Correlating compromised home internet of things devices with distributed denial of service attacks

A method comprising:

• in response to a distributed denial of service (“DDoS”) attack, determining, by a DDoS attack profiler executed by a home gateway system, a plurality of DDoS attack properties for the DDoS attack, wherein the DDoS attack utilizes an Internet of Things (“IoT”) device operating in communication with the home gateway system;
• creating, by the DDoS attack profiler, based upon the DDoS properties, a DDoS attack profile for the DDoS attack, wherein the DDoS attack profile comprises a devices in use property indicating a set of devices relied on by the DDoS attack;
• providing, by the DDoS attack profiler, a DDoS attack report to a correlator, wherein the DDoS attack report is based upon the DDoS attack profile;
• determining, by an IoT device profiler, a plurality of IoT device properties for the IoT device, wherein determining the plurality of IoT device properties for the IoT device is based, at least in part, on a basic IT device profile received from a basic IoT device profile repository, wherein the basic IoT device profile comprises information associated with IoT devices operating in communication with other home gateway systems that are similar to the IoT device operating in communication with the home gateway system;
• creating, by the IoT device profiler, based upon the plurality of IoT device properties, an IoT device profile for the IoT device;
• providing, by the IoT device profiler, an anomaly report to an anomalies repository, wherein the anomaly report identifies an anomaly associated with the IoT device based upon the IoT device profile;
• receiving, by the correlator, the DDoS attack report from the DDoS attack profiler and the anomaly report from the anomalies repository;
• correlating, by the correlator, the DDoS attack report with the anomaly report to determine if a match exists;
• and
• in response to determining that the match exists, storing a bot match record in a bot match repository.

A computer-readable storage medium comprising computer-executable instructions that, when executed by a processor of a home gateway system, cause the processor to perform operations comprising:

• in response to a distributed denial of service (“DDoS”) attack, determining, by a DDoS attack profiler, a plurality of DDoS attack properties for the DDoS attack, wherein the DDoS attack utilizes an Internet of Things (“IoT”) device operating in communication with the home gateway system;
• creating, by the DDoS attack profiler, based upon the DDoS properties, a DDoS attack profile for the DDoS attack, wherein the DDoS attack profile comprises a devices in use property indicating a set of devices relied on by the DDoS attack;
• providing, by the DDoS attack profiler, a DDoS attack report to a correlator, wherein the DDoS attack report is based upon the DDoS attack profile;
• determining, by an IoT device profiler, a plurality of IoT device properties for the IoT device, wherein determining the plurality of IT device properties for the IoT device is based, at least in part, on a basic IoT device profile received from a basic IoT device profile repository, wherein the basic IoT device profile comprises information associated with IoT devices operating in communication with other home gateway systems that are similar to the IoT device operating in communication with the home gateway system;
• creating, by the IoT device profiler, based upon the plurality of IoT device properties, an IoT device profile for the IoT device;
• providing, by the IoT device profiler, an anomaly report to an anomalies repository, wherein the anomaly report identifies an anomaly associated with the IoT device based upon the IoT device profile;
• receiving, by the correlator, the DDoS attack report from the DDoS attack profiler and the anomaly report from the anomalies repository;
• correlating, by the correlator, the DDoS attack report with the anomaly report to determine if a match exists;
• and
• in response to determining that the match exists, storing a bot match record in a bot match repository.