Statistical Analysis of CPU Power Consumption for Detecting DGA Botnet Command and Control Communication
Zul-Azri Ibrahim, Saiful Adli Ismail, Fiza Abdul Rahim, Muhammad Hazim Bin Abas, Muhammad Idris Bin Khairul Anuar, Aiman Harith Bin Azwan · 2024
Domain Generation Algorithms (DGA) Botnets represent a significant threat to network security due to their ability to mask Command and Control (C&C) communications with botmaster. Traditional detection methods like domain blacklists have struggle to keep pace with the dynamic nature of these botnets. This research explores an alternative detection approach by investigating the use of CPU power consumption as an indicator for detecting DGA botnet in Internet of Things (IoT) devices. The power consumption data was collected and analyzed from a testbed comprising infected Raspberry Pi devices with DGA-based botnets. Statistical methods that include Analysis of Variance (ANOVA) and post-hoc tests, were used to determine if significant differences in CPU power consumption exist across the botnet phases. The results show that CPU power consumption is significantly higher during both the C&C and attack phases compared to normal operation. Additionally, the attack phase exhibits greater power consumption variance, suggesting unstable resource utilization. These findings highlight the potential of using power consumption data as a key metric for identifying botnet activities in IoT systems.