An Accurate Security Game for Low-Resource IoT Devices

Abstract

International audienceThe Internet of Things (IoT) technology incorporates a large number of heterogeneous devices connected to untrusted networks. Nevertheless, securing IoT devices is a fundamental issue due to the relevant information handled in IoT networks. The intrusion detection system (IDS) is the most commonly used technique to detect intruders and acts as a second wall of defense when cryptography is broken. This is achieved by combining the advantages of anomaly and signature detection techniques, which are characterized by high detection rates and low false positives, respectively. To achieve a high detection rate, the anomaly detection technique relies on a learning algorithm to model the normal behavior of a node, and when a new attack pattern (often known as signature) is detected, it will be modeled with a set of rules. This latter is used by the signature detection technique for attack confirmation. Activating the anomaly detection technique simultaneously at each lowresource IoT device and all the time could generate a high-energy consumption. Thereby, we propose a game theoretic technique to activate anomaly detection technique only when a new attack’s signature is expected to occur; hence a balance between detection and false positive rates, and energy consumption is achieved. Even by combining between these two detection techniques, we observed that the number of false positives is still non null (almost equal to 5%). Thereby, to decrease further the false positive rate, a reputation model based on game theory is proposed. Simulation results show that this lightweight anomaly detection outperforms current anomaly detection techniques, since in scaling mode (i.e., when the number of IoT devices and attackers are high) it requires low energy consumption to detect the attacks with high detection and low false positive rates, almost 93% and 2%, respectively

Towards a Secure Internet of Things: A Comprehensive Study of Second Line Defense Mechanisms

“…The second approach is where the sensor nodes detect intrusions alongside their normal operations. This approach involves the process of continuous self and neighbor inspection, and is discussed in [72], [84], [93], [127], [131], [137], [145]- [147]. In [135], the network is composed of an hierarchical structure, where the nodes are classified as free, leader, and member or associated nodes.…”

COLIDE: a collaborative intrusion detection framework for Internet of Things

“…A number of trust based systems have also been proposed that compute the reputation of devices by considering the social connectivity network of devices and similarity measure between device feedback [46,47,48]. In [49], authors proposed a game theory based technique to perform the anomaly detection in the IoT network by matching the attack signature. The authors further developed the reputation model based on the game theory to minimize the false positive rate incurred because of signature matching.…”

Uma abordagem leve para detecção de DDoS a partir de roteadores domésticos

“…Existe uma vasta literatura sobre mecanismos de detecção de DDoS [McDermott et al 2018, Kuhnert et al 2018, Dash and Craven 2017, De Carli et al 2017, considerando pontos de detecção no núcleo da rede [Silveira et al 2011, Liaskos et al 2016, Mazel et al 2015, Nevat et al 2018, Pena et al 2017, nos hosts de rede [Sedjelmaci et al 2017, Summerville et al 2015] e na borda [Doshi et al 2018, Meidan et al 2018, Ozcelik et al 2017.…”

“…Em [Sedjelmaci et al 2017, Summerville et al 2015, os autores propõem soluções para detectar ataques nos hosts da rede. Embora tais métodos sejam eficazes para localizar e isolar botnets, sua execução pode não ser viável em dispositivos de IoT.…”