A preprint describes a system that found more live command-and-control (C2) servers used by botnets than Baseline 2 when both were given the same probing budget. At 1 million IP-address-and-port checks, BotScan identified 37 live servers, compared with 21 for Baseline 2. Once four live seed hosts were excluded, the count of new servers was 33 for BotScan and 17 for Baseline 2.
The system is intended to actively search for live botnet C2 servers at scale. It generates replay packets from activated malware, profiles historical C2 locations and port use, and adapts which IP segments and ports it probes first.
A search shaped by malware behavior
The main sample contained 1,842 IoT malware binaries: 1,347 Mirai, 368 Gafgyt, 19 Kaiji, 12 Mozi, 31 Hajime, 43 Tsunami and 22 listed as unknown. The accuracy benchmark contained 800 benign servers and 528 C2 servers.
Replay-based probing was feasible for at least 72% of the 1,842 binaries in the Fixed and Custom categories. In all, 1,634 binaries activated and 1,536 established a TCP handshake, equivalent to activation and handshake rates of 89% and 84%.
Historical profiling found strong C2-server locality within a /24 subnet, with the pattern dropping off quickly beyond that range. BotScan combines that signal with port use to prioritize IP segments and ports.
Strong precision, incomplete coverage
On the reported ground-truth evaluation, BotScan had 98.8% precision, 74.8% recall and an F1-score of 85.0%. These are point estimates; the paper reports no confidence intervals or independent benchmark.
In a retrospective emulation, the researchers searched a 16-million-IP space containing 207 historically reported C2 servers. They used 20 random servers as seeds and sought the remaining 187; at a budget of 550,000 IP-and-port checks, the high-priority BotScan-Hi version was reported to outperform Baseline 2 by about two to one. This was an emulation using historical data, rather than a live probe of that target space.
In the resource comparison, each BotScan IP-and-port task used 0.38% CPU, 11.86 megabytes of memory and 0.65 seconds. C2Miner used 6.24% CPU, 142.41 megabytes and 28.78 seconds per task; the paper reports 16-fold, 11-fold and 45-fold savings for CPU, memory and duration.
For a 10-million-task workload, the paper estimated 15 hours and $5 for BotScan, versus 304 days and $2,330 for C2Miner. The estimate depends on deployment and parallelism assumptions and excludes common-port discovery.
Repeated checks uncovered more servers
In the first case study, BotScan searched 68,000 IP addresses and found 382 live C2 servers. Of those, 194 were outside the seed set, and 64 were not reported by any of the three compared threat-intelligence feeds. The method detected C2 servers from five major families.
In a second case study, 38 selected subnets were probed every two days for 20 days. The median server response rate was one in 10 probes. Repeated probing found 514 additional live C2 servers, including 48 unreported servers; across the two case studies, the total was 896 live servers, including 112 unreported servers.
What remains unclear
The authors say replay-based detection may not cover sophisticated session-specific encryption and that flaky C2 responsiveness can limit active detection. The temporal result itself is described as an indication rather than an empirical rule.
The manuscript is a preprint identified as arXiv:2608.23854v2 and dated 26 August 2026. The authors say the BotScan tool and probing pipeline, replay signatures, C2 IP-and-port pairs and malware hashes are available through anonymous artifacts, while the malware files themselves are not shared.
Paper data and sources
Original title: BotScan: An adaptive active probing approach for identifying live IoT Botnet C2 servers at scale
Authors: S M Maksudul Alam, Vivek Jain, Zhaowei Tan et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-24
DOI: Not available
Original paper · Full text