Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering

Feraudo, Angelo; Popescu, Diana Andreea; Yadav, Poonam; Mortier, Richard; Bellavista, Paolo

doi:10.1145/3631461.3631549

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2024

Publication Types

Select...

Other2

Article1

Book1

Relationship

Self Cite0

Independent4

Authors

Journals

Cited by 4 publications

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Defid: Detecting and Filtering Distributed Denial of Service Attack in Edge Computing Environment

Pereira Gollnick,

Ranjan,

Jha

2024

2024 International Conference on Artificial Intelligence of Things and Systems (AIoTSys)

View full text Add to dashboard Cite

Defid: Detecting and Filtering Distributed Denial of Service Attack in Edge Computing Environment

Pereira Gollnick,

Ranjan,

Jha

2024

2024 International Conference on Artificial Intelligence of Things and Systems (AIoTSys)

View full text Add to dashboard Cite

Demo: Battery Depletion Attack Through Packet Injection on IoT Thread Mesh Network

Yadav,

Sagathia,

Wade

2024

2024 16th International Conference on COMmunication Systems &Amp; NETworkS (COMSNETS)

View full text Add to dashboard Cite

An Architecture of Enhanced Profiling Assurance for IoT Networks

Aroon,

Liu,

Kane

et al. 2024

Electronics

View full text Add to dashboard Cite

Attacks launched from IoT networks can cause significant damage to critical network systems and services. IoT networks may contain a large volume of devices. Protecting these devices from being abused to launch traffic amplification attacks is critical. The manufacturer usage description (MUD) architecture uses pre-defined stateless access control rules to allow or block specific network traffic without stateful communication inspection. This can lead to false negative filtering of malicious traffic, as the MUD architecture does not include the monitoring of communication states to determine which connections to allow through. This study presents a novel solution, the enhanced profiling assurance (EPA) architecture. It incorporates both stateless and stateful communication inspection, a unique approach that enhances the detection effectiveness of the MUD architecture. EPA contains layered intrusion detection and prevention systems to monitor stateful and stateless communication. It adopts three-way decision theory with three outcomes: allow, deny, and uncertain. Packets that are marked as uncertain must be continuously monitored to determine access permission. Our analysis, conducted with two network scenarios, demonstrates the superiority of the EPA over the MUD architecture in detecting malicious activities.

show abstract

Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering

Cited by 4 publications

References 26 publications

Defid: Detecting and Filtering Distributed Denial of Service Attack in Edge Computing Environment

Defid: Detecting and Filtering Distributed Denial of Service Attack in Edge Computing Environment

Demo: Battery Depletion Attack Through Packet Injection on IoT Thread Mesh Network

An Architecture of Enhanced Profiling Assurance for IoT Networks

Contact Info

Product

Resources

About