Nowadays DDoS attacks using devices from IoT networks are frequent and extensive. Given that IoT network instances are distributed and deployed on the conventional Internet structure, DDoS countermeasures in IoT need to be fully distributed and coordinated all over the components that form each IoT instance. This paper presents a host-based intrusion detection system (HIDS) that was designed and prototyped to protect the components of IoT network backbones comprising conventional switches and routers, not IoT devices. In our design, a set of the proposed HIDS executes conventional security verification, like default username and password, known attacks signatures, usage of resources, processes, ports and open connections, while also interacting with a Controller of the HIDS set to allow the coordination of intrusion detection actions relative to DDoS attacks distributed all over the IoT instance. The designed distributed HIDS is evaluated in a controlled environment that, although being a local and isolated network, realistically represents IoT network instances.

No abstract

A programabilidade resultante da abordagem Software Defined Networking (SDN) facilita a integração das funcionalidades de firewalls, sistemas de prevenção de intrusão (IPS) e switches, permitindo a rápida reconfiguração da rede em caso de detecção de anomalias. Neste artigo, a arquitetura proposta visa estruturar uma medida de segurança distribuída que integra firewall, IPS, switches e uma entidade controladora para suportar instâncias de Internet das Coisas (IoT), permitindo a identificação de comportamento anômalo de dispositivos IoT pelo IPS, levando então a SDN a bloquear os ataques o mais próximo possível das fontes, reduzindo o volume de tráfego malicioso e isolando o dispositivo infectado do resto da rede..