Abstract:The number of Cyber-Physical Systems (CPS) available in industrial environments is growing mainly due to the evolution of the Internet-of-Things (IoT) paradigm. In such a context, radio frequency spectrum sensing in industrial scenarios is one of the most interesting applications of CPS due to the scarcity of the spectrum. Despite the benefits of operational platforms, IoT spectrum sensors are vulnerable to heterogeneous malware. The usage of behavioral fingerprinting and machine learning has shown merit in detecting cyberattacks. Still, there exist challenges in terms of (i) designing, deploying, and evaluating ML-based fingerprinting solutions able to detect malware attacks affecting real IoT spectrum sensors, (ii) analyzing the suitability of kernel events to create stable and precise fingerprints of spectrum sensors, and (iii) detecting recent malware samples affecting real IoT spectrum sensors of crowdsensing platforms. Thus, this work presents a detection framework that applies device behavioral fingerprinting and machine learning to detect anomalies and classify different botnets, rootkits, backdoors, ransomware and cryptojackers affecting real IoT spectrum sensors. Kernel events from CPU, memory, network, file system, scheduler, drivers, and random number generation have been analyzed, selected, and monitored to create device behavioral fingerprints. During testing, an IoT spectrum sensor of the ElectroSense platform has been infected with ten recent malware samples (two botnets, three rootkits, three backdoors, one ransomware, and one cryptojacker) to measure the detection performance of the framework in two different network configurations. Both supervised and semi-supervised approaches provided promising results when detecting and classifying malicious behaviors from the eight previous malware and seven normal behaviors. In particular, the framework obtained 0.88–0.90 true positive rate when detecting the previous malicious behaviors as unseen or zero-day attacks and 0.94–0.96 F 1-score when classifying them.

Compromised IoT Devices Detection in Smart Home via Semantic Information

SeIoT: Detecting Anomalous Semantics in Smart Homes Via Knowledge Graph

A lightweight and efficient IoT intrusion detection method based on feature grouping

Detecting Abnormal Events on Binary Sensors in Smart Home Environments

Detecting Compromised IoT Devices Using Autoencoders with Sequential Hypothesis Testing

Semantic Framework Of Internet Of Things For Smart Cities: Case Studies

Discovering and Understanding the Security Hazards in the Interactions between IoT Devices, Mobile Apps, and Clouds on Smart Home Platforms

Automated Security Assessment for the Internet of Things

Machine Learning for the Detection and Identification of Internet of Things (IoT) Devices: A Survey

Machine Learning for the Detection and Identification of Internet of Things Devices: A Survey

Hybrid Intrusion Detection System for Internet of Things (IoT)

A Supervised Intrusion Detection System for Smart Home IoT Devices

IoT Behavioral Monitoring via Network Traffic Analysis

DÏoT: A Federated Self-learning Anomaly Detection System for IoT

Trusted Edge Computing System Based on Intelligent Risk Detection for Smart IoT

Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT

Cross-App Interference Threats in Smart Homes: Categorization, Detection and Handling

Enhancing Cybersecurity in IoT Networks: A Deep Learning Approach to Anomaly Detection

Intelligent and behavioral-based detection of malware in IoT spectrum sensors

Machine Learning-Based Non-Intrusive Digital Forensic Service for Smart Homes.

IoTBeholder: A Privacy Snooping Attack on User Habitual Behaviors from Smart Home Wi-Fi Traffic.