Abstract
In mitigating Internet of Things (IoT) botnet propagation, infected nodes are recovered via vaccination or patching,however, recovered nodes are liable to the same malware reinfections since bots often tide with the new exploits. Hence, in the absence of effective vaccines or treatment, it is realistic to mitigate IoT botnet propagation using an epidemic modelling approach. While current mitigation models in IoT botnets propagation do not take into account the efficiency of the of the infected nodes, In this paper, an epidemic based model (Infectious-Abandoned-Forensic (IoT-SIAF)) model is proposed. IoT-SIAF is a model inspired by the epidemic models to select or abandon infected nodes in mitigating botnet propagation. In addition to other influential factors, the IoT-SIAF model takes into consideration the memory availability of the infected nodes to determine its suitability for classification as an object of forensic interest. Furthermore, we demonstrate the capability of the IoT-SIAF model in mitigating at botnet equilibrium points.