Brief Industry Paper: Catching IoT Malware in the Wild Using HoneyIoT

Constantly increasing botnets powered by vulnerable IoT devices perform record-breaking DDoS attacks to critical infrastructures. Therefore, it is imperative to find vulnerabilities in IoT devices ahead of attackers. In this paper, we first present a systematic analysis on various kinds of IoT malware to further explore the challenges of IoT Honeypot design. We then propose HoneyIoT, a scalable IoT Honeypot framework, which aims at attracting IoT attacks and recording malicious behaviors with configurable vulnerabilities and firmware support. During a 7day real-world industrial experiment, HoneyIoT observed over 12,500 malicious connections and 3,423 distinct login attempts.