An Intelligent Improvement of Internet-Wide Scan Engine for Fast Discovery of Vulnerable IoT Devices

Abstract

Since 2016, Mirai and Persirai malware have infected hundreds of thousands of Internet of Things (IoT) devices and created a massive IoT botnet, which caused distributed denial of service (DDoS) attacks. IoT malware targets vulnerable IoT devices, which are vulnerable to security risks. Techniques are needed to prevent IoT devices from being exploited by attackers. However, unlike high-performance PCs, IoT devices are lightweight, low-power, and low-cost, having performance limitations regarding processing and memory, which makes it difficult to install security and anti-malware programs. Recently, several studies have been attempted to quickly search for vulnerable internet-connected devices to solve this real issue. Issues yet to be studied still exist regarding these types of internet-wide scan technologies, such as filtering by security devices and a shortage of collected operating system (OS) information. This paper proposes an intelligent internet-wide scan model that improves IP state scanning with advanced internet protocol (IP) randomization, reactive protocol (port) scanning, and OS fingerprinting scanning, applying k* algorithm in order to find vulnerable IoT devices. Additionally, we describe the experiment's results compared to the existing internet-wide scan technologies, such as ZMap and Shodan. As a result, the proposed model experimentally shows improved performance. Although we improved the ZMap, the throughput per minute (TPM) performance is similar to ZMap without degrading the IP scan throughput and the performance of generating a single IP address is about 118% better than ZMap. In the protocol scan performance experiments, it is about 129% better than the Censys based ZMap, and the performance of OS fingerprinting is better than ZMap, with about 50% accuracy.

SIEM-based detection and mitigation of IoT-botnet DDoS attacks

“…Several research efforts have been made to develop Internet Wide Scan technologies to search for vulnerable IoT devices. Kim et al [15] proposed a model to improve the performance of the Internet Wide Scanner Zmap [16].…”

IoT Vulnerability Scanning: A State of the Art

“…Among the studied literature, the main observed goal for performing vulnerability scanning is to investigate security and privacy issues with some works aiming to enforce security rules [21]. Secondary goals are related to developing security solutions for IoT and IIoT [3,9,10,17,21], certification of IoT and IIoT devices to improve their market value [17], while others aim to provide platform for threat information sharing in IoT [10]. From the studied scanning processes, we were able to identify an IoT vulnerability scanning space in which all the observed scanning processes reside.…”

“…produced by 14,3 thousand manufacturers [11]. Machine learning techniques have been applied to improve the identification of device types [11] and operating systems [9]. Communicating with these devices to scan them and identifying their associated vulnerabilities require varying levels of scrutiny, especially since most of them do not adhere to certain standards.…”

“…For instance, Al-Alami et al [1] scanned hosts on Shodan with default credentials based on the presence of FTP response code 230 which means successful login; Shodan suggests this after attempting to log in using a list of most common credentials. Knowing that Shodan scans the entire IPv4 at least once each month [9], the assumed vulnerability could have been resolved but still appears in the results, therefore should be validated using active scanning, bearing in mind the associated ethical considerations. Some processes utilize additional tools to validate the results of the scanning tools.…”

“…IoT Vulnerability Scanning space IPv4 addresses for the scanning process in an attempt to avoid the detection and scanning prevention by security solutions such as firewalls which can easily detect sequential IPv4 scanning[9].…”