Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article

A novel approach for detecting vulnerable IoT devices connected behind a home NAT

Published: 01 October 2020 Publication History

Abstract

Telecommunication service providers (telcos) are exposed to cyber-attacks executed by compromised IoT devices connected to their customers’ networks. Such attacks might have severe effects on the attack target, as well as the telcos themselves. To mitigate those risks, we propose a machine learning-based method that can detect specific vulnerable IoT device models connected behind a domestic NAT, thereby identifying home networks that pose a risk to the telcos infrastructure and service availability. To evaluate our method, we collected a large quantity of network traffic data from various commercial IoT devices in our lab and compared several classification algorithms. We found that (a) the LGBM algorithm produces excellent detection results, and (b) our flow-based method is robust and can handle situations for which existing methods used to identify devices behind a NAT are unable to fully address, e.g., encrypted, non-TCP or non-DNS traffic. To promote future research in this domain we share our novel labeled benchmark dataset.

References

[1]
S. Abt, H. Baier, Towards efficient and privacy-preserving network-based botnet detection using netflow data., Ninth International Network Conference (INC), 2012, pp. 37–50.
[2]
AG, P., 2019. Optimize high traffic networks with PRTG sflow monitoring.
[3]
A. Ahmad, A. Floris, L. Atzori, OTT-ISP joint service management: a customer lifetime value based approach, 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM), 2017, pp. 1017–1022.
[4]
Amazon, 2019. Fire stick.
[5]
Amcrest,. Amcrest IPM-721W.
[6]
S. Andy, B. Rahardjo, B. Hanindhito, Attack scenarios and security analysis of MQTT communication protocol in IoT system, 2017 4th International Conference on Electrical Engineering, Computer Science and Informatics (EECSI), IEEE, 2017, pp. 1–6.
[7]
M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein, J. Cochran, Z. Durumeric, J.A. Halderman, L. Invernizzi, M. Kallitsis, et al., Understanding the Mirai Botnet, Proceedings of the 26th USENIX Security Symposium, Vancouver, Canada, 2017.
[8]
N. Apthorpe, D. Reisman, N. Feamster, A smart home is no castle: privacy vulnerabilities of encrypted IoT traffic, Workshop on Data and Algorithmic Transparency, 2017.
[9]
P. Barapatre, N.Z. Tarapore, S.G. Pukale, M.L. Dhore, Training MLP neural network to reduce false alerts in IDS, 2008 International Conference on Computing, Communication and Networking, 2008, pp. 1–7.
[10]
D. Bekerman, B. Shapira, L. Rokach, A. Bar, Unknown malware detection using network traffic classification, Communications and Network Security (CNS), 2015 IEEE Conference on, 2015, pp. 134–142.
[11]
E. Bertino, N. Islam, Botnets and internet of things security, Computer (2017),.
[12]
Bushart, J., Rossow, C., 2019. Padding ain’t enough: assessing the privacy guarantees of encrypted dns. arXiv:1907.01317.
[13]
A.C. Callado, C.A. Kamienski, G. Szabó, B.P. Gero, J. Kelner, S.F. Fernandes, D.F.H. Sadok, A survey on internet traffic identification., IEEE Commun. Surv. Tut. 11 (3) (2009) 37–52.
[14]
J.B. Camiña, M.A. Medina-Pérez, R. Monroy, O. Loyola-González, L.A.P. Villanueva, L.C.G. Gurrola, Bagging-randomminer: a one-class classifier for file access-based masquerade detection, Mach. Vis. Appl. 30 (5) (2019) 959–974.
[16]
R.M. Cichy, D. Kaiser, Deep neural networks as scientific models, Trends Cogn. Sci. 23 (4) (2019) 305–317,.
[17]
Cisco, 2006. Cisco 3800 series integrated services routers. Data Sheet.
[18]
Cisco, 2019. Cisco catalyst 2960-x and 2960-xr series switches data sheet. Data Sheet.
[19]
Cisco.com, 2011. NetFlow Version 9 Flow-Record Format.
[20]
Cisco.com, 2017. Cisco - NetFlow.
[21]
CNET,. Samsung snh-1011n.
[22]
C. Cortes, V. Vapnik, Support-vector networks, Mach. Learn. 20 (3) (1995) 273–297.
[23]
J. Davis, M. Goadrich, The relationship between precision-recall and RoC curves, Proceedings of the 23rd International Conference on Machine Learning, 2006, pp. 233–240.
[24]
DELL,. Latitude 7400.
