Mirai Botnet DDoS Attack Simulation Using Build Your Own Botnet (BYOB)

Abstract:

The Mirai botnet malware creates a botnet by compromising Internet of Things (IoT) devices, including cameras and digital video recorders that are linked to a network. Individually, IoT devices lack significant processing power; however, when a vast number of these devices are utilized together, it becomes feasible to commence a high-powered attack. Mirai mutations are generated daily and continue to proliferate, inflict damages resulting in distributed denial-of-service (DDoS) attack which maliciously attempt to disrupt a server service or network traffic by flooding the target infrastructure with excessive amount of Internet traffic, using intrusion methods as the original malware is indicative of IoT device vendors’ chronic neglect in applying even basic security practices. To understand how Mirai operates, we used the Build Your Own Botnet (BYOB) variant to simulate a botnet attack. The BYOB source code was setup and deployed in a controlled lab environment to simulate botnet-driven DDoS attacks against our IoT devices communicating over AMQP using RabbitMQ sever. The simulation resulted in memory usage increase from 682M/5.79G before attack to 1.71G/5.79G during attack. This indicates system stress exerted on the IoT ecosystem by bots from the Mirai botnet attack, thereby reducing the performance of the IoT devices and making it unresponsive.

• Periodical: Engineering Headway (Volume 37)
• Pages: 101-112
• DOI: https://doi.org/10.4028/p-In0njh
• Online since: March 2026
• Authors: Stanley Olumayowa Imadu*, Braimoh Abdullahi Ikharo, Bello O. Lawal, Sunday Aigbiniode Lawani
• Keywords: Attack, Botnet, Malware, Mirai, Variant

References

[1] Cloudflare, What is aDDoS attack? (2024). https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/

[2] S. O. Imadu, S.A Lawani, P. U. Chinedu, B. A. Ikharo , Queuing System in E-commerce: An approach to Strengthen its Security, 2023 2nd International Conference on Multidisciplinary Engineering and Applied Science (ICMEAS),Abuja, Nigeria. (2023) 1-6.

DOI: 10.1109/ICMEAS58693.2023.10379219

[3] T. Arumuga Maria Devi, M. Arunima and K. Rooban Prakash, DDoS Attack using Botnets, International Journal of Engineering Research & Technology (IJERT), ICCIDT - 2022 Conference Proceedings. Special Issue. 10(04) (2022) 277-279.

[4] The Huy Nguyen This research report, tthreat Research Note, Mirai and its common attack method. (2023). https://6483172.fs1.hubspotusercontent-na1.net/hubfs/6483172/collateral/ threat-research/corero-threat-research-mirai.pdf.

[5] Mamoru Saito and Minoru Kobayashi, Mirai Botnet Detection and Countermeasures. Internet Initiative Japan Inc, Infrastructure Seecurity IIR. 33(2016).

[6] Constantinos Kolias and Georgios Kambourakis, Angelos Stavrou, and Jeffrey Voas. 2017. DDoS in the IoT: Mirai and other botnets", https://www.researchgate.net/publication/ 318288727Computer 50, 2 (2017) 80–84

DOI: 10.1109/mc.2017.201

[7] Burair Saad Hameed, Selvakumar Manickam and Kamal Alieyan, Internet of Things Botnet (mirai): A systematic review. (2019)

[8] Evan Cooke, Farnam Jahanian, and Danny McPherson, The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets, SRUTI 5 (2005)

[9] Jing Wang and Ioannis Ch Paschalidis, Botnet detection based on anomaly and community detection, IEEE Transactions on Control of Network Systems 4, 2 (2016) 392–404

DOI: 10.1109/tcns.2016.2532804

[10] Stijn Pletinckx, Cyril Trap, and Christian Doerr, Malware coordination using the blockchain: An analysis of the cerber ransomware", In 2018 IEEE Conference on Communications and Network Security (CNS). (2018).

DOI: 10.1109/cns.2018.8433199

[11] Constantinos Kolias, Georgios Kambourakis, Angelos Stavrou, and Jeffrey Voas, DDoS in the IoT: Mirai and other botnets, Computer 50, 7 (2017) 80–84

DOI: 10.1109/mc.2017.201

[12] Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Understanding the mirai botnet, In 26th USENIX Security Symposium. (2017) 1093–1110.

[13] Orcun Çetin, Carlos Ganán, Lisette Altena, Takahiro Kasama, Daisuke Inoue, Kazuki Tamiya, Ying Tie, Katsunari Yoshioka, and Michel van Eeten, Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai", In NDSS. (2019). https://www.ndss-symposium.org/ndss-paper/cleaning-up-the-internet-of-evil-things-real-world-evidence-on-isp-and-consumer-efforts-to-remove-mirai/.

DOI: 10.14722/ndss.2019.23438

[14] Giovanni Bottazzi and Gianluigi Me, The botnet revenue model, In Proceedings of the 7th International Conference on Security of Information and Networks. (2014). https://www.researchgate.net/publication/279852221_The_Botnet_Revenue_Model.

DOI: 10.1145/2659651.2659673

[15] Hugo LJ Bijmans, Tim M Booij, and Christian Doerr, Just the Tip of the Iceberg: Internet-Scale Exploitation of Routers for Cryptojacking, In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. (2019)449-464.

DOI: 10.1145/3319535.3354230

[16] Hwanjo Heo and Seungwon Shin, Who is knocking on the telnet port: A large-scale empirical study of network scanning", In Proceedings of the 2018 on Asia Conference on Computer and Communications Security. (2018) 625–636.

DOI: 10.1145/3196494.3196537

[17] Krebs on Security, Krebs On Security Hit with Record DDoS, (https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/).

[18] GitHub, (2024). https://github.com/malwaredllc/byob

[19] Harm Griffioen and Christian Doerr, Examining Mirai's Battle over the Internet of Things, Conference on Computer and Communications Security. (2020). ReseasrchGate, https://www.researchgate.net/publication/346593167.

DOI: 10.1145/3372297.3417277

[20] Virus Info A tweet reporting on the status of the DDoS. OVH (2019). (https://twitter.com/olesovhcom/status/779297257199964160).