, Lim TJ (2019) Edima: Early detection of IoT malware 109. PowerPC - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​Power​PC.
network activity using machine learning techniques. In: 2019 Accessed 27 Dec 2021
IEEE 5th World Forum on Internet of Things (WF-IoT), IEEE, 110. SPARC - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​SPARC.
pp 289–294 Accessed 27 Dec 2021
88. Kuzlu M, Fair C, Guler O (2021) Role of artificial intelligence 111. SuperH - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​SuperH.
in the internet of things (IoT) cybersecurity. Discover Internet Accessed 27 Dec 2021
Things 1(1):1–14 112. x86 - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​X86. Accessed
89. Myers J, Babun L, Yao E, Helble S, Allen P (2019) Mad-IoT: 27 Dec 2021
Memory anomaly detection for the Internet of Things. In: 2019 113. Haiba S, Mazri T (2021) Build a malware detection software for
IEEE Globecom Workshops (GC Wkshps), IEEE, pp 1–6 IoT network using machine learning. In: Proceedings of the 4th
90. Soewito B, Andhika CE (2019) Next generation firewall for International Conference on Networking, Information Systems
improving security in company and IoT network. In: 2019 & Security, pp 1–8

13
1426 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

114. Heightened DDoS threat posed by Mirai and other botnets | Cisa. mirai-o​ kiru-n​ ew-d​ dos-b​ otnet-t​ arget​ s-a​ rc-b​ ased-I​ oT-d​ evice​ s.h​ tml.
https://​www.​cisa.​gov/​uscert/​ncas/​alerts/​TA16-​288A. Accessed Accessed 16 Jan 2022
27 Dec 2021 136. New Mirai variants have built-in domain generation algorithm
115. Mirai malware infects CCTV camera | Blog | Darktrace. https://​ | securityweek.com. https://​www.​secur​itywe​ek.​com/​new-​mirai-​
www.​darkt​race.​com/​en/​blog/​mirai-​malwa​re-​infec​ts-​cctv-​cam- varia​nts-​have-​built-​domain-​gener​ation-​algor​ithm. Accessed 16
era/. Accessed 27 Dec 2021 Jan 2022
116. Smart toy security vulnerabilities archives - FS Studio. https://​ 137. A new strain of IoT malware can survive a reboot | Boing Boing.
fsstud​ io.c​ om/t​ ag/s​ mart-t​ oy-s​ ecuri​ ty-v​ ulner​ abili​ ties/. Accessed 27 https:// ​ b oing ​ b oing. ​ n et/ ​ 2 018/ ​ 0 5/ ​ 0 9/ ​ b oot- ​ p ersi ​ s tence. ​ h tml.
Dec 2021 Accessed 27 Dec 2021
117. Cimpanu C. New Ttint IoT botnet caught exploiting two zero-days 138. Spime watch: Linux.Darlloz, the internet-of-things worm |
in Tenda routers | ZDNet. https://​www.​zdnet.​com/​artic​le/​new-​ Wired. https://​www.​wired.​com/​2014/​01/​spime-​watch-​linux-​
ttint-​IoT-​botnet-​caught-​explo​iting-​two-​zero-​days-​in-​tenda-​route​rs/. darll​oz-​inter​net-​things-​worm/. Accessed 16 Jan 2022
Accessed 21 Dec 2021 139. internetofbusiness: OMG! Mirai malware variant turns IoT devices
118. Wangwang W, Yunchun Z, Chengjie L, Xuchenming S, Yuting Z, into proxy servers | Internet of Business. https://​inter​netof​busin​ess.​
Xin Z (2021) Network traffic oriented malware detection in IoT com/​omg-​mirai-​malwa​re-​varia​nt-​turns-​IoT-​device-​proxy-​serve​rs/.
(internet-of-things). In: 2021 International Conference on Net- Accessed 16 Jan 2022
working and Network Applications (NaNA), IEEE, pp 301–307 140. Amnesia:33 – Critical TCP/IP flaws affect millions of iot devices.
119. Cayre R, Nicomette V, Auriol G, Alata E, Kaâniche M, Marco- https://​theha​ckern​ews.​com/​2020/​12/​amnes​ia33-​criti​cal-​tcpip-​
nato G (2019) Mirage: Towards a metasploit-like framework for flaws-​affect.​html. Accessed 17 Jan 2022
IoT. In: 2019 IEEE 30th International Symposium on Software 141. File Transfer Protocol (FTP) definition. https://​www.​inves​toped​ia.​
Reliability Engineering (ISSRE), IEEE, pp 261–270 com/​terms/f/​ftp-​file-​trans​fer-​proto​col.​asp. Accessed 17 Jan 2022
120. Wang D, Ming J, Chen T, Zhang X, Wang C (2018) Cracking 142. Freaking out about fiendish IoT exploits? Maybe disable tel-
IoT device user account via brute-force attack to sms authentica- net, FTP and change that default password first? The register.
tion code. In: Proceedings of the First Workshop on Radical and https://​www.​there​gister.​com/​2019/​06/​18/​iot_​defau​lt_​secur​ity/.
Experiential Security, pp 57–60 Accessed 27 Dec 2021
121. Bashlite updated with mining and backdoor commands. https://​ 143. How to proactively defend against Mozi IoT botnet - Microsoft
www.t​ rendm ​ icro.c​ om/e​ n_c​ a/r​ esear​ ch/1​ 9/d/b​ ashli​ te-i​ ot-m
​ alwar​ e-​ Security Blog. https://​www.​micro​soft.​com/​secur​ity/​blog/​2021/​
updat​ed-​with-​mining-​and-​backd​oor-​comma​nds-​targe​ts-​wemo-​ 08/​1 9/​h ow-​t o-​p roac​t ively-​d efend-​a gain​st-​m ozi-​i ot-​b otnet/.
devic​es.​html. Accessed 21 Dec 2021 Accessed 27 Dec 2021
