Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3564625.3564644acmotherconferencesArticle/Chapter ViewAbstractPublication PagesacsacConference Proceedingsconference-collections
research-article
Open access

Stepping out of the MUD: Contextual threat information for IoT devices with manufacturer-provided behavior profiles

Published: 05 December 2022 Publication History

Abstract

Besides coming with unprecedented benefits, the Internet of Things (IoT) suffers deficits in security measures, leading to attacks increasing every year. In particular, network environments such as smart homes lack managed security capabilities to detect IoT-related attacks; IoT devices hosted therein are thus more easily targeted by threats. As such, context awareness of IoT infections is hard to achieve, preventing prompt response. In this work, we propose MUDscope, an approach to monitor malicious network activities affecting IoT systems in real-world consumer environments. We leverage the recent Manufacturer Usage Description (MUD) specification, which defines networking allow-lists for IoT devices in MUD profiles, to reflect consistent and necessarily-anomalous activities from smart things. Our approach characterizes this traffic and extracts signatures for given attacks. By analyzing attack signatures for multiple devices, we gather insights into emerging attack patterns. We evaluate our approach on both an existing dataset and a new, openly available dataset created for this research. We show that MUDscope detects several attacks targeting IoT devices with an F1-score of 95.77% and correctly identifies signatures for specific attacks with an F1-score of 87.72%.

