A ZigBee honeypot to assess IoT cyberattack behaviour

Dowling, Seamus; Schukat, Michael; Melvin, Hugh

doi:10.1109/issc.2017.7983603

Cited by 62 publications

(29 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These devices (or software) record malicious activities so that attack vectors and patterns can be further investigated. Given that ZigBee-based IoT devices are actively used in smart cities settings [74], the honeypot that simulates a Zig-Bee gateway proposed by Dowling et al [75] is instrumental to explore attacks against smart cities. After 3-month of monitoring the activity that has targeted the ZigBee gateway, the researchers reported 6 types of executed attacks.…”

Section: Risk Assessment and Threat Intelligencementioning

confidence: 99%

A survey of methods supporting cyber situational awareness in the context of smart cities

et al. 2020

View full text Add to dashboard Cite

A modern urban infrastructure no longer operates in isolation, but instead, leverages the latest technologies to collect, process, and distribute aggregated knowledge in order to improve the quality of the provided services and promote the efficiency of resource consumption. This technological development, however, manifests in the form of new vulnerabilities and a plethora of attack vectors. In the same context, the ambiguity of ever-evolving cyber threats and their debilitating consequences introduce new barriers for decision-makers. Therefore, cyber situational awareness of smart cities emerges as a mission-critical task that requires support methods for effective and timely decision-making. In this article, we investigate the threat landscape of smart cities, survey and reveal the progress in data-driven methods for situational awareness and evaluate their effectiveness when addressing various cyber threats. We draw several potential research directions that aim at advancing cyber situational awareness in the context of smart cities.

show abstract

Section: Risk Assessment and Threat Intelligencementioning

confidence: 99%

A survey of methods supporting cyber situational awareness in the context of smart cities

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Therefore, the article proposes honeypot creation by considering probabilistic estimation of honeypot detection. A Zigbee gateway-based honeypot is created in [29], as most of the IoT devices use this protocol at data link layer. The honeypot captures traffic for analysis and compares the individual versus mass attacks in the IoT system.…”

Section: Honeypots For the Iot Networkmentioning

confidence: 99%

Reputation Management Using Honeypots for Intrusion Detection in the Internet of Things

Khan

Abbasi

2020

Electronics

View full text Add to dashboard Cite

Internet of Things (IoT) networks consist of tiny devices with limited processing resources and restricted energy budget. These devices are connected to the world-wide web (www) using networking protocols. Considering their resource limitations, they are vulnerable to security attacks by numerous entities on the Internet. The classical security solutions cannot be directly implemented on top of these devices for this reason. However, an Intrusion Detection System (IDS) is a classical way to protect these devices by using low-cost solutions. IDS monitors the network by introducing various metrics, and potential intruders are identified, which are quarantined by the firewall. One such metric is reputation management, which monitors the behavior of the IoT networks. However, this technique may still result in detection error that can be optimized by combining this solution with honeypots. Therefore, our aim is to add some honeypots in the network by distributing them homogeneously as well as randomly. These honeypots will team up with possible maliciously behaving nodes and will monitor their behavior. As per the simulation results, this technique reduces the error rate within the existing IDS for the IoT; however, it costs some extra energy. This trade-off between energy consumption and detection accuracy is studied by considering standard routing and MAC protocol for the IoT network.

show abstract

“…-Phype [31]: that emulates a Telnet service in order to capture IoT malware, -HoneyThing [32]: emulates a specific IoT protocol: TR-069 (CPE WAN Management Protocol), -IoTPOT [6]: offers a front-end emulating access to a high interaction environment, called IoTBOX, that virtualizes different CPU architectures commonly used by IoT devices, -ZigBee honeypot [33]: emulates a ZigBee gateway, -Multi-purpose IoT honeypot [34]: emulates multiple protocols used by IoT devices such as Telnet, SSH, HTTP, and CWMP.…”

Section: Iot Honeypot Systemsmentioning

confidence: 99%

On the rewards of self-adaptive IoT honeypots

et al. 2019

View full text Add to dashboard Cite

In an era of fully digitally interconnected people and machines, IoT devices become a real target for attackers. Recent incidents such as the well-known Mirai botnet, have shown that the risks incurred are huge and therefore a risk assessment is mandatory. In this paper we present a novel approach on collecting relevant data about IoT attacks. We detail a SSH/Telnet honeypot system that leverages reinforcement learning algorithms in order to interact with the attackers, and we present the results obtained in view of defining optimal reward functions to be used. One of the key issues regarding the performance of such algorithms is the direct dependence on the reward functions used. The main outcome of our study is a full implementation of an IoT honeypot system that leverages Apprenticeship Learning using Inverse Reinforcement Learning, in order to generate best suited reward functions.

show abstract

A ZigBee honeypot to assess IoT cyberattack behaviour

Cited by 62 publications

References 11 publications

A survey of methods supporting cyber situational awareness in the context of smart cities

A survey of methods supporting cyber situational awareness in the context of smart cities

Reputation Management Using Honeypots for Intrusion Detection in the Internet of Things

On the rewards of self-adaptive IoT honeypots

Contact Info

Product

Resources

About