122. Brute force attack: Definition, types, and prevention | varonis. https://​ 144. HTTP | MDN. https://​devel​oper.​mozil​la.​org/​en-​US/​docs/​Web/​
www.​varon​is.​com/​blog/​brute-​force-​attack/. Accessed 21 Dec 2021 HTTP. Accessed on 18 Jan 2022
123. Brute force attacks on IoT - here to stay? | Allot blog. https://​www.​ 145. IoT vulnerability assessment of the Irish IP address space. https://​
allot.​com/​blog/​brute-​force-​attac​ks-​iot/. Accessed 21 Dec 2021 www.​f5.​com/​labs/​artic​les/​threat-​intel​ligen​ce/​IoT-​vulne​rabil​ity-​
124. Bug in millions of flawed iot devices lets attackers eavesdrop asses​sment-​of-​the-​irish-​ip-​addre​ss-​space. Accessed 27 Dec 2021
| Threatpost. https://​threa​tpost.​com/​bug-​iot-​milli​ons-​devic​es-​ 146. IoT worm “Hajime” uses bittorrent protocols for communications |
attac​kers-​eaves​drop/​168729/. Accessed 21 Dec 2021 securityweek.com. https://​www.​secur​itywe​ek.​com/​IoT-​worm-​hajime-​
125. What is a CVE? https://w ​ ww.r​ edhat.c​ om/e​ n/t​ opics/s​ ecuri​ ty/w ​ hat-​ uses-​bitto​rrent-​proto​cols-​commu​nicat​ions. Accessed 27 Dec 2021
is-​cve. Accessed on 21 Dec 2021 147. Linux Shishiga malware using LUA scripts | WeLiveSecurity.
126. What is Metasploit? The beginner’s guide. https://​www.​varon​is.​ https://​www.​weliv​esecu​r ity.​com/​2017/​04/​25/​linux-​shish​iga-​
com/​blog/​what-​is-​metas​ploit/. Accessed on 21 Dec 2021 malwa​re-​using-​lua-​scrip​ts/. Accessed 18 Jan 2022
127. Edward S, Profetis I. Hajime: Analysis of a decentralized inter- 148. Mozi, another botnet using DHT. https://​blog.​netlab.​360.​com/​
net worm for IoT devices. http://​secur​ity.​rapid​ityne​tworks.​com/​ mozi-​anoth​er-​botnet-​using-​dht/. Accessed 18 Jan 2022
publi​catio​ns/​2016-​10-​16/​hajime.​pdf. Accessed 16 Jan 2022 149. New Kaiji malware targets IoT devices via SSH brute-force attacks
128. Su J, Vasconcellos DV, Prasad S, Sgandurra D, Feng Y, Sakurai K | ZDNet. https://​www.​zdnet.​com/​artic​le/​new-​kaiji-​malwa​re-​targe​ts-​
(2018) Lightweight classification of IoT malware based on image IoT-​devic​es-​via-​ssh-​brute-​force-​attac​ks/. Accessed 18 Jan 2022
recognition. In: 2018 IEEE 42nd Annual Computer Software and 150. The Persirai botnet - UHWO Cyber Security. https://​westo​ahu.​
Applications Conference (COMPSAC), IEEE, vol. 2, pp 664–669 hawaii.​edu/​cyber/​regio​nal/​gce-​us-​news/​t he-​persi​rai-​botnet/.
129. (1) New Messages! https://​www.​imper​va.​com/​blog/​650gb​ps-​ Accessed 18 Jan 2022
ddos-​attack-​leet-​botnet/. Accessed 16 Jan 2022 151. Persirai: New IoT botnet targets IP cameras. https://​www.​trend​micro.​
130. Echobot Malware Now up to 71 exploits, targeting scada. https://​ com/​en_​ca/​resea​rch/​17/e/​persi​rai-​new-​inter​net-​things-​IoT-​botnet-​
www.​f5.​com/​labs/​artic​les/​threat-​intel​ligen​ce/​echob​ot-​malwa​re-​ targe​ts-​ip-​camer​as.​html. Accessed 27 Dec 2021
now-​up-​to-​71-​explo​its--​targe​ting-​scada. Accessed 16 Jan 2022 152. Telnet - Wikipedia. https:// ​ e n. ​ w ikip ​ e dia. ​ o rg/ ​ w iki/ ​ Telnet.
131. Gitpaste-12 malware via Github and Pastebin attacks Linux Accessed 17 Jan 2022
servers. https://​cyber​secur ​ityne​ws.​com/​gitpa​ste-​12-​malwa​re/. 153. The UPnP security exploit affecting millions of home devices.
Accessed 16 Jan 2022 https://​www.​minim.​com/​blog/​the-​upnp-​secur​ity-​explo​it-​affec​ting-​
132. IoT malware starts showing destructive behavior | CSO Online. milli​ons-​of-​home-​devic​es. Accessed 27 Dec 2021
https://​www.​csoon​line.​com/​artic​le/​31884​29/​IoT-​malwa​re-​starts-​ 154. What is UPnP? | NordVPN. https://​nordv​pn.​com/​blog/​what-​is-​
showi​ng-​destr​uctive-​behav​ior.​html. Accessed 27 Dec 2021 upnp/. Accessed 18 Jan 2022
133. JenX: a new botnet threatening all. https://​www.​radwa​re.​com/​ 155. Vijayan J. New ‘HEH’ botnet targets exposed telnet services.
secur​ity/​ddos-​threa​ts-​attac​ks/​threat-​advis​ories-​attack-​repor​ts/​ https://​www.​darkr​eading.​com/​vulne​rabil​ities-​threa​ts/​new-​heh-​
jenx/. Accessed 16 Jan 2022 botnet-​targe​ts-​expos​ed-​telnet-​servi​ces. Accessed 27 Dec 2021
134. Mirai goes stealth - TLS & IoT malware - Lacework. https://​ 156. Wikipedia Contributors (2022) Secure shell – Wikipedia, the free
www.​lacew​ork.​com/​blog/​mirai-​goes-​steal​th-​tls-​IoT-​malwa​re/. encyclopedia. https://​en.​wikip​edia.​org/w/​index.​php?​title=​Secure_​
Accessed 27 Dec 2021 Shell​ &​oldid=​10653​92858. Online. Accessed 18 Jan 2022
135. Mirai Okiru: New ddos botnet targets arc-based IoT devices | 157. Backdoor: Linux/IoTReaper threat description - Microsoft Security
CSO Online. https://​w ww.​c soon​l ine.​c om/​a rtic​l e/​3 2477​9 4/​ Intelligence. https://​www.​micro​soft.​com/​en-​us/​wdsi/​threa​ts/​malwa​re-​

