ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

Abstract

Today, cyber attacks are constantly evolving and changing, which makes them harder to detect. In particular, detecting attacks in large-scale networks is very challenging because they require high detection rates under real-time resource constraints. In this paper, we focus on detecting infected Internet of Things (IoT) hosts from domain name system (DNS) traffic data. IoT hosts, such as streaming cameras, printers, air conditioners, are hard to protect, unlike PCs and servers. Enterprises are often unaware of the devices which are connected to the network, their types, makes, and vulnerabilities. Since IoT hosts make use of the DNS protocol, analyzing DNS data can give a broad view of malicious activities, because they abuse the DNS protocol and leave fingerprints as part of their attack vector. In this collaborative research between Ben-Gurion University, and IBM, we establish a novel algorithm to detect infected IoT hosts in large-scale DNS traffic, named Anomaly and Reputation Based Algorithm (ARBA). Its novelty resides in developing a framework that combines host classification and domain reputation in a real-time production environment. ARBA is highly computational efficient and meets real-time requirements in terms of run time and computational complexity. By contrast to existing algorithms, it does not require a massive traffic volume for training, which is of significant interest in detecting infected hosts in real-time. The research was conducted on real live streaming data from IBM internal network traffic, and confirm the algorithm's strong performance in a real-time production environment. INDEX TERMS Cyber security, anomaly detection, domain name system (DNS), detection algorithms, real-time algorithms.

A Survey of Using Machine Learning in IoT Security and the Challenges Faced by Researchers

“…-Lower performance compared with other classifiers. 95,106,117,120,123,126,129,132,137,142,145,149,151,155,162,164,166,170,171,182,183,186,190,197,204,205 -Easy to implement.…”

“…IoT Networks in general Network traffic [105], [107], [109], [110], [111], [115], [116], [118], [119], [120], [126], [127], [129], [132], [136], [137], [139], [140], [142], [145], [146], [147], [149], [151], [153], [154], [158], [159], [162], [165], [166], [175], [178], [182], [183], [185], [186], [187], [190], [192], [194], [195], [196], [199], [200], [201], [202], [204],…”

IMDoC: Identification of Malicious Domain Campaigns via DNS and Communicating Files

“…Developing detection methods for cyber security can be divided broadly into two main approaches: signature-based detection [21]- [23] and anomaly-based detection [7], [15], [24]- [27]. To identify malicious domains, detection methods typically use DNS data, as considered in this paper.…”

“…One of the most popular ways of analyzing DNS traffic is to use passive DNS (pDNS) data (see [12]- [15] and references therein). The analysis is performed offline on a copy of live DNS traffic to study past DNS traffic patterns to evaluate the maliciousness of non-categorized domains.…”

“…Offline calculations overcome the need to process a huge amount of data in real-time. Recent studies have analyzed pDNS to isolate malicious domains and IP addresses, and identify infected machines [12]- [15]. However, developing robust methods to relate malicious domains to a malware campaign has not been addressed and is the main focus of this paper.…”