A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets

Sánchez, Pedro Miguel Sánchez; Valero, José María Jorquera; Celdrán, Alberto Huertas; Bovet, Gérôme; Pérez, Manuel Gil; Pérez, Gregorio Martínez

doi:10.1109/comst.2021.3064259

Cited by 95 publications

(42 citation statements)

References 155 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…1) The data set of legitimate IoT and anomalous DDoS traffic generated in this research will be made publicly available to the broad scientific community (and there is a lack of such data sets in [7]-see also the second section). 2) Our defined process of forming normal traffic profiles for classes of IoT devices.…”

Section: Introductionmentioning

confidence: 99%

Boosting-Based DDoS Detection in Internet of Things Systems

Cvitić

Peraković

Gupta

et al. 2022

IEEE Internet Things J.

108

View full text Add to dashboard Cite

Distributed Denial-of-Service (DDoS) attacks remain challenging to mitigate in the existing systems, including in-home networks that comprise different Internet of Things (IoT) devices. In this article, we present a DDoS traffic detection model that uses a boosting method of logistic model trees for different IoT device classes. Specifically, a different version of the model will be generated and applied for each device class since the characteristics of the network traffic from each device class may have subtle variation(s). As a case study, we explain how devices in a typical smart home environment can be categorized into four different classes (and in our context, Class 1-very high level of traffic predictability, Class 2-high level of traffic predictability, Class 3-medium level of traffic predictability, and Class 4-low level of traffic predictability). Findings from our evaluations show that the accuracy of our proposed approach is between 99.92% and 99.99% for these four device classes. In other words, we demonstrate that we can use device classes to help us more effectively detect DDoS traffic.

show abstract

Section: Introductionmentioning

confidence: 99%

Boosting-Based DDoS Detection in Internet of Things Systems

Cvitić

Peraković

Gupta

et al. 2022

IEEE Internet Things J.

108

View full text Add to dashboard Cite

show abstract

“…Traditional AI techniques have been widely applied in the literature to detect cybersecurity issues in IoT scenarios. In [3], existing works on device behavior fingerprinting were surveyed, including those targeting IoT security. This work shows how IoT security solutions are turning nowadays towards the application of ML and DL techniques.…”

Section: Artificial Intelligence For Iot Cybersecuritymentioning

confidence: 99%

“…One strategy that has gained relevance when detecting devices that have been corrupted by malware is monitoring device activities to generate behavioral fingerprints or profiles. Fingerprints can be utilized to detect deviations caused by cyberattacks or malicious software modifications [3]. In IoT devices, heterogeneous behavior sources can be monitored, such as network communications, resource consumption, software actions and events, or users' interactions.…”

Section: Introductionmentioning

confidence: 99%

Federated Learning for Malware Detection in IoT Devices

Rey,

Sánchez,

Celdrán

et al. 2021

Preprint

View full text Add to dashboard Cite

Billions of IoT devices lacking proper security mechanisms have been manufactured and deployed for the last years. Their vulnerability to malware has motivated the need for efficient techniques to detect infected IoT devices inside networks. With privacy becoming a major concern in recent years, a new technology called federated learning emerged. It allows training machine learning models with decentralized data while preserving its privacy by design. This work investigates the possibilities enabled by federated learning concerning IoT malware detection and studies security issues inherent to this new learning paradigm. In this context, a framework that uses federated learning to detect malware affecting IoT devices is presented. N-BaIoT, a dataset modeling network traffic of several real IoT devices while affected by malware, has been used to evaluate the proposed framework. Both supervised and unsupervised federated models (multi-layer perceptron and autoencoder) able to detect malware affecting seen and unseen IoT devices of N-BaIoT have been trained and evaluated. Furthermore, their performance has been compared to two traditional approaches. The first one lets each participant locally train a model using only its own data, while the second consists of making the participants share their data with a central entity in charge of training a global model. This comparison has shown that the use of more diverse and large data, as done in the federated and centralized methods, has a considerable positive impact on the model performance. Besides, the federated models, while preserving the participant's privacy, show similar results as the centralized ones. As an additional contribution and to measure the robustness of the federated approach, an adversarial setup with several malicious participants poisoning the federated model has been considered. The baseline model aggregation averaging step used in most federated learning algorithms appears highly vulnerable to different attacks, even with a single adversary. The performance of other model aggregation functions acting as countermeasures is thus evaluated under the same attack scenarios. These functions provide a significant improvement against malicious participants, but more efforts are still needed to make federated approaches robust.

show abstract

“…Continuous Authentication (CA) is one of the main emergent techniques from the BAD-based security approach. Also known as permanent authentication, CA is supposed to increase the level of security by keeping SHS users authenticated permanently and enhance the users' quality of experience by being non-intrusive and minimizing the usage of credentials during the authentication processes [38]. User cyber behavior-based authentication is a category of CA.…”

Section: Existing Approaches For Securing User-driven Operation Of Iot-based Shssmentioning

confidence: 99%