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1427

encyc​loped​ia-​descr​iption?​Name=​Backd​oor:​Linux/​IoTRe​aper. 176. Herwig S, Harvey K, Hughey G, Roberts R, Levin D (2019) Meas-

Accessed 19 Jan 2022 urement and analysis of Hajime, a peer-to-peer IoT botnet. In: Net-
158. Check point discovers three zero-day vulnerabilities in web work and Distributed Systems Security (NDSS) Symposium
programming language PHP 7 - Check Point software. https://​ 177. (1) New Messages! https://​www.​synop​sys.​com/​blogs/​softw​are-​
blog.​check​point.​com/​2016/​12/​27/​check-​point-​disco​vers-​three-​ secur​ity/​hajime-​mirai-​iot-​botnet-​turf-​war/. Accessed 25 May 2022
zero-​day-​vulne​rabil​ities-​web-​progr​amming-​langu​age-​php-7/. 178. Into the battlefield: a security guide to IoT botnets - Security news.
Accessed 27 Dec 2021 https://​www.​trend​micro.​com/​vinfo/​us/​secur​ity/​news/​inter​net-​of-​
159. Hajime (malware) explained. https://​every​t hing.​expla​i ned.​ things/​into-​the-​battl​efield-​a-​secur​ity-​guide-​to-​iot-​botne​ts. Accessed
today/​Hajime_​(malwa​re)/. Accessed on 27 Dec 2021 26 May 2022
160. Is this IoT malware acting for the greater good? | TechRadar. 179. Sign in risk assessment - new, more-powerful IoT botnet infects
https://​www.​techr​adar.​com/​news/​softw​are/​secur​ity-​softw​are/​ 3,500 devices in 5 days - for all the latest on all it tech like erp,
is-​t his-​I oT-​m alwa​r e-​a cting-​for-​t he-​g reat​e r-​g ood-​1 3059​1 9. cloud, bot, ai, IoT,m2m, netsuite, salesforce. https://​erpin​news.​
Accessed 27 Dec 2021 com/​sign-​r isk-​asses​sment-​new-​power ​ful-​IoT-​botnet-​infec​ts-​
161. Mirai (malware) - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​ 3500-​devic​es-5-​days/. Accessed 26 May 2022
Mirai_​(malwa​re). Accessed 27 Dec 2021 180. NJCCIC threat profile Aidra botnet. https://​w ww.​c yber.​n j.​
162. Necurs - hybrid spam botnet | CERT Polska. https://​cert.​pl/​en/​ gov/​threat-​center/​threat-​profi​les/​botnet-​varia​nts/​aidra-​botnet.
posts/​2016/​09/​necurs-​hybrid-​spam-​botnet/. Accessed 19 Jan 2022 Accessed 26 May 2022
163. Necurs evades detection via internet shortcut file. https://​www.​ 181. Linux.Darlloz - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​Linux.​
trend​micro.​com/​en_​ca/​resea​rch/​18/d/​necurs-​evolv​es-​to-​evade-​spam-​ Darll​oz. Accessed 25 May 2022
detec​tion-​via-​inter​net-​short​cut-​file.​html. Accessed 19 Jan 2022 182. Linux.Darlloz worm-targets Internet of Things | Waredot. https://​
164. Wikipedia Contributors (2021) Linux.Wifatch – Wikipedia, wared​ot.​com/​acade​my/​linux.​darll​oz-​worm-​targe​ts-​inter​net-​of-​
the free encyclopedia. https://​en.​wikip​edia.​org/w/​index.​php?​ things. Accessed 25 May 2022
title=​Linux.​Wifat​ch &​oldid=​10545​63047. Online. Accessed 183. Worm: Linux/Darlloz. A threat description - Microsoft Secu-
19 Jan 2022 rity Intelligence. https://​www.​micro​soft.​com/​en-​us/​wdsi/​threa​ts/​
165. Contributor T. What is an attack surface? - Definition from whatis. malwa​re-​encyc​loped​ia-​descr​iption?​Name=​Worm:​Linux/​Darll​oz.A.
com. https://​whatis.​techt​arget.​com/​defin​ition/​attack-​surfa​ce. Accessed 25 May 2022
Accessed 11 May 2022 184. The Darlloz Linux Worm diversifies to mine cryptocurrencies |
166. White paper-ruckus IoT security. https://​w ww.​c omms​c ope.​ Computerworld. https://​www.​compu​terwo​rld.​com/​artic​le/​24888​28/​
com/​globa​lasse​ts/​digiz​uite/​857777-​wp-​r uckus-​IoT-​secur ​ity.​ the-​darll​oz-​linux-​worm-​diver​sifies-​to-​mine-​crypt​ocurr​encies.​html.
pdf. Accessed 19 Jan 2022 Accessed 25 May 2022
167. Stone R. IoT cellular gateway routers - Do you need one? | Mush- 185. Satori (malware family). https://​malpe​dia.​caad.​fkie.​fraun​hofer.​
room networks. https://​www.​mushr​oomne​tworks.​com/​blog/​IoT-​ de/​detai​ls/​elf.​satori. Accessed 26 May 2022
cellu​lar-​gatew​ay-​route​rs-​what-​are-​they-​and-​do-​you-​need-​one/. 186. Satori IoT botnet variant. https://​www.​radwa​re.​com/​secur ​ity/​
