The proliferation of IoT devices which can be more easily compromised than desktop computers has led to an increase in the occurrence of IoT-based botnet attacks. In order to mitigate this new threat there is a need to develop new methods for detecting attacks launched from compromised IoT devices and differentiate between hour and millisecond long IoT-based attacks. In this paper we propose and empirically evaluate a novel network-based anomaly detection method which extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic emanating from compromised IoT devices. To evaluate our method, we infected nine commercial IoT devices in our lab with two of the most widely known IoT-based botnets, Mirai and BASHLITE. Our evaluation results demonstrated our proposed method's ability to accurately and instantly detect the attacks as they were being launched from the compromised IoT devices which were part of a botnet.

The Internet of Things (IoT) is a global ecosystem of information and communication technologies aimed at connecting any type of object (thing), at any time and in any place, to each other and to the Internet. One of the major problems associated with the IoT is maintaining security; the heterogeneous nature of such deployments poses a challenge to many aspects of security, including security testing and analysis. In addition, there is no existing mechanism that performs security testing for IoT devices in different contexts. In this paper, we propose an innovative security testbed framework targeted at IoT devices. The security testbed supports both standard and context-based security testing, with a set of security tests conducted under the different environmental conditions in which IoT devices operate. The requirements and architectural design of the proposed testbed are discussed, and the testbed operation is demonstrated in several testing scenarios. CCS Concepts• Security and privacy➝Systems Security➝Vulnerability management • Computing methodologies➝Machine learning.

In this work we apply machine learning algorithms on network traffic data for accurate identification of IoT devices connected to a network. To train and evaluate the classifier, we collected and labeled network traffic data from nine distinct IoT devices, and PCs and smartphones. Using supervised learning, we trained a multi-stage meta classifier; in the first stage, the classifier can distinguish between traffic generated by IoT and non-IoT devices. In the second stage, each IoT device is associated a specific IoT device class. The overall IoT classification accuracy of our model is 99.281%. CCS Concepts •Security and privacy → Mobile and wireless security; •Computing methodologies → Machine learning;

No abstract