Detection of threats to IoT devices using scalable VPN-forwarded honeypots
Loading...
Access rights
openAccess
acceptedVersion
URL
Journal Title
Journal ISSN
Volume Title
A4 Artikkeli konferenssijulkaisussa
This publication is imported from Aalto University research portal.
View publication in the Research portal (opens in new window)
View/Open full text file from the Research portal (opens in new window)
Other link related to publication (opens in new window)
View publication in the Research portal (opens in new window)
View/Open full text file from the Research portal (opens in new window)
Other link related to publication (opens in new window)
Date
2019-03-13
Department
Major/Subject
Mcode
Degree programme
Language
en
Pages
12
Series
CODASPY 2019 - Proceedings of the 9th ACM Conference on Data and Application Security and Privacy, pp. 85-96
Abstract
Attacks on Internet of Things (IoT) devices, exploiting inherent vulnerabilities, have intensified over the last few years. Recent large-scale attacks, such as Persirai, Hakai, etc. corroborate concerns about the security of IoT devices. In this work, we propose an approach that allows easy integration of commercial off-the-shelf IoT devices into a general honeypot architecture. Our approach projects a small number of heterogeneous IoT devices (that are physically at one location) as many (geographically distributed) devices on the Internet, using connections to commercial and private VPN services. The goal is for those devices to be discovered and exploited by attacks on the Internet, thereby revealing unknown vulnerabilities. For detection and examination of potentially malicious traffic, we devise two analysis strategies: (1) given an outbound connection from honeypot, backtrack into network traffic to detect the corresponding attack command that caused the malicious connection and use it to download malware, (2) perform live detection of unseen URLs from HTTP requests using adaptive clustering. We show that our implementation and analysis strategies are able to detect recent large-scale attacks targeting IoT devices (IoT Reaper, Hakai, etc.) with overall low cost and maintenance effort.Description
Keywords
Adaptive clustering, Attack attribution, High-interaction IoT honeypot, Intrusion detection, Network traffic analysis
Other note
Citation
Tambe, A, Aung, Y L, Sridharan, R, Ochoa, M, Tippenhauer, N O, Shabtai, A & Elovici, Y 2019, Detection of threats to IoT devices using scalable VPN-forwarded honeypots . in CODASPY 2019 - Proceedings of the 9th ACM Conference on Data and Application Security and Privacy . ACM, pp. 85-96, ACM Conference on Data and Application Security and Privacy, Richardson, Texas, United States, 25/03/2019 . https://doi.org/10.1145/3292006.3300024