Accessed 21 Dec 2021 ddos-​threa​ts-​attac​ks/​threat-​advis​ories-​attack-​repor ​ts/​satori-​IoT-​
168. Isawa R, Ban T, Tie Y, Yoshioka K, Inoue D (2018) Evaluat- botnet/. Accessed 26 May 2022
ing disassembly-code based similarity between IoT malware 187. ThinkPHP remote code execution vulnerability used to deploy vari-
samples. In: 2018 13th Asia Joint Conference on Information ety of malware (CVE-2018-20062). https://​www.​tenab​le.​com/​blog/​
Security (AsiaJCIS), IEEE, pp 89–94 think​php-​remote-​code-​execu​tion-​vulne​rabil​ity-​used-​to-​deploy-​
169. IoT malware starts showing destructive behavior | CSO Online. varie​ty-​of-​malwa​re-​cve-​2018-​20062. Accessed 26 May 2022
https://​www.​csoon​line.​com/​artic​le/​31884​29/​IoT-​malwa​re-​starts-​ 188. Threat alert: Multiple cryptocurrency miner botnets start to exploit
showi​ng-​destr​uctive-​behav​ior.​html. Accessed 14 Jan 2022 the new thinkPHP vulnerability - Alibaba Cloud Community. https://​
170. Arghire I. ‘Botenago’ malware targets routers, IoT devices with www.​aliba​baclo​ud.​com/​blog/​threat-​alert-​multi​ple-​crypt​ocurr​ency-​
over 30 exploits. https://​www.​secur ​itywe​ek.​com/​boten​ago-​ miner-​botne​ts-​start-​to-​explo​it-​the-​new-​think​php-​vulne​rabil​ity_​
malwa​re-​targe​ts-​route​rs-​IoT-​devic​es-​over-​30-​explo​its#:​~:​text=​ 594369. Accessed 26 May 2022
’Boten​aGo’/. Accessed 16 Jan 2022 189. Tracking the people behind botnets: a list of top 20 IoT blackhat
171. Transmission Control Protocol (TCP) (article) | Khan Acad- hackers | by Newsky Security | Newsky Security. https://​blog.​
emy. https://​www.​khana​cademy.​org/​compu​ting/​compu​ters-​and-​ newsk​ysecu​rity.​com/​track​ing-​the-​people-​behind-​botne​ts-a-​list-​
inter ​net/​xcae6​f4a7f​f 015e​7d:​t he-​inter ​net/​xcae6​f4a7f​f 015e​7d:​ of-​top-​20-​IoT-​black​hat-​hacke​rs-​3a67d​7bd3b​e0. Accessed 26
trans​porti​ng-​packe​ts/a/​trans​missi​on-​contr​ol-​proto​col--​tcp#:​ May 2022
∼: ​ t ext= ​ T he% ​ 2 0Tra ​ n smis ​ s ion% ​ 2 0Con ​ t rol% ​ 2 0Pro ​ t ocol%​ 190. Okane botnet - NHS Digital. https://​digit​al.​nhs.​uk/​cyber-​alerts/​
20(TCP,dupli ​ c ate% ​ 2 0pac​ k ets% ​ 2 C% ​ 2 0and% ​ 2 0cor ​ r upted%​ 2018/​cc-​2555. Accessed 16 May 2022
20pac​kets. Accessed 17 Jan 2022 191. Unit 42 finds new Mirai and Gafgyt IoT/Linux botnet campaigns.
172. Mirai botnet attack IoT devices via CVE-2020-5902. https://​ https://u​ nit42.p​ aloal​ tonet​ works.c​ om/u​ nit42-fi​ nds-n​ ew-m ​ irai-g​ af-
www.​trend​micro.​com/​en_​us/​resea​rch/​20/g/​mirai-​botnet-​attack-​ gyt-​IoTli​nux-​botnet-​campa​igns/. Accessed 16 May 2022
IoT-​devic​es-​via-​cve-​2020-​5902.​html. Accessed 25 May 2022 192. New malware and Mirai botnet variants pose significant threats
173. The Mirai botnet explained: How IoT devices almost brought - Corero | Corero. https://​www.​corero.​com/​blog/​new-​malwa​re-​
down the internet | CSO Online. https://​www.​csoon​line.​com/​ and-​mirai-​botnet-​varia​nts-​pose-​signi​ficant-​threa​ts/. Accessed 11
artic​le/​32587​48/​the-​mirai-​botnet-​expla​ined-​how-​teen-​scamm​ers-​ May 2022
and-​cctv-​camer​as-​almost-​broug​ht-​down-​the-​inter​net.​html. Accessed 193. ZHtrap botnet: How it works and how to prevent it - Infosec
25 May 2022 Resources. https://​resou​rces.​infos​ecins​titute.​com/​topic/​zhtrap-​botnet-​
174. Inside the infamous Mirai IoT botnet: a retrospective analysis. how-​it-​works-​and-​how-​to-​preve​nt-​it/. Accessed 26 May 2022
https://b​ log.c​ loudfl​ are.c​ om/i​ nside-m ​ irai-t​ he-i​ nfamo​ us-i​ ot-b​ otnet-​ 194. ZHtrap botnet uses honeypot to harvest infected devices | APNIC
a-​retro​spect​ive-​analy​sis/. Accessed 25 May 2022 Blog. https://​blog.​apnic.​net/​2021/​05/​04/​zhtrap-​botnet-​uses-​
175. Hajime botnet variant. https://​excha​nge.​xforce.​ibmcl​oud.​com/​colle​ction/​ honey​pot-​to-​harve​st-​infec​ted-​devic​es/. Accessed 26 May 2022
Hajime-​Botnet-​Varia​nt-​857fd​ecabb​dbd6f​8acc8​bf957​f8c70​4a. 195. New ZHtrap botnet malware deploys honeypots to find more
Accessed 25 May 2022 targets. https://​w ww.​b leep​i ngco​mputer.​c om/​n ews/​s ecur ​i ty/​

