Detection of Threats to IoT Devices using Scalable VPN-forwarded Honeypots

Abstract

Attacks on Internet of Things (IoT) devices, exploiting inherent vulnerabilities, have intensified over the last few years. Recent large-scale attacks, such as Persirai, Hakai, etc. corroborate concerns about the security of IoT devices. In this work, we propose an approach that allows easy integration of commercial off-the-shelf IoT devices into a general honeypot architecture. Our approach projects a small number of heterogeneous IoT devices (that are physically at one location) as many (geographically distributed) devices on the Internet, using connections to commercial and private VPN services. The goal is for those devices to be discovered and exploited by attacks on the Internet, thereby revealing unknown vulnerabilities. For detection and examination of potentially malicious traffic, we devise two analysis strategies: (1) given an outbound connection from honeypot, backtrack into network traffic to detect the corresponding attack command that caused the malicious connection and use it to download malware, (2) perform live detection of unseen URLs from HTTP requests using adaptive clustering. We show that our implementation and analysis strategies are able to detect recent large-scale attacks targeting IoT devices (IoT Reaper, Hakai, etc.) with overall low cost and maintenance effort. CCS CONCEPTS • Security and privacy → Intrusion detection systems; Malware and its mitigation;

IoT Botnet Attack Detection Based on Optimized Extreme Gradient Boosting and Feature Selection

“…Others were related to wireless sensor networks (WSNs) [22][23][24], cloud computing [25], cyber-physical systems [26], and wide area networks (WANs) [27][28][29]. The recent spread of IoT devices has introduced new threats such as botnet attacks [30]. Such attacks appear to compromise the victim devices, and the attacks can be coordinated.…”

The Security of IP-based Video Surveillance Systems

“…Therefore, we believe future research should focus on providing an external continuous protection that can be easily updated with information on newly discovered attacks. One way to collect intelligence on emerging threats to surveillance systems is to use an advanced honeypot system [29]. Moreover, by identifying emerging exploits, administrators can protect their systems before they get infected.…”

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems

“…Tambe et al [86] proposed a scalable high interaction honeypot to attract and detect large scale botnet attacks. In order to solve the scalability problem of high interaction honeypots using real devices, Tambe et al used VPN tunnels which allowed a small number of real IoT devices to appear as multiple IoT devices with different IP addresses around the world.…”