The recent surge in large-scale Distributed Denial-of-Service (DDoS) attacks, primarily driven by Internet of Things (IoT) botnets, has drawn significant concerns. Defending against IoT botnet DDoS attacks is challenging, especially as attackers’ techniques and strategies become increasingly sophisticated. We propose a novel traffic-level differential game model from holistic and dynamic perspectives to address these challenges, integrating both the botnet formation and DDoS attack stages. Based on the actual operation mechanism of IoT botnet DDoS attacks, we extract two key attack features: 1) the incubation period of infected devices and 2) the threshold effects of DDoS attacks. Considering these, the proposed model more effectively captures the dynamic strategic behaviors of attackers and defenders. Using optimal control theory, we derive the optimal timing and frequency for attackers to activate latent devices and for defenders to restore compromised ones. Numerical simulations show the effectiveness of our defense strategy under both traditional and intelligent attack scenarios, reducing the payoff function of the attack-defense system by approximately 48% compared to static and adaptive strategies. Additionally, we examine the impact of key parameters on network security, providing valuable insights for developing effective defense strategies against botnet-driven DDoS attacks.

Many interconnected terminals in the Internet of Things (IoT) networks raise significant security risks. From a competitive perspective, the many heterogeneous nodes, including various wireless terminals, access points, and base stations are the competing targets between the defenders and potential attackers. This article proposes a security competition model based on the game theory to address the security competition problem. The model has two players, a defender and an attacker, who allocate resources to each IoT node according to their strategies. A novel metric, security entropy, derived from the security probability, quantifies each node’s security status. Based on the node heterogeneity, the overall security performance of the considered IoT network is evaluated with a topology-determined weighted security entropy. The defender and the attacker, respectively, aim to decrease and increase the weighted security entropy while balancing the cost, which constitutes their utility functions. The existence of the unique Nash equilibrium is proved. A best response selection algorithm for the optimal solutions is designed. The experimental results demonstrate that the proposed model effectively represents the goal orientation and interaction between the attackers and defenders in various scenarios. Additionally, increasing the cost for the attackers significantly reduces their resource allocation, especially to the attackers leading to a decrease in the system’s security entropy.