Modeling and Evaluation of Mitigation Methods against IoT Malware Mirai with Agent-Oriented Petri Net PN2

In this paper, we proposed a model of the infection phenomenon of an IoT malware called Mirai. We regarded the infection phenomenon as a multi-agent system and expressed it with agent-oriented Petri net called as Petri nets in a Petri net (PN2 for short). Some mitigation methods have been proposed such as rebooting infected devices and using an IoT worm called as Hajime which blocks Mirai. We reflected the methods into the PN2 model, and evaluated the methods of the model. Our results show that: 1) by rebooting the infected devices, we can drastically reduce Mirai's infection rate when the delay is zero. The effect, however, is rapidly lost with the increase of the delay; 2) Hajime reduces Mirai's infection rate to less than half without depending on the delay of reboot. The reduction rate, however, gradually decreases with the increase of the initial number of Hajime.