Identification of Mirai Botnet in IoT Environment through Denial-of-Service Attacks for Early Warning System

Alam Rahmatulloh - Siliwangi University, Tasikmalaya, Indonesia
Galih Muhammad Ramadhan - Siliwangi University, Tasikmalaya, Indonesia
Irfan Darmawan - Telkom University, Bandung, Indonesia
Nur Widiyasono - Siliwangi University, Tasikmalaya, Indonesia
Dita Pramesti - Telkom University, Bandung, Indonesia

Citation Format:



The development of computing technology in increasing the accessibility and agility of daily activities currently uses the Internet of Things (IoT). Over time, the increasing number of IoT device users impacts access and delivery of valuable data. This is the primary goal of cybercriminals to operate malicious software. In addition to the positive impact of using technology, it is also a negative impact that creates new problems in security attacks and cybercrimes. One of the most dangerous cyberattacks in the IoT environment is the Mirai botnet malware. The malware turns the user's device into a botnet to carry out Distributed Denial of Service (DDoS) attacks on other devices, which is undoubtedly very dangerous. Therefore, this study proposes a k-nearest neighbor algorithm to classify Mirai malware-type DDOS attacks on IoT device environments. The malware classification process was carried out using rapid miner machine learning by conducting four experiments using SYN, ACK, UDP, and UDPlain attack types. The classification results from selecting five parameters with the highest activity when the device is attacked. In order for these five parameters to be a reference in the event of a malware attack starting in the IoT environment, the results of the classification have implications for further research. In the future, it can be used as a reference in making an early warning innovative system as an early warning in the event of a Mirai botnet attack.


Classification; DDOS; Internet of Things; k-nearest neighbor; Mirai botnet.

Full Text:



A. A. Karia, L. V. Budhwani, and V. S. Badgujar, “IoT-Key Towards Automation,†2018 International Conference on Smart City and Emerging Technology, ICSCET 2018, pp. 1–5, 2018. DOI: 10.1109/ICSCET.2018.8537261

A. Rahmatulloh, F. M. S. Nursuwars, I. Darmawan, and G. Febrizki, “Applied Internet of Things ( IoT ): The Prototype Bus Passenger Monitoring System Using PIR Sensor,†in 2020 8th International Conference on Information and Communication Technology (ICoICT), 2020, pp. 617–622.

F. M. S. Nursuwars and A. Rahmatulloh, “RFID for nurse activity monitoring in the hospital’s nurse call system with Internet of Thing (IoT) concept,†in IOP Conference Series: Materials Science and Engineering, 2019, vol. 550, p. 012025 [Online]. DOI: 10.1088/1757-899X/550/1/012025

A. Rahmatulloh, R. Gunawan, H. Sulastri, I. Pratama, and I. Darmawan, “Face Mask Detection using Haar Cascade Classifier Algorithm based on Internet of Things with Telegram Bot Notification,†in 2021 International Conference Advancement in Data Science, E-learning and Information Systems (ICADEIS), 2021, pp. 1–6. DOI: 10.1109/ICADEIS52521.2021.9702065

N. Widiyasono, A. Rahmatulloh, and H. Firmansah, “Automatic Email Alert on the Internet of Things-based Smart Motion Detection System,†in Selected Papers from the 1st International Conference on Islam, Science and Technology, ICONISTECH-1 2019, 11-12 July 2019, Bandung, Indonesia, 2020. DOI: 10.4108/eai.11-7-2019.2297829

K. Angrishi, “Turning Internet of Things(IoT) into Internet of Vulnerabilities (IoV) : IoT Botnets,†Feb. 2017 [Online]. Available:

E. Bertino and N. Islam, “Botnets and Internet of Things Security,†Computer, vol. 50, no. 2, pp. 76–79, Feb. 2017. DOI: 10.1109/MC.2017.62

C. Kolias, G. Kambourakis, A. Stavrou, and J. Voas, “DDoS in the IoT: Mirai and Other Botnets,†Computer, vol. 50, no. 7, pp. 80–84, 2017. DOI: 10.1109/MC.2017.201

G. B. Gunawan, P. Sukarno, and A. G. Putrada, “Pendeteksian SeranganDenial of Service(DoS) pada Perangkat Smartlock Berbasis WifiMenggunakan SNORT IDS,†e-Proceeding of Engineering, vol. 5, no. 3, 2018.

O. Toutsop, S. Das, and K. Kornegay, “Exploring The Security Issues in Home-Based IoT Devices Through Denial of Service Attacks,†in 2021 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computing, Scalable Computing & Communications, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/IOP/SCI), 2021, pp. 407–415. DOI: 10.1109/SWC50871.2021.00062

A. Marzano et al., “The Evolution of Bashlite and Mirai IoT Botnets,†in 2018 IEEE Symposium on Computers and Communications (ISCC), 2018, pp. 00813–00818. DOI: 10.1109/ISCC.2018.8538636

M. Antonakakis et al., “Understanding the Mirai Botnet,†in Proceedings of the 26th USENIX Security Symposium, 2017.

A. Čolaković and M. Hadžialić, “Internet of Things (IoT): A review of enabling technologies, challenges, and open research issues,†Computer Networks, vol. 144, pp. 17–39, 2018 [Online]. DOI: 10.1016/j.comnet.2018.07.017

K. B. Aswathi, S. Jayadev, N. Krishna, R. Krishnan, and G. Sarath, “Botnet Detection using Machine Learning,†in 2021 12th International Conference on Computing Communication and Networking Technologies (ICCCNT), 2021, pp. 1–7. DOI: 10.1109/ICCCNT51525.2021.9579508

“Mirai IoT botnet code release raises fears of surge in DDoS attacks.†[Online]. Available:

H.-D. Huang, T.-Y. Chuang, Y.-L. Tsai, and C.-S. Lee, “Ontology-based intelligent system for malware behavioral analysis,†in International Conference on Fuzzy Systems, 2010, pp. 1–6. DOI: 10.1109/FUZZY.2010.5584325

D. P. Ismi, S. Panchoo, and M. Murinto, “K-means clustering based filter feature selection on high dimensional data,†International Journal of Advances in Intelligent Informatics, vol. 2, no. 1, p. 38, Mar. 2016. DOI: 10.26555/ijain.v2i1.54

B. Abraham, A. Mandya, R. Bapat, F. Alali, D. E. Brown, and M. Veeraraghavan, “A Comparison of Machine Learning Approaches to Detect Botnet Traffic,†in 2018 International Joint Conference on Neural Networks (IJCNN), 2018, pp. 1–8. DOI: 10.1109/IJCNN.2018.8489096

Y. Meidan et al., “N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders,†May 2018 [Online]. DOI: 10.1109/MPRV.2018.03367731

T. P. Setia, A. P. Aldya, and N. Widiyasono, “Reverse Engineering untuk Analisis Malware Remote Access Trojan,†Jurnal Edukasi dan Penelitian Informatika (JEPIN), vol. 5, no. 1, p. 40, Apr. 2019. DOI: 10.26418/jp.v5i1.28214

S. Nomm and H. Bahsi, “Unsupervised Anomaly Based Botnet Detection in IoT Networks,†in 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), 2018, pp. 1048–1053. DOI: 10.1109/ICMLA.2018.00171