The rise of the Internet of Things (IoT) has led to the deployment of a wide range of smart devices in homes, enterprises, and cities. However, these devices also pose significant privacy and security challenges that are not present in traditional IT networks. The lack of visibility into IoT assets makes it difficult for operators to detect cyber-attacks or ensure that each device is functioning properly. To address this issue, researchers have developed techniques for profiling the network behavioral patterns of IoTs, automating their classification, deducing their operating context, and detecting anomalous behavior indicative of cyber-attacks. In this thesis by Arunan Sivanathan, the author surveys the IoT ecosystem while reviewing current approaches to vulnerability assessments, intrusion detection, and behavioral monitoring. The first contribution involves collecting traffic traces and characterizing the network behavior of IoT devices via attributes from traffic patterns. A robust machine learning-based inference engine is then developed using these attributes to demonstrate real-time classification of 28 IoT devices with over 99% accuracy. The second contribution enhances classification by reducing the cost of attribute extraction while identifying IoT device states. Prototype implementation and evaluation demonstrate the ability of supervised machine learning methods to detect behavioral changes for five IoT devices. The third and final contribution develops a modularized unsupervised inference engine that dynamically accommodates new IoT devices or updates to existing ones without requiring system-wide retraining. Experiments show that this model can automatically detect attacks and firmware changes in ten IoT devices with over 94% accuracy. Overall, this thesis provides valuable insights into how network traffic analysis can be used to monitor the behavior of IoTs and improve their security posture. By automating device classification and detecting anomalous behavior in real-time, operators can better protect their smart environments from potential cyber threats.
- Smart devices are being used more and more in homes, businesses, and cities because of the rise of IoT.
- IoT devices can have problems with privacy and security that regular IT networks don't have.
- It's hard to know if an IoT device is working properly or if it's being attacked by hackers because they are difficult to monitor.
- Researchers have found ways to use machine learning to detect abnormal behavior in IoT devices that could indicate a cyber-attack.
- A person named Arunan Sivanathan wrote a thesis about how to assess the security of IoT devices using network traffic analysis.
Definitions
- IoT: Internet of Things - a network of physical objects (devices, vehicles, buildings) that are connected and able to exchange data
- Cyber-attack: an attempt by hackers to damage or disrupt computer systems or networks
- Machine learning: a type of artificial intelligence where machines learn from data without being explicitly programmed
The Rise of the Internet of Things (IoT): Understanding the Security Challenges
The Internet of Things (IoT) is a rapidly growing technology that has enabled the deployment of smart devices in homes, enterprises, and cities. However, these devices also pose significant privacy and security challenges that are not present in traditional IT networks. To address this issue, Arunan Sivanathan’s thesis investigates current approaches to vulnerability assessments, intrusion detection, and behavioral monitoring for IoT systems.
Vulnerability Assessments
One major challenge with IoT systems is their lack of visibility into assets which makes it difficult for operators to detect cyber-attacks or ensure that each device is functioning properly. To overcome this problem, Sivanathan proposes collecting traffic traces and characterizing the network behavior of IoT devices via attributes from traffic patterns. A robust machine learning-based inference engine can then be developed using these attributes to demonstrate real-time classification of 28 IoT devices with over 99% accuracy.
Intrusion Detection
Sivanathan's second contribution involves enhancing classification by reducing the cost of attribute extraction while identifying IoT device states. Prototype implementation and evaluation demonstrate the ability of supervised machine learning methods to detect behavioral changes for five IoT devices. This approach allows operators to better monitor their networks for potential intrusions or malicious activity before they occur.
Behavioral Monitoring
Finally, Sivanathan develops a modularized unsupervised inference engine that dynamically accommodates new IoT devices or updates to existing ones without requiring system-wide retraining. Experiments show that this model can automatically detect attacks and firmware changes in ten IoT devices with over 94% accuracy. This provides an efficient way for operators to keep track of their smart environments without needing manual intervention every time a change occurs on the network level.
In conclusion, Sivanthan's research provides valuable insights into how network traffic analysis can be used to monitor the behavior of IoTs and improve their security posture by automating device classification and detecting anomalous behavior in real-time . By leveraging these techniques , organizations can better protect themselves from potential cyber threats while taking advantage of all the benefits offered by modern connected technologies .
Smart homes, enterprises, and cities are increasingly being equipped with a plethora of Internet of Things (IoT), ranging from smart-lights to security cameras. While IoT networks have the potential to benefit our lives, they create privacy and security challenges not seen with traditional IT networks. Due to the lack of visibility, operators of such smart environments are not often aware of their IoT assets, let alone whether each IoT device is functioning properly safe from cyber-attacks. This thesis is the culmination of our efforts to develop techniques to profile the network behavioral pattern of IoTs, automate IoT classification, deduce their operating context, and detect anomalous behavior indicative of cyber-attacks. We begin this thesis by surveying IoT ecosystem, while reviewing current approaches to vulnerability assessments, intrusion detection, and behavioral monitoring. For our first contribution, we collect traffic traces and characterize the network behavior of IoT devices via attributes from traffic patterns. We develop a robust machine learning-based inference engine trained with these attributes and demonstrate real-time classification of 28 IoT devices with over 99% accuracy. Our second contribution enhances the classification by reducing the cost of attribute extraction while also identifying IoT device states. Prototype implementation and evaluation demonstrate the ability of our supervised machine learning method to detect behavioral changes for five IoT devices. Our third and final contribution develops a modularized unsupervised inference engine that dynamically accommodates the addition of new IoT devices and/or updates to existing ones, without requiring system-wide retraining of the model. We demonstrate via experiments that our model can automatically detect attacks and firmware changes in ten IoT devices with over 94% accuracy.
