Peek-a-boo

How Machine Learning Changes the Nature of Cyberattacks on IoT Networks: A Survey

“…Fingerprinting attacks have also been studied, by taking into account several types of IoT devices operating on several different (e.g. Bluetooth Low Energy, WiFi, ZigBee) [117]. Not only is it possible to guess what type of IoT device is used in a given environment, but also the activity of the device (on / off) can be identified.…”

“…In [120], the authors have the same objectives as [117] but develop a new attack more resistant to detection methods and countermeasures such as traffic shaping. For this, the authors have created a 'Ping-Pong' tool, which makes it possible to automate the collection of data and to deduce the type of activity of a device.…”

Every Byte Matters

“…We infer sensitive information from the encrypted communications of wearable devices by using traffic-analysis attacks [44], a technique that exploits the communication patterns (e.g., packet sizes and timings) of encrypted traffic. These attacks have been successfully demonstrated in diverse settings: to recognize web pages on Tor traffic [48,67,88,89], to fingerprint devices [68] or to infer the activities performed in a user's smart home [17,81] and to recognize user activities and applications used on a smartphone (e.g., sending an e-mail or browsing a web page) [42,76,83,84,94]. The focus of recent related works has been on inferring user activities in the IoT and smart home setting [17,21,27,28,85], eavesdropping on WLAN or Internet traffic (or both).…”

“…Second, they show how the traffic is linked to the gait of the wearer, and that the encrypted traffic is enough to recognize a person with 97.6% accuracy across 10 users. Acar et al infer user actions in a smart home using a layered traffic-analysis attack [17]. Their methodology is similar to ours: they first perform device identification and then use it as a stepping stone to further infer device states and user activities.…”

“…Traffic-analysis attacks have also been applied on TLS traffic, for instance, to recognize a streamed video [72,73,77] or to identify the operating system and the applications [65]. Many recent related works focus on IoT traffic and smart homes [17,21,27,28,81,85]; while these works often employ a similar attack methodology, they do not consider the same ecosystem of devices, applications and actions. We focus on devices and applications that have access to live fitness-or health-related information of the wearer, both in a fine-grained manner and over a long period of time.…”