[25]
Dell Latitude e6430.
[26]
R. Doshi, N. Apthorpe, N. Feamster, Machine learning DDoS detection for consumer internet of things devices, 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA, 2018.
[27]
K. Egevang, P. Francis, et al., The IP network address translator (NAT), Technical Report, RFC 1631, may, 1994.
[28]
R.T. El-Maghraby, N.M.A. Elazim, A.M. Bahaa-Eldin, A survey on deep packet inspection, 2017 12th International Conference on Computer Engineering and Systems (ICCES), IEEE, 2017, pp. 188–197.
[29]
V.J. Ercolani, M.W. Patton, H. Chen, Shodan visualized, 2016 IEEE Conference on Intelligence and Security Informatics (ISI), IEEE, 2016, pp. 193–195,.
[30]
Y. Gokcen, V.A. Foroushani, A.N.Z. Heywood, Can we identify NAT behavior by analyzing traffic flows?, 2014 IEEE Security and Privacy Workshops, IEEE, 2014, pp. 132–139,.
[31]
H. Guo, J. Heidemann, IP-based IoT device detection, Proceedings of the 2018 Workshop on IoT Security and Privacy, ACM, Budapest, Hungary, 2018, pp. 36–42,.
[32]
N. Hadar, S. Siboni, Y. Elovici, A lightweight vulnerability mitigation framework for IoT devices, Proceedings of the 2017 Workshop on Internet of Things Security and Privacy, 2017, pp. 71–75.
[33]
R. Hallman, J. Bryan, G. Palavicini, J. Divita, J. Romero-Mariona, IoDDoS the internet of distributed denial of service attacks - a case study of the Mirai malware and IoT-based botnets, Proceedings of the 2nd International Conference on Internet of Things, Big Data and Security - Volume 1: IoTBDS, SciTePress, 2017, pp. 47–58,.
[34]
S.A. Hamad, W.E. Zhang, Q.Z. Sheng, S. Nepal, Iot device identification via network-flow based fingerprinting and learning, 2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), IEEE, 2019, pp. 103–111.
[35]
Hamilton, R., 2016. Mirai Scanner: Are You an Unwitting Mirai Botnet Recruit?Imperva.
[36]
Haran, V., 2016. StarHub Attack Raises IoT Security Questions.
[37]
Ismail, N., 2018. Telcos struggling to mitigate the threats of cyber attacks. Information Age.
[38]
JVN, 2019. Jvnvu#94678942 fon routers may behave as an open resolver.
[39]
Industrial Enterprise and IoT Security Threats: Forecast for 2018 | Kaspersky Lab ICS CERT. 2017.
[40]
G. Kambourakis, C. Kolias, A. Stavrou, The Mirai botnet and the IoT Zombie Armies, Proceedings - IEEE Military Communications Conference MILCOM, 2017-October, 2017,.
[41]
A.E. Kashef, N. Barakat, Intelligent alarm system to protect small, valuable items, 2018 International Conference on Computer and Applications (ICCA), 2018, pp. 326–330.
[42]
G. Ke, Q. Meng, T. Finley, T. Wang, W. Chen, W. Ma, Q. Ye, T.-Y. Liu, Lightgbm: a highly efficient gradient boosting decision tree, in: Guyon I., Luxburg U.V., Bengio S., Wallach H., Fergus R., Vishwanathan S., Garnett R. (Eds.), Advances in Neural Information Processing Systems 30, Curran Associates, Inc., 2017, pp. 3146–3154.
[43]
M.A. Khan, K. Salah, Iot security: review, blockchain solutions, and open challenges, Fut. Gener. Comput. Syst. 82 (2018) 395–411.
[44]
A.S. Khatouni, L. Zhang, K. Aziz, I. Zincir, N. Zincir-Heywood, Exploring nat detection and host identification using machine learning, 2019 15th International Conference on Network and Service Management (CNSM), IEEE, 2019, pp. 1–8.
[45]
Kirk, J., 2016. Mirai Botnet Knocks Out Deutsche Telekom Routers.
[46]
Kit, T. S., 2016a. DDoS attack on StarHub first of its kind on Singapore’s telco infrastructure: CSA, IMDA.
[47]
Kit, T. S., 2016b. DDoS attack on StarHub first of its kind on Singapore’s telco infrastructure: CSA, IMDA.
[48]
C. Kolias, G. Kambourakis, A. Stavrou, J. Voas, DDoS in the IoT: Mirai and other botnets, Computer 50 (7) (2017) 80–84,.
[49]
Krebs, B., 2016. New Mirai Worm Knocks 900K Germans Offline.
[50]
D. Kumar, K. Shen, B. Case, D. Garg, G. Alperovich, D. Kuznetsov, R. Gupta, Z. Durumeric, All things considered: an analysis of IoT devices on home networks, 28th USENIX Security Symposium (USENIX Security’19), 2019, pp. 1169–1185.
[51]
E. Lear, D. Romascanu, R. Droms, Manufacturer usage description specification, Internet Engineering Task Force (IETF) (2019),.
[52]
Lee, D., 2019. Iran seizes 1,000 Bitcoin mining machines after power spike.