13
1428 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

new-​zhtrap-​botnet-​malwa​re-​deplo​ys-​honey​pots-​to-​find-​more-​ 216. Wicked botnet uses passel of exploits to target IoT | Threatpost.
targe​ts/. Accessed 26 May 2022 https://​threa​tpost.​com/​wicked-​botnet-​uses-​passel-​of-​explo​its-​to-​
196. Persirai: New IoT botnet targets IP cameras. https://​www.​trend​micro.​ target-​IoT/​132125/. Accessed 17 May 2022
com/​en_​ca/​resea​rch/​17/e/​persi​rai-​new-​inter​net-​things-​IoT-​botnet-​ 217. Wicked Mirai brings new exploits to IoT botnets. https://​www.​
targe​ts-​ip-​camer​as.​html. Accessed 11 May 2022 darkr​eading.​com/​IoT/​wicked-​mirai-​brings-​new-​explo​its-​to-​IoT-​
197. Persirai Botnet - NHS Digital. https://d​ igita​ l.n​ hs.u​ k/c​ yber-a​ lerts/​ botne​ts. Accessed 17 May 2022
2018/​cc-​2805. Accessed 11 May 2022 218. Beltov M. Mirai-based Masuta IoT botnet spreads in a worldwide
198. The Persirai botnet - UHWO Cyber Security. https://​westo​ahu.​ attack. https://​senso​rstec​hforum.​com/​mirai-​based-​masuta-​IoT-​
hawaii.​edu/​cyber/​regio​nal/​gce-​us-​news/​t he-​persi​rai-​botnet/. botnet-​world​wide-​attack/. Accessed 17 Oct 2022
Accessed 11 May 2022 219. New botnet torii showcases next stage of IoT abuse, researchers
199. 120,000 IoT cameras vulnerable to new persirai botnet say researchers say - The Parallax. https://​www.​the-​paral​lax.​com/​new-​botnet-​
| ZDNet. https://​www.​zdnet.​com/​artic​le/​120000-​iot-​camer​as-​vulne​rable- torii-​IoT-​abuse/. Accessed 17 May 2022
​to-​new-​persi​rai-​botnet-​say-​resea​rchers/. Accessed 11 May 2022 220. New IoT botnet Torii uses six methods for persistence, has no clear
200. Gitpaste-12: a new worming botnet with reverse shell capability purpose. https://​www.​bleep​ingco​mputer.​com/​news/​secur​ity/​new-​
spreading via Github and Pastebin | Official Juniper Networks IoT-​botnet-​torii-​uses-​six-​metho​ds-​for-​persi​stence-​has-​no-​clear-​
Blogs. https://b​ logs.j​ unipe​ r.n​ et/e​ n-u​ s/t​ hreat-r​ esear​ ch/g​ itpas​ te-1​ 2. purpo​se/. Accessed 17 May 2022
Accessed 16 May 2022 221. Torii, the latest IoT botnet is worse than Mirai | HOBI International,
201. Gitpaste-12: a dozen exploits that silently lived on Github, Inc. https://​hobi.​com/​torii-​the-​latest-​IoT-​botnet-​to-​watch-​out-​for/​
attacked Linux servers. https://​blog.​sonat​ype.​com/​gitpa​ste-​12. torii-​the-​latest-​IoT-​botnet-​to-​watch-​out-​for/. Accessed 17 May 2022
Accessed 16 May 2022 222. Meet Torii, a new IoT botnet far more sophisticated than mirai
202. NJCCIC threat profile Linux/Moose. https://​www.​cyber.​nj.​ variants | ZDNet. https://​www.​zdnet.​com/​artic​le/​meet-​torii-a-​
gov/​threat-​center/​threat-​profi​les/​botnet-​varia​nts/​linux-​moose. new-​IoT-​botnet-​far-​more-​sophi​stica​ted-​than-​mirai/. Accessed
Accessed 25 May 2022 17 May 2022
203. The moose is loose: Linux-based worm turns routers into social 223. Joven R, Ananin E. DDoS-for-hire service powered by bushido
network bots | Ars Technica. https://a​ rstec​ hnica.c​ om/i​ nform ​ ation-​ botnet. https://​www.​forti​net.​com/​blog/​threat-​resea​rch/​ddos-​for-​
techn​ology/​2015/0​ 5/t​ he-m ​ oose-i​ s-l​ oose-l​ inux-b​ ased-w ​ orm-t​ urns-​ hire-s​ ervic​ e-p​ owere​ d-b​ y-b​ ushid​ o-b​ otnet-. Accessed 17 Oct 2022
route​rs-​into-​social-​netwo​rk-​bots/. Accessed 25 May 2022 224. Smii M. JenX, new IoT botnet. https://​medium.​com/​secju​ice/​
204. Linux/Moose malware makes comeback with new IoT botnet jenx-​new-​IoT-​botnet-​c412d​5a446​ee. Accessed 17 Oct 2022
behind fake instagram, twitter profiles. https://​www.​ibtim​es.​ 225. Miori IoT botnet - NHS Digital. https://​digit​al.​nhs.​uk/​cyber-​
co.​uk/​new-​IoT-​botnet-​behind-​fake-​insta​gram-​twitt​er-​youtu​be-​ alerts/​2019/​cc-​3143. Accessed 16 May 2022
profi​les-​15927​61. Accessed 25 May 2022 226. Mirai malware attack as Miori delivered via RCE exploit. https://​
205. Linux Shishiga malware targeting IoT - information security gbhac​kers.​com/​mirai-​malwa​re-​attack-​miori/. Accessed on 16
buzz. https://​infor ​matio​nsecu​r ityb​uzz.​com/​expert-​comme​nts/​ May 2022
linux-​shish​iga-​malwa​re-​targe​ting-​IoT/. Accessed 23 May 2022 227. Sora botnet. https://​www.​enigm​asoft​ware.​com/​sorab​otnet-​remov​al/.
