Ilmu Komputer & AI editorial
BotScan: An adaptive active probing approach for identifying live IoT Botnet C2 servers at scale
The core problem
The proliferation of IoT botnets has created an urgent need for scalable methods to identify their live command-and-control (C2) servers. Traditional takedown and measurement efforts often rely on passive traffic observation or PC-centric assumptions about botnet communication, which may not hold for modern IoT malware. The authors pose a central question: **How can we actively search and identify live C2 servers of botnets at scale?** The scalability requirement imposes strict constraints on both computation and the number of probing packets that can be sent, making brute-force scanning of large IP spaces impractical.
BotScan addresses this gap by actively probing a large IP space to find the highest possible number of live C2 servers. Its design is motivated by two empirically established insights. First, contrary to popular PC-centric observations, many modern IoT botnet communication protocols use packets with minimal customization, a pattern observed across six major malware families. Second, C2 servers exhibit exploitable behavioral patterns, most notably strong spatial locality. These insights enable a streamlined, replay-based probing approach that is both efficient and ef
Innovation
The authors validate BotScan using **1,842 recently collected IoT binaries** and explore a target space of **2.5 million IP addresses**. Two headline results emerge. First, a replay-based method is applicable for **at least 72%** of the malware binaries, confirming that minimal-customization C2 protocols are widespread across the sampled families. This high replayability rate substantiates the first insight and enables broad, automated probing without per-binary reverse engineering.
Second, BotScan **outperforms baseline methods by finding approximately double the live C2 servers for the same number of probes**. This efficiency gain is critical at scale, where probe budgets are constrained by network resources and detection risk. The improvement is attributed to the behavior-adaptive, segment-centric strategy, which concentrates effort on high-yield regions rather than uniformly scanning the IP space.
In addition, the authors conduct **two case studies** that identify **896 live servers**, including **112 unreported C2 servers**. These unreported servers represent previously unknown infrastructure, demonstrating BotScan's practical value for threat intelligence and takedown opera
Why it matters
The findings carry several implications for IoT botnet defense. The high replayability of C2 protocols (≥72% of binaries) suggests that many IoT botnets prioritize operational simplicity over sophisticated evasion, a departure from PC-centric assumptions. This creates opportunities for lightweight, replay-based active probing that can be deployed at scale without extensive protocol emulation. The observed spatial locality of C2 servers further implies that botnet infrastructure is not uniformly distributed, and that adaptive, segment-centric strategies can achieve substantial efficiency gains.
The two-level segment-centric approach and dynamic adaptation together address the core scalability challenge: maximizing live C2 discovery under a fixed probe budget. Formally, the adaptive strategy approximates a solution to the budget allocation problem by iteratively updating segment priorities based on observed success rates, effectively performing a form of online optimization. This is analogous to multi-armed bandit strategies, where segments are arms and probe success is the reward.
Limitations include the reliance on replayable protocols; the 28% of binaries where replay is not applicable may require alternative probing methods. Additionally, spatial locality patterns may evolve as botnet operators adapt to detection. Future work could integrate passive signals with active probing, extend the taxonomy to emerging families, and explore adversarial countermeasures. Nonetheless, BotScan demonstrates that active, behavior-adaptive probing can significantly enhance the identification of live IoT botnet C2 servers, providing a scalable tool for defenders and researchers.
Who should read this
Opening member content…