[53]
B. Li, J. Springer, G. Bebis, M.H. Gunes, A survey of network flow applications, J. Netw. Comput. Appl. 36 (2) (2013) 567–581.
[54]
B. Li, Y. Zhu, Q. Liu, Z. Zhou, L. Guo, Hunting for invisible smartcam: characterizing and detecting smart camera based on netflow analysis, ICC 2019-2019 IEEE International Conference on Communications (ICC), IEEE, 2019, pp. 1–7.
[55]
Y. Liu, T. Song, L. Liao, Tpii: tracking personally identifiable information via user behaviors in http traffic, Front. Comput. Sci. 14 (3) (2020) 1–14.
[56]
M. Lopez-Martin, B. Carro, A. Sanchez-Esguevillas, J. Lloret, Network traffic classifier with convolutional and recurrent neural networks for internet of things, IEEE Access 5 (2017) 18042–18050,.
[57]
M1, 2020. Terms and Conditions: Fibre Broadband.
[58]
P.N. Mahalle, Object classification based context management for identity management in internet of things, Int. J. Comput. Appl. 63 (12) (2013) 1–6,.
[59]
G. Maier, F. Schneider, A. Feldmann, NAT usage in residential broadband networks, International Conference on Passive and Active Network Measurement, Springer, Berlin, Heidelberg, Berlin, 2011, pp. 32–41,.
[60]
Y. Meidan, M. Bohadana, A. Shabtai, J.D. Guarnizo, M. Ochoa, N.O. Tippenhauer, Y. Elovici, ProfilIoT: a machine learning approach for IoT device identification based on network traffic analysis, Proceedings of the Symposium on Applied Computing - SAC ’17, ACM Press, Marrakech, Morocco, 2017, pp. 506–509,.
[61]
Meidan, Y., Sachidananda, V., Peng, H., Sagron, R., Elovici, Y., Shabtai, A., 2020. IoT-deNAT: outbound flow-based network traffic data of IoT and non-IoT devices behind a home NAT. https://doi.org/10.5281/zenodo.3924770. 10.5281/zenodo.3924770.
[62]
Microsoft,. Welcome to lightgbm’s documentation.
[63]
M. Miettinen, S. Marchal, I. Hafeez, T. Frassetto, N. Asokan, A.-R. Sadeghi, S. Tarkoma, IoT sentinel demo: automated device-type identification for security enforcement in IoT, 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), IEEE, 2017, pp. 2511–2514,.
[64]
Mitre, 1999. Common vulnerabilities and exposures.
[65]
Mitre, 2019. Cve-2019-6015.
[66]
Networks, J., 2011. Juniper flow monitoring.
[67]
NIST, 2000. National vulnerability database.
[68]
M. Nobakht, V. Sivaraman, R. Boreli, A host-based intrusion detection and mitigation framework for smart home IoT using OpenFlow, Proceedings - 2016 11th International Conference on Availability, Reliability and Security, ARES 2016, 2016,.
[69]
T. Omitola, G. Wills, Towards mapping the security challenges of the internet of things (IoT) supply chain, Procedia Comput. Sci. 126 (2018) 441–450.
[70]
L. Orevi, A. Herzberg, H. Zlatokrilov, D. Sigron, DNS-DNS: DNS-based De-NAT Scheme, NDSS DNS Privacy Workshop, 2017.
[71]
Z. Ori, M. Levi, Y. Elovici, L. Rockach, Nir Shafrir, G. Sinter, O. Pen, Identifying computers hidden behind a nat using machine learning techniques, ECIW2008-7th European Conference on Information Warfare and Security: ECIW2008, Academic Conferences Limited, 2008, p. 335.
[72]
M. Patton, E. Gross, R. Chinn, S. Forbis, L. Walker, H. Chen, Uninvited connections: a study of vulnerable devices on the internet of things (IoT), Proceedings - 2014 IEEE Joint Intelligence and Security Informatics Conference, JISIC 2014, 2014,.
[73]
Patton, S., 2018. What is the Real Cost of a DDoS Attack?IoT Tech Expo.
[74]
F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, E. Duchesnay, Scikit-learn: machine learning in python, J. Mach. Learn. Res. 12 (2011) 2825–2830.
[75]
S.V. Radhakrishnan, A.S. Uluagac, R. Beyah, Gtid: a technique for physical device and device type fingerprinting, IEEE Trans. Depend. Secure Comput. 12 (5) (2015) 519–532.
[76]
M. Rai, H. Mandoria, Network intrusion detection: a comparative study using state-of-the-art machine learning methods, 2019 International Conference on Issues and Challenges in Intelligent Computing Techniques (ICICT), 1, IEEE, 2019, pp. 1–5.
[77]
A.K. Ray, A. Bagwari, Study of smart home communication protocol’s and security privacy aspects, 2017 7th International Conference on Communication Systems and Network Technologies (CSNT), 2017, pp. 240–245.
[78]
