Heimdall: Mitigating the Internet of Insecure Things

Habibi, Javid; Midi, Daniele; Mudgerikar, Anand; Bertino, Elisa

doi:10.1109/jiot.2017.2704093

Cited by 75 publications

(45 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There has also been some research on intrusion detection and anomaly detection systems for IoT. A whitelist-based intrusion detection system for IoT devices (Heimdall) has been presented in [12]. The authors in [13] propose an intrusion detection model for IoT backbone networks leveraging twolayer dimension reduction and two-tier classification techniques to detect U2R (User-to-Root) and R2L (Remote-to-Local) attacks.…”

Section: Related Workmentioning

confidence: 99%

EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques

Kumar

Lim

2019

2019 IEEE 5th World Forum on Internet of Things (WF-IoT)

115

View full text Add to dashboard Cite

The widespread adoption of Internet of Things has led to many security issues. Post the Mirai-based DDoS attack in 2016 which compromised IoT devices, a host of new malware using Mirai's leaked source code and targeting IoT devices have cropped up, e.g. Satori, Reaper, Amnesia, Masuta etc. These malware exploit software vulnerabilities to infect IoT devices instead of open TELNET ports (like Mirai) making them more difficult to block using existing solutions such as firewalls. In this research, we present EDIMA, a distributed modular solution which can be used towards the detection of IoT malware network activity in large-scale networks (e.g. ISP, enterprise networks) during the scanning/infecting phase rather than during an attack. EDIMA employs machine learning algorithms for edge devices' traffic classification, a packet traffic feature vector database, a policy module and an optional packet sub-sampling module. We evaluate the classification performance of EDIMA through testbed experiments and present the results obtained.

show abstract

Section: Related Workmentioning

confidence: 99%

EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques

Kumar

Lim

2019

2019 IEEE 5th World Forum on Internet of Things (WF-IoT)

115

View full text Add to dashboard Cite

show abstract

“…Compromised IoT devices can be used as part of a botnet to launch large-scale denial-of-service (DoS) attacks on other systems and networks. [7][8][9][10] A recent report has quantified the cost that such attacks have on organizations and society at large. 11 The cost of IoT hacks for small US firms amounts to 13% of their annual revenue.…”

Section: Internet Of Thingsmentioning

confidence: 99%

Securing Internet of Things (IoT) with machine learning

Zeadally

Tsikerdekis

2019

Int J Communication

View full text Add to dashboard Cite

Advances in hardware, software, communication, embedding computing technologies along with their decreasing costs and increasing performance have led to the emergence of the Internet of Things (IoT) paradigm. Today, several billions of Internet-connected devices are part of the IoT ecosystem.IoT devices have become an integral part of the information and communication technology (ICT) infrastructure that supports many of our daily activities. The security of these IoT devices has been receiving a lot of attention in recent years. Another major recent trend is the amount of data that is being produced every day which has reignited interest in technologies such as machine learning and artificial intelligence. We investigate the potential of machine learning techniques in enhancing the security of IoT devices. We focus on the deployment of supervised, unsupervised learning techniques, and reinforcement learning for both host-based and network-based security solutions in the IoT environment. Finally, we discuss some of the challenges of machine learning techniques that need to be addressed in order to effectively implement and deploy them so that they can better protect IoT devices. KEYWORDSattack, internet of things, machine learning, security

show abstract

“…There has also been some research on intrusion detection and anomaly detection systems for IoT. A whitelist-based intrusion detection system for IoT devices (Heimdall) has been presented in [20]. Heimdall is based on dynamic profile learning and is designed to work on routers acting as gateways for IoT devices.…”

Section: Related Workmentioning

confidence: 99%

Early Detection of Mirai-Like IoT Bots in Large-Scale Networks through Sub-sampled Packet Traffic Analysis

Kumar

Lim

2019

Lecture Notes in Networks and Systems

View full text Add to dashboard Cite

The widespread adoption of Internet of Things has led to many security issues. Recently, there have been malware attacks on IoT devices, the most prominent one being that of Mirai. IoT devices such as IP cameras, DVRs and routers were compromised by the Mirai malware and later large-scale DDoS attacks were propagated using those infected devices (bots) in October 2016. In this research, we develop a network-based algorithm which can be used to detect IoT bots infected by Mirai or similar malware in large-scale networks (e.g. ISP network). The algorithm particularly targets bots scanning the network for vulnerable devices since the typical scanning phase for botnets lasts for months and the bots can be detected much before they are involved in an actual attack. We analyze the unique signatures of the Mirai malware to identify its presence in an IoT device. The prospective deployment of our bot detection solution is discussed next along with the countermeasures which can be taken post detection. Further, to optimize the usage of computational resources, we use a two-dimensional (2D) packet sampling approach, wherein we sample the packets transmitted by IoT devices both across time and across the devices. Leveraging the Mirai signatures identified and the 2D packet sampling approach, a bot detection algorithm is proposed. Subsequently, we use testbed measurements and simulations to study the relationship between bot detection delays and the sampling frequencies for device packets. Finally, we derive insights from the obtained results and use them to design our proposed bot detection algorithm.

show abstract

Heimdall: Mitigating the Internet of Insecure Things

Cited by 75 publications

References 4 publications

EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques

EDIMA: Early Detection of IoT Malware Network Activity Using Machine Learning Techniques

Securing Internet of Things (IoT) with machine learning

Early Detection of Mirai-Like IoT Bots in Large-Scale Networks through Sub-sampled Packet Traffic Analysis

Contact Info

Product

Resources

About