A longitudinal Measurement and Analysis Study of Mozi, an Evolving P2P IoT Botnet.

Due to the remarkable diversity and ubiquity of IoT devices, many IoT botnets like Mirai and Hajime are inclined to infect vulnerable embedded devices to achieve the purpose of scale expansion and future attacks. Nowadays, a novel, evolving P2P botnet in the wild, named Mozi, targets numerous devices but substantially differs in many aspects involving self-proliferation, network control, and distribution situations. To uncover the curtain, throughout detailed measurement–a novel active probing approach (namely Bawa) for tracking Mozi’s dynamic topology infrastructure and passive collection of Mozi binaries and its download URLs, we provide a holistic view of Mozi, including its scale and geographic distribution. The dataset ¹ collected in a passive mode is available to assist in tracking and mitigating the Mozi botnet’s expansion.