Rayome, A. D., 2017. DDoS attacks increased 91% in 2017 thanks to IoT.
[79]
Ring,. Video Doorbell.
[80]
E. Ronen, A. Shamir, Extended functionality attacks on IoT devices: the case of smart lights, 2016 IEEE European Symposium on Security and Privacy (EuroS&P), IEEE, 2016, pp. 3–12.
[81]
Samsung, a. Samsung Galaxy Note 4.
[82]
Samsung, b. Samsung Galaxy Note5.
[83]
S. Savage, D. Wetherall, A. Karlin, T. Anderson, Practical network support for IP traceback, Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication - SIGCOMM ’00, ACM Press, New York, New York, USA, 2000, pp. 295–306,.
[84]
Shaked, I., 2019. P2P Hole punching in Home IoT - A best UX or a built in security vulnerability?Firedome.
[85]
O. Shwartz, Y. Mathov, M. Bohadana, Y. Elovici, Y. Oren, Opening pandora’s box: effective techniques for reverse engineering IoT devices, in: Eisenbarth T., Y. Teglia (Eds.), Smart Card Research and Advanced Applications, Springer International Publishing, Cham, 2018, pp. 1–21.
[86]
S. Siboni, A. Shabtai, Y. Elovici, An attack scenario and mitigation mechanism for enterprise byod environments, ACM SIGAPP Appl. Comput. Rev. 18 (2) (2018) 5–21.
[87]
A. Sivanathan, D. Sherratt, H.H. Gharakheili, A. Vishwanath, Low-cost flow-based security solutions for smart-home IoT devices, IEEE Advanced Networks and Telecommunications Systems (ANTS), Bangalore, India, 2016.
[88]
Smith, B. W., 2020. Systems and Methods for Blocking Spoofed Traffic. US Patent App. 16/592,544.
[89]
J. Smith-perrone, J. Sims, Securing cloud, SDN and large data network environments from emerging ddos attacks, 2017 7th International Conference on Cloud Computing, Data Science & Engineering-Confluence, IEEE, 2017, pp. 466–469.
[90]
SONOS,. One: The smart speaker.
[91]
Spring, T., 2018. Mirai variant targets financial sector with IoT DDoS attacks.
[92]
S. Stalla-Bourdillon, E. Papadaki, T. Chown, From porn to cybersecurity passing by copyright: how mass surveillance technologies are gaining legitimacy the case of deep packet inspection technologies, Comput. Law Secur. Rev. 30 (6) (2014) 670–686.
[93]
A. Taivalsaari, T. Mikkonen, A taxonomy of IoT client architectures, IEEE Softw. 35 (3) (2018) 83–88.
[94]
Technology Council, F., 2018. 14 predictions for the future of smart home technology.
[95]
A. Tekeoglu, N. Altiparmak, A.S. Tosun, Approximating the number of active nodes behind a NAT device, 2011 Proceedings of 20th International Conference on Computer Communications and Networks (ICCCN), IEEE, 2011, pp. 1–7,.
[96]
Than, I., 2016. StarHub: cyber attacks that caused broadband outages came from customers’ infected machines.
[97]
The HDF Group, 2000–2010. Hierarchical Data Format Version 5.
[98]
S. Torabi, E. Bou-Harb, C. Assi, M. Galluscio, A. Boukhtouta, M. Debbabi, Inferring, characterizing, and investigating internet - scale malicious IoT device activities : a network telescope perspective, 48th International Conference on Dependable Systems and Networks (DSN-2018), Luxembourg, 2018.
[99]
TP-LINK, a. Smart wi-fi led bulb lb130.
[100]
TP-LINK, b. Tl-wa901nd.
[101]
Trustwave, 2015. Singtel Acquires Trustwave to Bolster Global Cyber Security Capabilities.
[102]
E. Valdez, D. Pendarakis, H. Jamjoom, How to discover IoT devices when network traffic is encrypted, 2019 IEEE International Congress on Internet of Things (ICIOT), IEEE, 2019, pp. 17–24.
[103]
I. van der Elzen, J. van Heugten, Techniques for Detecting Compromised IoT Devices, University of Amsterdam, 2017, Ph.D. thesis.
[104]
N.V. Verde, G. Ateniese, E. Gabrielli, L.V. Mancini, A. Spognardi, No NAT’d user left behind: fingerprinting users behind NAT from NetFlow records alone, 2014 IEEE 34th International Conference on Distributed Computing Systems, IEEE, 2014, pp. 218–227,.
[105]
G.J. Victor, M.S. Rao, V.C. Venkaiah, Intrusion detection systems-analysis and containment of false positives alerts, Int. J. Comput. Appl 5 (8) (2010) 27–33.
[106]
WEMO,. Wemo Insight Smart Plug.
[107]
Z.K. Zhang, M.C.Y. Cho, C.W. Wang, C.W. Hsu, C.K. Chen, S. Shieh, IoT security: ongoing challenges and research opportunities, Proceedings - IEEE 7th International Conference on Service-Oriented Computing and Applications, SOCA 2014, 2014,.

