Mirai Benchmark in IoT Security and Forecasting

• Mirai Benchmark is a framework encompassing evaluation protocols for IoT botnet detection and LLM-based event forecasting, with standardized setups in controlled environments.
• It measures key metrics such as infection probability, scanning rate, and mean time-to-compromise to assess IoT device vulnerabilities effectively.
• Recent adaptations extend its use to agentic frameworks for temporal event forecasting, broadening research impact beyond traditional IoT security.

The term "Mirai Benchmark" encompasses a spectrum of evaluation protocols and datasets across several research domains, primarily IoT security and, independently, LLM-based event forecasting. Historically, the most prominent use of "Mirai Benchmark" is in the context of experimental evaluations and detection strategies for Mirai-family IoT botnet malware. In more recent literature, the term has also denominated agentic frameworks for temporal event forecasting ("MIRAI" as Multi-Information Forecasting Agent Interface) with no relation to IoT. This article presents both primary interpretations, focusing on their technical protocols, metrics, and research impact.

1. Mirai Benchmark for IoT Security Research

The Mirai Benchmark in IoT botnet research defines standardized experimental setups for evaluating both the infection process and detection/hardening strategies for devices vulnerable to Mirai-class malware. The core goals are to measure infection rate, time-to-compromise, effectiveness of security countermeasures, and early detection performance in large-scale networks (Kelly et al., 2020, Tushir et al., 2021, Kumar et al., 2019).

Key Experimental Components

Typical Mirai Benchmarks include:

• Vulnerable Device Set: A mix of commodity IoT endpoints (e.g., embedded BusyBox Linux IP cameras, Raspberry Pi-based nodes).
• Attacker Emulation: Original or lightly patched Mirai source code, including Telnet and SSH brute-force, command-and-control logic, and loader routines.
• Controlled Network Environment: Layer-2 isolated or bridged lab networks (e.g., /24 LAN segments) to constrain infections.
• Primary Metrics:
  • $P_{\text{infect}} = \frac{n}{N}$ — Infection probability over a fixed window $\Delta T$.
  • $R_s = \frac{S}{T_s}$ — Scanning rate in distinct hosts/sec.
  • $\overline{T_c}$ — Mean time-to-compromise per susceptible device.
• Secondary Metrics: Host CPU, energy, memory, I/O load during both infection and attack stages.

2. IoT Mirai Benchmark Results: Quantitative Findings

Reproducible Mirai benchmarks yield consistent findings:

• Attack Success: Across studies, default-configured consumer IoT devices exhibit $P_{\text{infect}} \approx