Abstract:IoT networks are increasingly becoming target of sophisticated new cyber-attacks. Anomaly-based detection methods are promising in finding new attacks, but there are certain practical challenges like false-positive alarms, hard to explain, and difficult to scale cost-effectively. The IETF recent standard called Manufacturer Usage Description (MUD) seems promising to limit the attack surface on IoT devices by formally specifying their intended network behavior. In this paper, we use SDN to enforce and monitor the expected behaviors of each IoT device, and train one-class classifier models to detect volumetric attacks. Our specific contributions are fourfold. (1) We develop a multi-level inferencing model to dynamically detect anomalous patterns in network activity of MUD-compliant traffic flows via SDN telemetry, followed by packet inspection of anomalous flows. This provides enhanced fine-grained visibility into distributed and direct attacks, allowing us to precisely isolate volumetric attacks with microflow (5-tuple) resolution. (2) We collect traffic traces (benign and a variety of volumetric attacks) from network behavior of IoT devices in our lab, generate labeled datasets, and make them available to the public. (3) We prototype a full working system (modules are released as open-source), demonstrates its efficacy in detecting volumetric attacks on several consumer IoT devices with high accuracy while maintaining low false positives, and provides insights into cost and performance of our system. (4) We demonstrate how our models scale in environments with a large number of connected IoTs (with datasets collected from a network of IP cameras in our university campus) by considering various training strategies (per device unit versus per device type), and balancing the accuracy of prediction against the cost of models in terms of size and training time.

FlowSpotter: Intelligent IoT Threat Detection Via Imaging Network Flows

A Proactive Model for Intrusion Detection Using Image Representation of Network Flows

A lightweight and efficient IoT intrusion detection method based on feature grouping

Ethics and the anti‐dementia drugs

A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild

Efficient Attack Detection in IoT Devices using Feature Engineering-Less Machine Learning

Realguard: A Lightweight Network Intrusion Detection System for IoT Gateways

Flow Topology-Based Graph Convolutional Network for Intrusion Detection in Label-Limited IoT Networks

Your Smart Home Can't Keep a Secret: Towards Automated Fingerprinting of IoT Traffic with Neural Networks

Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT

IoTa: Fine-Grained Traffic Monitoring for IoT Devices Via Fully Packet-Level Models

IoT-KEEPER: Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the Edge

Detecting Anomalous Microflows in IoT Volumetric Attacks via Dynamic Monitoring of MUD Activity

AI-based Two-Stage Intrusion Detection for Software Defined IoT Networks

A Novel Deep Learning-Based Intrusion Detection System for IoT Networks

HorusEye: A Realtime IoT Malicious Traffic Detection Framework using Programmable Switches

Enhancing IoT Security: A Novel Feature Engineering Approach for ML-Based Intrusion Detection Systems

MASiNet: Network Intrusion Detection for IoT Security Based on Meta-Learning Framework

IoTFlowGenerator: Crafting Synthetic IoT Device Traffic Flows for Cyber Deception

Machine learning-based early detection of IoT botnets using network-edge traffic

Distributed Deep Neural-Network-Based Middleware for Cyber-Attacks Detection in Smart IoT Ecosystem: A Novel Framework and Performance Evaluation Approach