On Collective Reboot to Mitigate Botnet Threats in Low-Observability IoT Networks

In order to exterminate botnets that have infected IoT devices, we proposed a method of rebooting on a per-area basis rather than on a per-device basis. We were able to confirm that this method can efficiently disinfect a botnet by rebooting an entire area that has been significantly infected by a self-propagating and repeatedly occurring botnet and boldly recovering the area. However, not all botnets are observable. Therefore, we propose an effective countermeasure in IoT networks with low observability. In IoT networks with low observability, some Bots frequently evade disinfection by frequently moving back and forth between the boundaries of the regions where they are collectively rebooted. Therefore, by defining the boundary of the region as a special region, we can prevent bots from frequently coming and going on the boundary and improve the disinfection efficiency. Simulation results confirmed that this method can suppress the number of botnets to about 20% or less of the total number of botnets in most steps.