A Process Mining Approach for Supporting IoT Predictive Security

Abstract

The growing interest for the Internet-of-Things (IoT) is supported by the large-scale deployment of sensors and connected objects. These ones are integrated with other Internet resources in order to elaborate more complex and value-added systems and applications. While important efforts have been done for their protection, security management is a major challenge for these systems, due to their complexity, their heterogeneity and the limited resources of their devices. In this paper we introduce a process mining approach for detecting misbehaviors in such systems. It permits to characterize the behavioral models of IoT-based systems and to detect potential attacks, even in the case of heterogenous protocols and platforms. We then describe and formalize its underlying architecture and components, and detail a proof-of-concept prototype. Finally, we evaluate the performance of this solution through extensive experiments based on real industrial datasets.

An Ensemble Learning-Based Architecture for Security Detection in IoT Infrastructures

“…First, a clustering technique is used on the refined data in order to extract the states of the observed system, then a process mining algorithm is applied to build the behavior models of this system. This approach has been described in details in [24]. These different detection methods provide an individual score, noted s i , as previously mentioned.…”

“…Methods such as local outlier factor [21] consider the sparsity of data, and evaluate the density of a point based on its nearest data points. Finally, solutions such as isolation forest [22] rely on the building of specific trees to classify data points, and techniques based on process mining consist in establishing the normal class based on an extracted process pattern [23], [24]. These individual detection methods will be further detailed in the paper, as they will be considered to establish our ensemble learning-based approach for IoT infrastructures.…”

Digital twins as run-time predictive models for the resilience of cyber-physical systems: a conceptual framework

“…In the field of process mining applied to CPS resilience, reference [ 29 ] proposes a framework to detect anomalies from event data coming from the edge, based on process discovery from available data. After a model is retrieved, additional data are collected and each trace, i.e.…”

Comparative Assessment of Process Mining for Supporting IoT Predictive Security

“…In this paper, we evaluate the exploitability and performance of a process mining approach for detecting misbehaviors in IoT networks. This is an extended version of our work published in [11] where we overview this approach and its architecture, with the generation of behavioral models and the detection of potential attacks. We complement these efforts, with the formalization of four other categories of commonlyused detection methods, including elliptic envelope, supportvector machine, local outlier factor, and isolation forest techniques.…”