Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity

Abstract

Smart homes, enterprises, and cities equipped with IoT devices are increasingly becoming target of an escalating number of sophisticated new cyber-attacks. Anomaly-based detection methods are promising in finding new attacks, but there are certain practical challenges like false-positive alarms, hard to explain, and difficult to scale cost-effectively. The IETF recent standard called Manufacturer Usage Description (MUD) seems promising to limit the attack surface on IoT devices by formally specifying their intended network behavior (whitelisting). In this paper, we use SDN to enforce and monitor the expected behaviors (compliant with MUD profile) of each IoT device, and train one-class classifier models to detect volumetric attacks such as DoS, reflective TCP/UDP/ICMP flooding, and ARP spoofing on IoT devices.Our first contribution develops a multi-level inferencing model to dynamically detect anomalous patterns in network activity of MUDcompliant traffic flows via SDN telemetry, followed by packet inspection of anomalous flows. This provides enhanced fine-grained visibility into distributed and direct attacks, allowing us to precisely isolate volumetric attacks with microflow (5-tuple) resolution. For our second contribution, we collect traffic traces (benign and a variety of volumetric attacks) from network behavior of IoT devices in our lab, generate labeled datasets, and make them available to the public. Our third contribution prototypes a full working system (modules are released as open-source), demonstrates its efficacy in detecting volumetric attacks on several consumer IoT devices with high accuracy while maintaining low false positives, and provides insights into cost and performance of our system. Our last contribution demonstrates how our models scale in environments with a large number of connected IoTs (with datasets collected from a network of IP cameras in our university campus) by considering various training strategies (per device unit versus per device type), and balancing the accuracy of prediction against the cost of models in terms of size and training time.

CoLearn

“…The use of MUD as an isolation-based defensive mechanism to restrict traic generated from IoT devices is still in its early phase. Therefore, only a few deployment scenarios and proof-of-concept (PoC) implementations currently exist [1,2,10,11,19,28]. To the best of our knowledge, no work has considered the deployment of FL in MUD-compliant networks.…”

“…To reduce the attack surface in IoT, the Internet Engineering Task Force (IETF) has ratiied a standard for IoT device manufacturers to provide a Manufacturer Usage Description (MUD) with their IoT devices [14]. The MUD standard restricts and limits traic end-points and rates in and out of IoT devices, thus limiting the attack surface and enabling identiication of volumetric and man-in-the-middle attacks [11,27]. Deployment of FL in MUD-compliant networks thus not only meets necessary security requirements but also provides a practical solution for limiting the attack surface.…”

Enforcing Behavioral Profiles through Software-Defined Networks in the Industrial Internet of Things

“…These rules are proactively configured into network switches and used to detect attacks by using an Intrusion Detection System (IDS). The same authors use an SDN-based approach to monitor the compliance of a device's behavior with the corresponding MUD profile [24]. Toward this end, they develop an anomaly detection mechanism to identify potential attacks, such as DoS and Address Resolution Protocol (ARP) spoofing.…”

Security Architecture for Defining and Enforcing Security Profiles in DLT/SDN-Based IoT Systems

“…MUD standard has attracted the attention of different Standards Developing Organization (SDOs), such as the National Institute Standards and Technology (NIST) in U.S. [3,4] that has proposed the creation of a vulnerability behavior database based on this standard (https://www.nist.gov/itl/applied-cybersecurity/nist-initiatives-iot). One of the strong points of the MUD standard is the potential integration with the Software-Defined Networking (SDN) paradigm for the automated and dynamic enforcement of the restrictions included in a MUD profile as discussed by Hamza et al [5] and Ranganathan [6] by using OpenFlow [7].…”