206. New strain of Linux malware could get serious | TechNewsWorld. Accessed 17 Oct 2022
https://​www.​techn​ewswo​rld.​com/​story/​new-​strain-​of-​linux-​ 228. Analysis of Linux.Omni - Security art work. https://​w ww.​
malwa​re-​could-​get-​serio​us-​84481.​html. Accessed 23 May 2022 secur ​ i tyar ​ t work. ​ e s/ ​ 2 018/ ​ 1 1/ ​ 0 8/ ​ a naly​ s is- ​ o f- ​ l inux- ​ o mni/.
207. Shishiga - Linux malware - NHS Digital. https://​digit​al.​nhs.​uk/​ Accessed 17 May 2022
cyber-​alerts/​2017/​cc-​1384. Accessed 23 May 2022 229. OMNI bot variant discovered in polycom devices - WootCloud
208. Mozi malware modified to present a more potent threat to indus- hypercontext powered security. https://​wootc​loud.​com/​press/​omni-​
trial control systems | The Daily Swig. https://​ports​wigger.​net/​ bot-​varia​nt-​disco​vered-​in-​polyc​om-​devic​es/. Accessed 17 May 2022
daily-​swig/​mozi-​malwa​re-​modif​i ed-​to-​prese​nt-a-​more-​potent-​ 230. FritzFrog botnet returns to attack healthcare, education, govern-
threat- ​ t o- ​ i ndus​ t rial- ​ c ontr​ o l- ​ s yste ​ m s#: ​ ~ : ​ t ext= ​ M ozi% ​ 2 0is%​ ment sectors | ZDNet. https://​www.​zdnet.​com/​artic​le/​fritz​frog-​
20a%​20peer%​2Dto,servi​ce%​20att​acks%​20or%​20send%​20spam. botnet-​ s trik​ e s-​ h ealt​ h care-​ e duca​ t ion-​ g over​ n ment-​ s ecto​ r s/.
Accessed 12 May 2022 Accessed 17 May 2022
209. How to proactively defend against Mozi IoT botnet - Microsoft 231. New FritzFrog P2P botnet has breached at least 500 enterprise,
Security Blog. https://​www.​micro​soft.​com/​secur​ity/​blog/​2021/​ government servers | ZDNet. https://​www.​zdnet.​com/​artic​le/​
08/​1 9/​h ow-​t o-​p roac​t ively-​d efend-​a gain​st-​m ozi-​i ot-​b otnet/. new-​fritz​frog-​p2p-​botnet-​has-​breac​hed-​at-​least-​500-​enter​prise-​
Accessed 12 May 2022 gover​nment-​serve​rs/. Accessed 17 May 2022
210. Cimpanu C. Mozi botnet gains the ability to tamper with its victims’ 232. Botticelli B. IoT honeypots: State of the art botnet. https://​fr.​
traffic. https://​there​cord.​media/​mozi-​botnet-​gains-​the-​abili​ty-​to-​tam- slide​share.​net/​Biagi​oBott​icelli/​state-​of-​the-​art-​IoT-​honey​pots.
per-​with-​its-​victi​ms-​traff​i c/. Accessed 12 May 2022 Accessed 17 Oct 2022
211. This is why the Mozi botnet will linger on | ZDNet. https://w ​ ww.​ 233. Abel R. Hakai and Yowai botnets abuse thinkPHP vulnerabili-
zdnet.​com/​artic​le/​this-​is-​why-​the-​mozi-​botnet-​will-​linger-​on/. ties. https://​www.​scmag​azine.​com/​news/​appli​cation-​secur​ity/​
Accessed 12 May 2022 cyber​crimi​nals-​are-​explo​iting-​vulne​rabil​ities-​in-​the-​think​php-​
212. Carna botnet - Wikipedia. https://​en.​wikip​edia.​org/​wiki/​Carna_​ open-s​ ource-f​ ramew ​ ork-t​ o-e​ xpand-t​ he-h​ akai-a​ nd-y​ owai-b​ otnet​ s.
botnet. Accessed on 26 May 2022 Accessed 17 Oct 2022
213. Carna Botnet - Wikiwand. https://w ​ ww.w ​ ikiwa​ nd.c​ om/e​ n/C ​ arna_​ 234. OMG Mirai variant turns IoT devices into proxy servers - Security
botnet. Accessed 26/May 2022 News. https://​www.​trend​micro.​com/​vinfo/​us/​secur​ity/​news/​inter​net-​
214. Cashdollar L. Latest Echobot: 26 infection vectors. https://​www.​ of-​things/​omg-​mirai-​varia​nt-​IoT-​devic​es-​proxy-​serve​rs. Accessed
akamai.​com/​blog/​secur​ity/​latest-​echob​ot-​26-​infec​tion-​vecto​rs. 16 May 2022
Accessed 10 May 2022 235. OMG botnet, the first Mirai variant that sets up proxy serversSecu-
215. Wicked variant of Mirai botnet emerges | securityweek.com. https://​ rity affairs. https://​secur​ityaf​f airs.​co/​wordp​ress/​69449/​malwa​re/
www.​secur​itywe​ek.​com/​wicked-​varia​nt-​mirai-​botnet-​emerg​es#:​~:​ ​omg-​botnet.​html. Accessed 16 May 2022
text=​Wicked%​20con​tains%​20the%​20str​ing%​20Sor​aLOAD​ER,bot%​ 236. OMG: New Mirai variant converts IoT devices into proxy
2C%​20a%​20dif​f erent%​20Mir​ai%​20var​iant. Accessed 17 May 2022 servers. https://​www.​darkr​eading.​com/​vulne​rabil​ities-​threa​ts/-​

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1429

omg-​new-​mirai-​varia​nt-​conve​rts-​IoT-​devic​es-​into-​proxy-​serve​rs. 257. IoT reaper. https://​rhebo.​com/​en/​servi​ce/​gloss​ar/​IoT-​reaper-​

