IoTPOT: A Novel Honeypot for Revealing Current IoT Threats

Pa, Yin Minn Pa; Suzuki, Sadao; Yoshioka, Katsunari; Matsumoto, Tsutomu; Kasama, Takahiro; Rossow, Christian

doi:10.2197/ipsjjip.24.522

Cited by 173 publications

(89 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Honeypots are one of the detection sources surveyed in this study. Honeypots have commonly been used for collecting, understanding, characterizing, and tracking botnets [6]. However, they are not necessarily useful for detecting compromised endpoints or the attacks emanating from them.…”

Section: Related Workmentioning

confidence: 99%

“…To launch an attack, the botnet infects Linux-based IoT devices by brute forcing default credentials of devices with open Telnet ports. In our research, the IoT devices were infected using the binaries from the IoTPOT dataset [6] (namely Gafgyt). In order to adjust the attacks to our lab, the IP address of the C&C server was extracted from the malware's binary, and all of the network traffic to this IP was routed to a server in our lab that functions as a C&C server.…”

Section: Empirical Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

Meidan

Bohadana

Mathov

et al. 2018

IEEE Pervasive Comput.

1,067

518

View full text Add to dashboard Cite

The proliferation of IoT devices which can be more easily compromised than desktop computers has led to an increase in the occurrence of IoT-based botnet attacks. In order to mitigate this new threat there is a need to develop new methods for detecting attacks launched from compromised IoT devices and differentiate between hour and millisecond long IoT-based attacks. In this paper we propose and empirically evaluate a novel network-based anomaly detection method which extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic emanating from compromised IoT devices. To evaluate our method, we infected nine commercial IoT devices in our lab with two of the most widely known IoT-based botnets, Mirai and BASHLITE. Our evaluation results demonstrated our proposed method's ability to accurately and instantly detect the attacks as they were being launched from the compromised IoT devices which were part of a botnet.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Empirical Evaluationmentioning

confidence: 99%

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

Meidan

Bohadana

Mathov

et al. 2018

IEEE Pervasive Comput.

1,067

518

View full text Add to dashboard Cite

show abstract

“…A multi architecture support IoT honeypot (IoTPOT) that detects at least 4 distributed denial of service malware families targeting Telnet based IoT [135]. IoTPOT is the first IOTPOT to publish its malware collected data.…”

Section: Tools In Iot Malware Synthesismentioning

confidence: 99%

Internet of Things Malware : A Survey

Karanja¹,

Masupe²,

Jeffrey³

2017

IJCSES

View full text Add to dashboard Cite

show abstract

“…Mirai also realizes similar attack stages (detailed in Sect. V-A3 below) as stateof-the-art IoT malware [3], [28]. This makes Mirai a highly relevant baseline for IoT malware behavior.…”

Section: Methodsmentioning

confidence: 99%

DÏoT: A Federated Self-learning Anomaly Detection System for IoT

Nguyen

Marchal

Miettinen

et al. 2019

2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS)

401

253

View full text Add to dashboard Cite

IoT devices are increasingly deployed in daily life. Many of these devices are, however, vulnerable due to insecure design, implementation, and configuration. As a result, many networks already have vulnerable IoT devices that are easy to compromise. This has led to a new category of malware specifically targeting IoT devices. However, existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different types of devices and manufacturers involved.In this paper, we present DÏOT, an autonomous self-learning distributed system for detecting compromised IoT devices. DÏOT builds effectively on device-type-specific communication profiles without human intervention nor labeled data that are subsequently used to detect anomalous deviations in devices' communication behavior, potentially caused by malicious adversaries. DÏOT utilizes a federated learning approach for aggregating behavior profiles efficiently. To the best of our knowledge, it is the first system to employ a federated learning approach to anomaly-detection-based intrusion detection. Consequently, DÏOT can cope with emerging new and unknown attacks. We systematically and extensively evaluated more than 30 off-theshelf IoT devices over a long term and show that DÏOT is highly effective (95.6 % detection rate) and fast (≈ 257 ms) at detecting devices compromised by, for instance, the infamous Mirai malware. DÏOT reported no false alarms when evaluated in a real-world smart home deployment setting.

show abstract

IoTPOT: A Novel Honeypot for Revealing Current IoT Threats

Cited by 173 publications

References 3 publications

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

Internet of Things Malware : A Survey

DÏoT: A Federated Self-learning Anomaly Detection System for IoT

Contact Info

Product

Resources

About