Towards a Conversational Agent for Threat Detection in the Internet of Things

Abstract

A conversational agent to detect anomalous traffic in consumer IoT networks is presented. The agent accepts two inputs in the form of user speech received by Amazon Alexa enabled devices, and classified IDS logs stored in a DynamoDB Table. Aural analysis is used to query the database of network traffic, and respond accordingly. In doing so, this paper presents a solution to the problem of making consumers situationally aware when their IoT devices are infected, and anomalous traffic has been detected. The proposed conversational agent addresses the issue of how to present network information to non-technical users, for better comprehension, and improves awareness of threats derived from the mirai botnet malware.

Intrusion Detection in Smart Homes: A pretest-posttest study of learning modalities for improved Cyber Situational Awareness

“…When applied to the Cyber domain, Cyber Situational Awareness (CSA) can be defined as the compilation, processing and fusing of network data to understand a network environment in order to accurately predict and respond to potential threats that might occur [17]. In this respect it is clearly linked to network security monitoring which can be traced back to Anderson's seminal work [18] that analysed security logs for anomalies.…”

SecBot: a Business-Driven Conversational Agent for Cybersecurity Planning and Management

“…This tool was planned to be used in large companies, where employees' faceto-face training is infeasible. [18] proposed a conversational agent to address the complexity of how to present network information to non-technical users about the behavior of IoT devices, helping identify when devices are part of a botnet. However, none of these solutions focus on business demands or directly explore different tasks involved in the decisionmaking, configuration, and cybersecurity management.…”

CyberOps: Situational Awareness in Cybersecurity Operations

“…Since the seminal work of Endsley (Endsley, 1995) situational awareness has been applied to a number of areas such as safety, security and transportation. Situational awareness has been applied in cyber security, vehicular networks, aviation, social media analytics and conversational agents (Onwubiko C., 2009, Eiza M. H., 2017, & McDermott, C. D., Jeannelle, B., and Isaacs, J. P., 2019.…”

“…situational awareness has been applied to a number of areas such as safety, security and transportation. Situational awareness has been applied in cyber security, vehicular networks, aviation, social media analytics and conversational agents(Onwubiko C., 2009, Eiza M. H., 2017, & McDermott, C. D., Jeannelle, B., and Isaacs, J. P., 2019.Cyber Situational Awareness (Cyber SA) has been defined in many ways in relation to cyber security, cyber defense, and cyber operations in general (see,McGuiness B., Foy J. L., 2000, Cumiford D. L., 2006and Tadda G. P., and Salerno J. S., 2010.…”