References

[1]
Yehuda Afek, Anat Bremler-Barr, David Hay, Ran Goldschmidt, Lior Shafir, Gafnit Avraham, and Avraham Shalev. 2020. NFV-based IoT Security for Home Networks using MUD. In Proceedings of the IEEE/IFIP Network Operations and Management Symposium (NOMS). 1–9.
[2]
Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J Alex Halderman, Luca Invernizzi, Michalis Kallitsis, 2017. Understanding the mirai botnet. In 26th USENIX security symposium (USENIX Security 17). 1093–1110.
[3]
AT&T. n.d. AlienVault Open Source SIEM (OSSIM). https://cybersecurity.att.com/products/ossim
[4]
Xander Bouwman, Harm Griffioen, Jelle Egbers, Christian Doerr, Bram Klievink, and Michel van Eeten. 2020. A different cup of TI? The added value of commercial threat intelligence. In Proceedings of the USENIX Security Symposium.
[5]
[5] Censys.n.d. https://censys.io
[6]
CISCO. 2011. NetFlow version 9 Flow-Record Format. https://www.cisco.com/en/US/technologies/tk648/tk362/technologies_white_paper09186a00800a3db9.html
[7]
CISCO. n.d. Software-Defined Networking. https://www.cisco.com/c/en/us/solutions/software-defined-networking/overview.html
[8]
Andrei Costin and Jonas Zaddach. 2018. IoT Malware : Comprehensive Survey, Analysis Framework and Case Studies. In BlackHat USA. https://i.blackhat.com/us-18/Thu-August-9/us-18-Costin-Zaddach-IoT-Malware-Comprehensive-Survey-Analysis-Framework-and-Case-Studies-wp.pdf
[9]
Donna Dodson, Douglas Montgomery, Tim Polk, Mudumbai Ranganathan, Murugiah Souppaya, Steve Johnson, Ashwini Kadam, Craig Pratt, Darshak Thakore, Mark Walker, Eliot Lear, Brian Weis, William C. Barker, Dean Coclin, Avesta Hojjati, Clint Wilson, Tim Jones, Adnan Baykal, Drew Cohen, Kevin Yeich, Yemi Fashina, Parisa Grayeli, Joshua Harrington, Joshua Klosterman, Blaine Mulugeta, Susan Symington, and Jaideep Singh. 2021-05-25. Securing Small-Business and Home Internet of Things (IoT) Devices: Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD). In NIST SPECIAL PUBLICATION 1800-15. https://doi.org/10.6028/NIST.SP.1800-15
[10]
ENISA. 2021. Internet of Things (IoT) — ENISA. https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot
[11]
Angelo Feraudo, Poonam Yadav, Vadim Safronov, Diana Andreea Popescu, Richard Mortier, Shiqiang Wang, Paolo Bellavista, and Jon Crowcroft. 2020-04-27. CoLearn: enabling federated learning in MUD-compliant IoT edge networks. In Proceedings of the Third ACM International Workshop on Edge Systems, Analytics and Networking(EdgeSys ’20). Association for Computing Machinery, 25–30. https://doi.org/10.1145/3378679.3394528
[12]
Javier Franco, Ahmet Aris, Berk Canberk, and A. Selcuk Uluagac. 2021-08-04. A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems. arXiv:2108.02287 [cs](2021-08-04). arxiv:2108.02287http://arxiv.org/abs/2108.02287
[13]
Oscar Garcia-Morchon, Sandeep Kumar, and Mohit Sethi. 2019-04. RFC 8576 - Internet of Things (IoT) Security: State of the Art and Challenges. https://tools.ietf.org/html/rfc8576
[14]
Google. 2017. Definition of Federated Learning. https://ai.googleblog.com/2017/04/federated-learning-collaborative.html
[15]
Harm Griffioen, Tim M. Booij, and Christian Doerr. 2020. Quality Evaluation of Cyber Threat Intelligence Feeds. In Proceedings of the International Conference on Applied Cryptography and Network Security (ACNS), Mauro Conti, Jianying Zhou, Emiliano Casalicchio, and Angelo Spognardi (Eds.).
[16]
Harm Griffioen and Christian Doerr. 2020. Examining Mirai’s Battle over the Internet of Things. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS).
[17]
H. J. Griffioen. 2018. Scanners: Discovery of distributed slow scanners in telescope data. (2018). https://repository.tudelft.nl/islandora/object/uuid%3Adcb1669d-d81e-4aa3-bbd1-65049c3209c5
[18]
Shuai Guo, Wenbing Lin, Kaiyang Zhao, and Yang Su. 2021. Comparison of Clustering-based Network Traffic Anomaly Detection Methods. In 2021 IEEE 4th Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC), Vol. 4. 365–369. https://doi.org/10.1109/IMCEC51613.2021.9482304 ISSN: 2693-2776.
[19]
Ayyoob Hamza, Hassan Habibi Gharakheili, Theophilus A. Benson, and Vijay Sivaraman. 2019. Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity. In Proceedings of the ACM Symposium on SDN Research. Association for Computing Machinery.
[20]
Ayyoob Hamza, Hassan Habibi Gharakheili, and Vijay Sivaraman. 2018. Combining MUD Policies with SDN for IoT Intrusion Detection. In Proceedings of the Workshop on IoT Security and Privacy(IoT S&P ’18). Association for Computing Machinery. https://doi.org/10.1145/3229565.3229571
[21]
Ayyoob Hamza, Dinesha Ranathunga, Hassan Habibi Gharakheili, Theophilus Benson, Matthew Roughan, and Vijay Sivaraman. 2019. Verifying and Monitoring IoTs Network Behavior using MUD Profiles. CoRR abs/1902.02484(2019). arXiv:1902.02484http://arxiv.org/abs/1902.02484
[22]
Ayyoob Hamza, Dinesha Ranathunga, Hassan Habibi Gharakheili, Matthew Roughan, and Vijay Sivaraman. 2018. Clear as MUD: Generating, Validating and Applying IoT Behavioral Profiles. In Proceedings of the Workshop on IoT Security and Privacy. Association for Computing Machinery, 8–14.
[23]
Arne Holst. 2021. IoT connected devices worldwide 2019-2030. https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide/
[24]