Accessed 16 May 2022 25113/. Accessed 17 Oct 2022
237. Owari. https://m ​ alped​ ia.c​ aad.f​ kie.f​ raunh​ ofer.d​ e/d​ etail​ s/e​ lf.o​ wari. 258. Elknot. https://​w ww.​e nigm​a soft​ware.​c om/​e lknot-​r emov​a l/.
Accessed 17 Oct 2022 Accessed 17 Oct 2022
238. S, G. Hackers used default/weakest credentials for IoT botnet 259. Elknot. https://​evosec.​eu/​g r1n-​new-​malwa​re-​also-​t arge​ts-​iot-​
command and control server. https://​gbhac​kers.​com/​IoT-​botnet-​ devic​es/. Accessed 17 Oct 2022
owari-​weake​st-​crede​ntial/. Accessed on 17 Oct 2022 260. Karasek J, Augusto Remillano II TB. Multistage attack delivers bill-
239. Genetics of a modern iot attack. https://​cujo.​com/​genet​ics-​of-a-​ gates/setag backdoor. https://​www.​trend​micro.​com/​en_​us/​resea​rch/​
modern-​iot-​attack/. Accessed 17 Oct 2022 19/g/​multi​stage-​attack-​deliv​ers-​billg​ates-​setag-​backd​oor-​can-​turn-​
240. New VPNFilter malware targets at least 500k networking elast​icsea​rch-​datab​ases-​into-​ddos-​botnet-​zombi​es.​html. Accessed
devices worldwide. https://​blog.​t alos​intel​ligen​ce.​com/​2018/​ 17 Oct 2022
05/​VPNFi​lter.​html. Accessed 17 Oct 2022 261. Dominguez K. Karu backdoor. https://​www.​trend​micro.​com/​
241. Apt15’s new backdoors; Two botnets dominate global spam. vinfo/​r u/​threat-​encyc​loped​ia/​malwa​re/​BKDR_​TDSS.​KARU/.
https://​thewa​tchto​wer.​io/​news/​apt15s-​backd​oors-​two-​botne​ts-​ Accessed 17 Oct 2022
domin​ate-​global-​spam/. Accessed 17 Oct 2022 262. Constantin L. Interplanetary storm cross-platform P2P botnet
242. Gamut botnet. https://​www.​spywa​rerem​ove.​com/​remov​egamu​tbotn​et.​ infects computers and IoT devices. https://​www.​csoon​line.​com/​
html. Accessed 17 Oct 2022 artic​le/​35845​28/​inter​plane​tary-​storm-​cross-​platf​orm-​p2p-​botnet-​
243. How to remove Gamut Botnet Trojan from computer. https://​ infec​ts-​compu​ters-​and-​IoT-​devic​es.​html. Accessed 17 Oct 2022
unbox​how.​com/​cyber​secur ​ity/​remove-​gamut-​botnet. Accessed 263. Turjeman E. Threat spotlight: New interplanetary storm variant
on 17 Oct 2022 targeting IoT devices. https://​blog.​barra​cuda.​com/​2020/​10/​01/​
244. Team MDR. Rise in Xorddos: a deeper look at the stealthy ddos threat-s​ potli​ ght-n​ ew-i​ nterp​ lanet​ ary-s​ torm-v​ arian​ t-I​ oT/. Accessed
malware targeting linux devices. https://​www.​micro​soft.​com/​ 17 Oct 2022
secur​ity/​blog/​2022/​05/​19/​rise-​in-​xordd​os-a-​deeper-​look-​at-​the-​ 264. BlueBorne: Bluetooth vulnerabilities expose billions of devices
steal​thy-​ddos-​malwa​re-​targe​ting-​linux-​devic​es/. Accessed 17 to hacking - Nouvelles de Sécurité - Trend Micro FR. https://​
Oct 2022 www.​trend​micro.​com/​vinfo/​fr/​secur​ity/​news/​inter​net-​of-​things/​
245. Spybot worm. https://​en.​wikip​edia.​org/​wiki/​Spybot_​worm. blueb​orne-​bluet​ooth-​vulne​rabil​ities-​expose-​billi​ons-​of-​devic​es-​
Accessed 17 Oct 2022 to-​hacki​ng. Accessed 12 May 2022
246. Meskauskas T. How to remove Win32/Skeeyah malware. https://​ 265. New bluetooth malware affects billions of devices, requires no
www.​pcrisk.​com/​remov​al-​guides/​14739-​win32-​skeey​ah-​trojan. pairing - ExtremeTech. https://​www.​extre​metech.​com/​mobile/​
Accessed 17 Oct 2022 255752-​n ew-​b lueb​o rne-​b luet​o oth-​m alwa​re-​a ffec​t s-​b illi​o ns-​
247. Barrett B. How microsoft dismantled the infamous necurs botnet. devic​es-​requi​res-​no-​pairi​ng. Accessed 12 May 2022
https://​www.​wired.​com/​story/​micro​soft-​necurs-​botnet-​taked​own/. 266. IoT botnet retooled to send email spam. https://​www.​bleep​ingco​mputer.​
Accessed 17 Oct 2022 com/​news/​secur​ity/​iot-​botnet-​retoo​led-​to-​send-​email-​spam/. Accessed
248. Ilascu I. Cr1ptT0r ransomware infects D-link NAS devices, tar- 18 May 2022
gets embedded systems. https://​www.​bleep​ingco​mputer.​com/​ 267. LuaBot Linux/IoT malware. https://e​ xcha​nge.​xforce.​ibmcl​oud.​
news/​secur​ity/​cr1pt​t0r-​ranso​mware-​infec​ts-d-​link-​nas-​devic​es-​ com/​colle​ction/​2b04d​3f76f​6fbd4​b6bc7​e3644​b6e90​f9. Accessed
targe​ts-​embed​ded-​syste​ms/. Accessed 17 Oct 2022 17 Oct 2022
249. Ilascu I. Hades ransomware. https://​digit​al.​nhs.​uk/​cyber-​alerts/​ 268. Paganini P. Luabot is the first linux ddos botnet written in LUA
2021/​cc-​3810. Accessed 17 Oct 2022 language. https://​secur​ityaf​f airs.​co/​wordp​ress/​51155/​malwa​re/​
250. Ilascu I. Hades ransomware. https://​malwa​retips.​com/​blogs/​ linux-​luabot.​html. Accessed 17 Oct 2022
remove-​razor-​virus/. Accessed on 17 Oct 2022 269. Wikipedia: Emotet. https:// ​ e n. ​ w ikip ​ e dia. ​ o rg/ ​ w iki/ ​ E motet.
251. Meskauskas T. How to avoid file encryption by Lulz ransomware. Accessed 17 Oct 2022
https://w​ ww.p​ crisk.c​ om/r​ emova​ l-g​ uides/1​ 6194-l​ ulz-r​ ansom ​ ware. 270. Emotet. https://​www.​malwa​rebyt​es.​com/​emotet. Accessed 17
Accessed 17 Oct 2022 Oct 2022
252. Paganini P. The Muhstik botnet has been observed targeting redis 271. Malwaremustdie analyzes a new IoT malware dubbed Linux/Air-
servers exploiting the recently disclosed CVE-2022-0543 vulner- DropBotSecurity affairs. https://​secur​ityaf​f airs.​co/​wordp​ress/​91905/​
ability. https://​secur​ityaf​f airs.​co/​wordp​ress/​129549/​cyber-​crime/​ malwa​re/​linux-​airdr​opbot-​malwa​re.​html. Accessed 12 May 2022
muhst​ik-​botnet-​targe​ting-​redis-​serve​rs-​using-​recen​tly-​discl​osed-​ 272. Leet IoT botnet bursts on the scene with massive ddos attack
vulne​rabil​ity.​html. Accessed 17 Oct 2022 | Malwaretips Community. https://​malwa​retips.​com/​t hrea​ds/​
253. Arsene L. SSH-targeting Golang bots becoming the new norm. leet-​IoT-​botnet-​bursts-​on-​the-​scene-​with-​massi​ve-​ddos-​attack.​
https://​www.​bitde​fender.​com/​blog/​labs/​ssh-​targe​ting-​golang-​ 67169/. Accessed 12 May 2022
bots-​becom​ing-​the-​new-​norm/. Accessed 17 Oct 2022 273. 650Gbps DDoS attack from Leet Botnet rivals Mirai attacks. https://​
254. Brickerbot malware emerges, permanently bricks IoT devices - www.​bleep​ingco​mputer.​com/​news/​secur​ity/​650gb​ps-​ddos-​attack-​
Security news. https://​www.​trend​micro.​com/​vinfo/​us/​secur​ity/​ from-​leet-​botnet-​rivals-​mirai-​attac​ks/. Accessed 12 May 2022
news/i​ ntern​ et-o​ f-t​ hings/b​ ricke​ rbot-m ​ alwar​ e-p​ erman​ ently-b​ ricks-​ 274. Linux.PnScan - How to protect - PCQuest. https://​www.​pcque​st.​
iot-​devic​es. Accessed 17 May 2022 com/​linux-​pnscan-​how-​to-​prote​ct/. Accessed on 12 May 2022
255. Brickerbot, Mirai and the IoT malware knife fight | Digital guard- 275. Linux.PnScan trojan is back to compromise routers and install
ian. https://​digit​algua​rdian.​com/​blog/​brick​erbot-​mirai-​and-​iot-​ backdoorssecurity affairs. https://​secur​ityaf​f airs.​co/​wordp​ress/​
malwa​re-​knife-​fight. Accessed 17 May 2022 50607/​malwa​re/​linux-​pnscan-​return.​html. Accessed 12 May
256. Brickerbot malware attacks iot devices with permanent denial- 2022
of-service. https://​www.​bitde​fender.​com/​blog/​hotfo​rsecu​r ity/​ 276. Lakshmanan R. Dark nexus: a new emerging IoT botnet malware
brick​erbot-​malwa​re-​attac​ks-​iot-​devic​es-​with-​perma​nent-​denial-​ spotted in the wild. https://​theha​ckern​ews.​com/​2020/​04/​darkn​exus-​
of-​servi​ce?​adobe_​mc=​MCMID%​3D158​04029​63242​55647​61935​ IoT-​ddos-​botnet.​html. Accessed 17 Oct 2022
46223​68495​27380%​7CMCO​RGID%​3D0E9​20C0F​53DA9​E9B0A​ 277. Investigations B, Unit F. New dark Nexus IoT botnet puts others to
490D45%​2540A​dobeO​rg%​7CTS%​3D150​87168​00. Accessed 17 shame. https://​www.​bitde​fender.​com/​files/​News/​CaseS​tudies/​study/​
May 2022 319/​Bitde​fender-​PR-​White​paper-​DarkN​exus-​creat​4349-​en-​EN-​

