Immune-Based Botnet Defense System: Multi-Layered Defense and Immune Memory

This paper proposes a novel defense mechanism inspired by the bioimmune response to effectively eliminate botnets that repeatedly infect IoT networks and describes the development of an Immune-Based Botnet Defense System (iBDS), incorporating this mechanism. Focusing on the roles of antibodies and phagocytes in the immune response, the iBDS implements a multi-layered defense using two types of worms: antibody worms and phagocyte worms. When a malicious botnet infects a network, the resident phagocyte worms immediately infect and eliminate the bots and prevent the infection from spreading in its early stages. This provides an immediate response in a similar way to innate immunity. On the other hand, if a malicious botnet infects the network and the phagocyte worms are unable to infect the bots, the antibody worms, instead, infect the bots and change their vulnerabilities to help the phagocyte worms infect and eliminate them. This provides an adaptive response in a similar way to acquired immunity. In addition, when the same botnet is repeatedly infected, more antibody worms are used to produce a stronger response, similar to immune memory. The introduction of multi-layered defense and immune memory is an important novelty of this paper that is not found in traditional botnet defense system research. The experimental results from simulations and prototype implementations show that iBDS can effectively eliminate botnets that repeatedly infect IoT networks.