Cited By

View all
  • (2023)Efficient IoT Traffic Inference: From Multi-view Classification to Progressive MonitoringACM Transactions on Internet of Things10.1145/36253065:1(1-30)Online publication date: 16-Dec-2023
  • (2023)Granular IoT Device Identification Using TF-IDF and Cosine SimilarityProceedings of the 5th Workshop on CPS&IoT Security and Privacy10.1145/3605758.3623492(91-99)Online publication date: 26-Nov-2023
  • (2023)How Polynomial Regression Improves DeNATingIEEE Transactions on Network and Service Management10.1109/TNSM.2023.326639020:4(5000-5011)Online publication date: 1-Dec-2023
  • Show More Cited By

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image Computers and Security
Computers and Security  Volume 97, Issue C
Oct 2020
747 pages

Publisher

Elsevier Advanced Technology Publications

United Kingdom

Publication History

Published: 01 October 2020

Author Tags

  1. Internet of things (IoT)
  2. Device identification
  3. Network address translation (NAT)
  4. Machine learning
  5. DeNAT

Qualifiers

  • Research-article

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)0
  • Downloads (Last 6 weeks)0
Reflects downloads up to 02 Oct 2024

Other Metrics

Citations

Cited By

View all
  • (2023)Efficient IoT Traffic Inference: From Multi-view Classification to Progressive MonitoringACM Transactions on Internet of Things10.1145/36253065:1(1-30)Online publication date: 16-Dec-2023
  • (2023)Granular IoT Device Identification Using TF-IDF and Cosine SimilarityProceedings of the 5th Workshop on CPS&IoT Security and Privacy10.1145/3605758.3623492(91-99)Online publication date: 26-Nov-2023
  • (2023)How Polynomial Regression Improves DeNATingIEEE Transactions on Network and Service Management10.1109/TNSM.2023.326639020:4(5000-5011)Online publication date: 1-Dec-2023
  • (2023)You Can Glimpse but You Cannot Identify: Protect IoT Devices From Being FingerprintedIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2023.327585021:3(1210-1223)Online publication date: 12-May-2023
  • (2023)A Comprehensive Survey for IoT Security Datasets Taxonomy, Classification and Machine Learning MechanismsComputers and Security10.1016/j.cose.2023.103283132:COnline publication date: 1-Sep-2023
  • (2023)lIDS-SIoEL: intrusion detection framework for IoT-based smart environments security using ensemble learningCluster Computing10.1007/s10586-022-03810-026:6(4069-4083)Online publication date: 1-Dec-2023
  • (2022)Classification of Encrypted IoT Traffic despite Padding and ShapingProceedings of the 21st Workshop on Privacy in the Electronic Society10.1145/3559613.3563191(1-13)Online publication date: 7-Nov-2022

View Options

View options

Get Access

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media