Early-stage detection of botnets during their spreadingphase, before any attack, is fundamental to IoT security.Recently introduced lightweight memory networks represent thestate of the art in this domain. However, they require a centralsystem to capture and analyze all traffic in the network, whichmay not always be feasible in real-world scenarios.In this paper, we introduce a decentralized and collaborativealternative, in which the IoT devices themselves are responsiblefor this task without any central observer or coordinator. Ourresults show that the performance of this novel approach iscompetitive with similar centralized solutions, despite the lackof a global view of the network at any participating device.We also provide an extensive analysis of the security limitationsof our fully-decentralized detection system. We identify thepotential exploits that an attacker may attempt to perform, assesstheir impact on the IoT network as well as propose and evaluateeffective countermeasures.

QC 20230405