13
1430 Peer-to-Peer Networking and Applications (2023) 16:1380–1431

inter​active.​pdf?​awc=​15520_​15865​05336_​a71fa​4366a​ed60a​a31d1​ 297. Depuru SK, Madhavi K (2019) Autoencoder integrated deep neural
5670b​42777​3c. Accessed 17 Oct 2022 network for effective analysis of malware in distributed internet of
278. Heads of the Hydra. Malware for network devices. https:// things (IoT) devices. Int J Analytic Experiment Modal Anal
s​ ecure​ list.c​ om/h​ eads-o​ f-t​ he-h​ ydra-m
​ alwar​ e-f​ or-n​ etwor​ k-d​ evice​ s/​ 298. Jeon J, Park JH, Jeong YS (2020) Dynamic analysis for IoT mal-
36396/. Accessed 17 Oct 2022 ware detection with convolution neural network model. IEEE
279. Augusto Remillano II MV. Miori IoT botnet delivered via thinkPH Access 8:96899–96911
exploit. https://​www.​trend​micro.​com/​en_​ca/​resea​rch/​18/l/​with-​ 299. Radhakrishnan G, Srinivasan K, Maheswaran S, Mohanasundaram
mirai-​comes-​miori-​IoT-​botnet-​deliv​ered-​via-​think​php-​remote-​ K, Palanikkumar D, Vidyarthi A (2021) A deep-rnn and meta-
code-​execu​tion-​explo​it.​html. Accessed 17 Oct 2022 heuristic feature selection approach for IoT malware detection.
280. Ares Botnet. https://​www.​enigm​asoft​ware.​com/​aresb​otnet-​remov​al/. Materials Today: Proceedings
Accessed 17 Oct 2022 300. Wozniak M, Silka J, Wieczorek M, Alrashoud M (2021) Recur-
281. Threats to Linux. https://​news.​drweb.​com/​show/​revie​w/?​lng=​ rent neural network model for IoT and networking malware threat
en &i=​9461. Accessed 17 Oct 2022 detection. IEEE Trans Ind Inform 17(8):5583–5594
282. Yaakobi O. QBot malware: What is it and how does it work. 301. Sung Y, Jang S, Jeong YS, Hyuk J et al (2020) Malware clas-
https://​www.​datto.​com/​blog/​qbot-​malwa​re-​what-​is-​it-​and-​how-​ sification algorithm using advanced word2vec-based bi-lstm for
does-​it-​work. Accessed 17 Oct 2022 ground control stations. Comput Commun 153:342–348
283. Backdoor Qbot. https://w ​ ww.m ​ alwar​ ebyte​ s.c​ om/b​ log/d​ etect​ ions/​ 302. Jeon J, Jeong B, Baek S, Jeong YS (2021) Hybrid malware detection
backd​oor-​qbot. Accessed 17 Oct 2022 based on bi-lstm and spp-net for smart IoT. IEEE Trans Ind Inform
284. Ilgayev A. An old bot’s nasty new tricks: Exploring qbot’s latest 303. Van CN, Phan VA, Nguyen KDT et al (2020) IoT malware detec-
attack methods. https://​resea​rch.​check​point.​com/​2020/​explo​ring-​ tion based on latent representation. In: 2020 12th International
qbots-​latest-​attack-​metho​ds/. Accessed 17 Oct 2022 Conference on Knowledge and Systems Engineering (KSE),
285. Silex malware bricks IoT devices with weak passwords - Nouvelles IEEE, pp 177–182
de Sécurité - Rrend Micro FR. https://​www.​trend​micro.​com/​vinfo/​fr/​ 304. Mahmoudyar N, Ghorbani AA, Lashkari AH. Graph-based IoT
secur​ity/​news/​cyber​crime-​and-​digit​al-​threa​ts/-​silex-​malwa​re-​bricks-​ malware family classification. https://​unbsc​holar.​lib.​unb.​ca/​
IoT-​devic​es-​with-​weak-​passw​ords. Accessed 12 May 2022 islan​dora/​object/​unbsc​holar%​3A105​68/​datas​tream/​PDF/​view.
286. Joker. https://​www.​bsi.​bund.​de/​EN/​Themen/​Verbr​auche​rinnen-​ Accessed 3 Feb 2023
und-​Verbr​aucher/​Cyber-​Siche​rheit​slage/​Metho​den-​der-​Cyber-​ 305. Lee YT, Ban T, Wan TL, Cheng SM, Isawa R, Takahashi T,
Krimi​nalit​aet/​Botne​tze/​Steck​briefe-​aktue​ller-​Botne​tze/​Steck​briefe/​ Inoue D (2020) Cross platform IoT-malware family classifica-
Joker/​Joker.​html. Accessed 17 Oct 2022 tion based on printable strings. 2020 IEEE 19th International
287. Cimpanu C (2018) New Exo android Trojan sold on hacking forums, Conference on Trust. Security and Privacy in Computing and
dark web. https://​www.​bleep​ingco​mputer.​com/​news/​secur​ity/​new-​ Communications TrustCom, IEEE, pp 775–784
exo-​andro​id-​trojan-​sold-​on-​hacki​ng-​forums-​dark-​web/. Accessed 11 306. Hossain MM, Al Noor S, Karim Y, Hasan R (2017) IoTbed: a
May 2022 generic architecture for testbed as a service for internet of things-
288. For 8 years, a hacker operated a massive IoT Botnet just to down- based systems. In: ICIoT, pp 42–49
load anime videos | ZDNet. https://​www.​zdnet.​com/​artic​le/​for-8-​ 307. Hakim MA, Aksu H, Uluagac AS, Akkaya K (2018) U-pot: a hon-
years-a-​hacker-​opera​ted-a-​massi​ve-​iot-​botnet-​just-​to-​downl​oad-​ eypot framework for upnp-based IoT devices. In: 2018 IEEE 37th
anime-​videos/. Accessed 12 May 2022 International Performance Computing and Communications Confer-
289. New HEH botnet can wipe routers and IoT devices | ZDNet. https://​ ence (IPCCC), pp 1–8. https://​doi.​org/​10.​1109/​PCCC.​2018.​87113​21
www.​zdnet.​com/​artic​le/​new-​heh-​botnet-​can-​wipe-​route​rs-​and-​IoT-​ 308. Krishna RR, Priyadarshini A, Jha AV, Appasani B, Srinivasulu
devic​es/. Accessed 12 May 2022 A, Bizon N (2021) State-of-the-art review on IoT threats and
290. The HEH virus - Telsy. https://​www.​telsy.​com/​the-​heh-​virus/, attacks: Taxonomy, challenges and solutions. Sustainability
Accessed 12 May 2022 13(16). https://​doi.​org/​10.​3390/​su131​69463, https://​www.​mdpi.​
291. Carrillo-Mondejar J, Castelo Gomez JM, Nunez-Gomez C, com/​2071-​1050/​13/​16/​9463
Roldan-Gomez J, Martinez JL (2020) Automatic analysis architec- 309. Khraisat A, Alazab A (2021) A critical review of intrusion
ture of IoT malware samples. Secur Commun Netw 2020:8810708. detection systems in the Internet of Things: Techniques, deploy-
https://​doi.​org/​10.​1155/​2020/​88107​08 ment strategy, validation strategy, attacks, public datasets and
292. Yong B, Liu X, Yu Q, Huang L, Zhou Q (2019) Malicious web challenges. Cybersecurity 4(1):18. https://​doi.​org/​10.​1186/​
traffic detection for Internet of Things environments. Comput s42400-​021-​00077-7
Electric Eng 77:260–272 310. Nath R, Nath HV (2022) Critical analysis of the layered and
293. Tran NP, Nguyen NB, Ngo QD, Le VH (2017) Towards malware systematic approaches for understanding IoT security threats and
detection in routers with c500-toolkit. In: 2017 5th International Con- challenges. Comput Electric Eng 100:107997
ference on Information and Communication Technology (ICoIC7), 311. Qamar A, Karim A, Chang V (2019) Mobile malware attacks:
IEEE, pp 1–5 Review, taxonomy & future directions. Futur Gener Comput Syst
294. Cheng SM, Ban T, Huang JW, Hong BK, Inoue D (2020) Elf 97:887–909
analyzer demo: Online identification for IoT malwares with mul- 312. Williams P, Rojas P, Bayoumi M (2019) Security taxonomy
tiple hardware architectures. In: 2020 IEEE Security and Privacy in IoT - a survey. In: 2019 IEEE 62nd International Midwest
Workshops (SPW), IEEE, pp 126–126 Symposium on Circuits and Systems (MWSCAS), pp 560–565.
295. Dovom EM, Azmoodeh A, Dehghantanha A, Newton DE, Parizi https://​doi.​org/​10.​1109/​MWSCAS.​2019.​88849​13
RM, Karimipour H (2019) Fuzzy pattern tree for edge malware 313. Khanam S, Ahmedy IB, Idna Idris MY, Jaward MH, Sabri Bin
detection and categorization in IoT. J Syst Architect 97:1–7 Md AQ (2020) A survey of security challenges, attacks taxonomy
296. Khoda ME, Imam T, Kamruzzaman J, Gondal I, Rahman A (2019) and advanced countermeasures in the Internet of Things. IEEE
Robust malware defense in industrial IoT applications using machine Access 8:219709–219743. https://​doi.​org/​10.​1109/​ACCESS.​
learning with selective adversarial samples. IEEE Trans Ind Appl 2020.​30373​59
56(4):4415–4424

13
Peer-to-Peer Networking and Applications (2023) 16:1380–1431 1431

314. Mishra N, Pandya S (2021) Internet of Things applications, secu- Publisher's Note Springer Nature remains neutral with regard to
rity challenges, attacks, intrusion detection, and future visions: a jurisdictional claims in published maps and institutional affiliations.
systematic review. IEEE Access 9:59353–59377. https://​doi.​org/​
10.​1109/​ACCESS.​2021.​30734​08 Springer Nature or its licensor (e.g. a society or other partner) holds
315. Explainable AI - XAI. https://w ​ ww.i​ bm.c​ om/w
​ atson/e​ xplai​ nable-​ exclusive rights to this article under a publishing agreement with the
ai. Accessed 3 Jan 2023 author(s) or other rightsholder(s); author self-archiving of the accepted
316. Saad S, Briguglio W, Elmiligi H (2019) The curious case of manuscript version of this article is solely governed by the terms of
machine learning in malware detection. Proceedings of the 5th such publishing agreement and applicable law.
International Conference on Information Systems Security and
Privacy. https://​doi.​org/​10.​5220/​00074​70705​280535

13