ANALYSIS OF IOT MALWARE DARKNET TRAFFIC USING ASSOCIATIVE RULES

Kulikov Alexander Anatolievich, Kravtsova Yekaterina Yuryevna, Platoshin Alexander Igorevich

This research paper examines the issues of cybersecurity in the context of the development of information technology and the Internet of Things (IoT - Internet of Things). Due to the increasing frequency of cyber-attacks in today's world, including the use of malicious software Mirai for IoT, it is necessary to develop mechanisms to detect cyber-attacks occurring on the Internet. Thus, the paper proposes the use of an anonymous network to detect cyber-attacks, as it is a system of virtual tunnels in which packets are generated by malware. Statistical methods and associative rule learning are used to analyze the behavior of scanning attacks based on the packets observed in the Darknet. Particular attention is paid to TCP SYN packets that characterize scanning attacks. The paper discusses the principles of anonymous networking, IP addresses, and the characteristics of the Mirai malware for IoT. The basic concepts used in finding associative rules, such as support and confidence, are also discussed, and the FP-Growth/FP-tree algorithm is proposed for finding such rules. A large set of TCP SYN packets collected by the NICT/16 Darknet sensor was used to evaluate the proposed method. The results show that the proposed method is efficient and can be used to find associative rules in large databases. The algorithm parameters and strategies for determining them to obtain the best results are also discussed. The research can be useful for developing new mechanisms for detecting cyber-attacks and improving cybersecurity.

Keywords:darknet; cyberattacks; Mirai; analysis using associative rule learning, darknet, anonymous network, IoT