Smart Home IoT Traffic Characteristics as a Basis for DDoS Traffic Detection

Abstract

Distributed denial of Service (DDoS) attack is a continuous threat to the availability of information and communication resources. The development and growth of acceptance and the continuous increase in the number of devices within the IoT concept provides the platform for the implementation of DDoS attacks of significantly greater traffic intensity than is currently possible. Numerous botnet networks, where the most prominent representative is Mirai botnet, use the inadequate protection of IoT devices in the smart home environment for generating illegitimate DDoS traffic. To further development of the timely DDoS traffic detection generated in the aforementioned environment, this research seeks to establish the diversity of traffic generated by IoT devices in a smart home environment with respect to the traffic generated through human type communication. Research results will represent base for the future development of new models aimed at detecting this specific DDoS traffic type.

Boosting-Based DDoS Detection in Internet of Things Systems

“…Such devices are often shipped with minimal or nonexistent security mechanisms, and in an effort to make these devices user friendly, the security requirements are often reduced [4]. In addition, most of the devices in a smart home are inexpensive and do not have significant computational capabilities and, consequently, they can be easily compromised to facilitate a broad range of nefarious activities, including generating DDoS traffic [5]. In a typical smart home ecosystem, there are several stakeholder groups, such as end users (homeowners or tenants within a home), Internet/telecommunication service providers, device manufacturers, and service providers (e.g., third-party service providers such as a monitored security service).…”

“…A challenge is how to design an effective DDoS detection system that can be deployed in an increasingly diverse and dynamic smart home environment. For example, based on the generated network traffic characteristics, one might identify the types of devices commonly found in a smart home environment [5]. Along a similar line, a model for classifying IoT devices into previously defined classes was presented in our previous research [6], where we defined the classes of IoT devices-based purely on their traffic behavior and behavioral predictability (i.e., the coefficient of variation of the ratio of received and sent data).…”

Blockchain-Based Secured Access Control in an IoT System

“…The attacker used default authentication data to log in to victims' IoT devices. The estimated number of targeted devices was approximately 100,000 [34].…”

Novel Classification of IoT Devices Based on Traffic Flow Features

“…The SHIoT devices covered by this research are presented in Table 2. The MAC (Media Access Control) represents unique identifiers of the SHIoT device in the network, the name of the device, the P / S tag that indicates whether the monitored device used for collecting primary or secondary data, and to which group belongs according to the segmentation shown in Ivan Cvitić et al (2018).…”