Martin Husák, Nataliia Neshenko, Morteza Safaei Pour, Elias Bou-Harb, and Pavel Čeleda. 2018. Assessing Internet-wide Cyber Situational Awareness of Critical Sectors. In Proceedings of the International Conference on Availability, Reliability and Security. ACM, 1–6.
[25]
IETF. n.d. Internet Engineering Task Force. https://www.ietf.org/
[26]
Internet-Storm-Center. n.d. DShield Honeypot. https://isc.sans.edu/honeypot.html
[27]
Sille Kamoen. 2018. Honeytrack: Persistent honeypot for the Internet of Things. (2018). https://repository.tudelft.nl/islandora/object/uuid%3A344bd7aa-0a17-47dc-92fd-bd6f7e7b08c8
[28]
Hyunjae Kang, Dong Hyun Ahn, Gyung Min Lee, Jeong Do Yoo, Kyung Ho Park, and Huy Kang Kim. 2019. IoT network intrusion dataset. IEEE Dataport. https://doi.org/10.21227/q70p-q449
[29]
Biar Koshnaw and Steven Furnell. 2022. Assessing cyber security consumer support from technology retailers. Computer Fraud & Security 2022, 3 (2022).
[30]
Eliot Lear, Dan Romascanu, and Ralph Droms. 2019-03. IETF RFC 8520 - Manufacturer Usage Description (MUD) Specification. https://tools.ietf.org/html/rfc8520
[31]
Antonio Mangino, Morteza Safaei Pour, and Elias Bou-Harb. 2020-10-12. Internet-scale Insecurity of Consumer Internet of Things: An Empirical Measurements Perspective. ACM Transactions on Management Information Systems 11, 4(2020-10-12), 21:1–21:24. https://doi.org/10.1145/3394504
[32]
Sara Nieves Matheu, Alejandro Molina Zarca, José Luis Hernández-Ramos, Jorge Bernal Bernabé, and Antonio Skarmeta Gómez. 2019-10-28. Enforcing Behavioral Profiles through Software-Defined Networks in the Industrial Internet of Things. Applied Sciences 9, 21 (2019-10-28), 4576. https://doi.org/10.3390/app9214576
[33]
Sara Nieves Matheu, José Luis Hernández Ramos, Salvador Pérez, and Antonio F. Skarmeta. 2019. Extending MUD Profiles Through an Automated IoT Security Testing Methodology. IEEE Access 7(2019), 149444–149463. https://doi.org/10.1109/ACCESS.2019.2947157
[34]
Leland McInnes and Steven Horn. 2017-11-10. How HDBSCAN Works — hdbscan 0.8.1 documentation. https://hdbscan.readthedocs.io/en/latest/how_hdbscan_works.html
[35]
Leland McInnes and Marek Suppa. 2018-12-31. Benchmarking Performance and Scaling of Python Clustering Algorithms — hdbscan 0.8.1 documentation. https://hdbscan.readthedocs.io/en/latest/performance_and_scalability.html
[36]
Dave McMillen. 2021. Internet of Threats: IoT Botnets Drive Surge in Network Attacks. https://securityintelligence.com/posts/internet-of-threats-iot-botnets-network-attacks/
[37]
Max Meijer, Giacomo Tommaso Petrucci, Matthjis Schotsman, Luca Morgese Zangrandi, Thjis van Ede, Andrea Continella, Ganduulga Gankhuyag, Luca Allodi, and Savio Sciancalepore. 2022. Federated Lab (FedLab): An Open-source Distributed Platform for Internet of Things (IoT) Research and Experimentation. In IEEE World Forum on IoT.
[38]
MITRE. n.d. ATT&CK Framework. https://attack.mitre.org/
[39]
David Moore. 2003. Network Telescopes: Tracking Denial-of-Service Attacks and Internet Worms Around the Globe. In Proceedings of the 17th Conference on Systems Administration (LISA 2003), San Diego, California, USA, October 26-31, 2003, Æleen Frisch (Ed.). USENIX.
[40]
Luca Morgese Zangrandi and Thijs van Ede. 2022. MUDscope tool. https://github.com/lucamrgs/MUDscope
[41]
Luca Morgese Zangrandi, Thijs van Ede, Tim Booij, Savio Sciancalepore, Luca Allodi, and Andrea Continella. 2022. MUDscope Dataset. https://doi.org/10.5281/zenodo.7182597
[42]
Nataliia Neshenko, Elias Bou-Harb, Jorge Crichigno, Georges Kaddoum, and Nasir Ghani. 2019. Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-Scale IoT Exploitations. IEEE Commun. Surv. Tutorials 21, 3 (2019), 2702–2733. https://doi.org/10.1109/COMST.2019.2910750
[43]
NETSCOUT. 2021. Cyber Security & Threat Intelligence Report | NETSCOUT. https://www.netscout.com/threatreport/
[44]
NIST. n.d. MUD Related Resources. https://www.nccoe.nist.gov/mud-related-resources
[45]
[45] Numpy.n.d. https://numpy.org/
[46]
Open Networking Foundation. 2012-09-06. OpenFlow Switch Specification (1.3.1). https://opennetworking.org/wp-content/uploads/2013/04/openflow-spec-v1.3.1.pdf
[47]
Yin Minn Pa Pa, Shogo Suzuki, Katsunari Yoshioka, Tsutomu Matsumoto, Takahiro Kasama, and Christian Rossow. 2015. IoTPOT: Analysing the Rise of IoT Compromises. In Proceedings of the USENIX Workshop on Offensive Technologies (WOOT).
[48]
Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, and Larry Peterson. 2004. Characteristics of internet background radiation. In Proceedings of the ACM SIGCOMM conference on Internet measurement (IMC).
[49]
Morteza Safaei Pour, Elias Bou-Harb, Kavita Varma, Nataliia Neshenko, Dimitris A.Pados, and Kim-Kwang Raymond Chooc. 2019-04-01. Comprehending the IoT cyber threat landscape: A data dimensionality reduction technique to infer and characterize Internet-scale IoT probing campaigns. Digital Investigation 28(2019-04-01), S40–S49. https://doi.org/10.1016/j.diin.2019.01.014
[50]
Morteza Safaei Pour, Dylan Watson, and Elias Bou-Harb. 2021. Sanitizing the IoT Cyber Security Posture: An Operational CTI Feed Backed up by Internet Measurements. In Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN).
[51]
Philipp Richter and Arthur Berger. 2019. Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope. In Proceedings of the ACM Internet Measurement Conference (IMC). 144–157.
[52]
Andrew Rosenberg and Julia Hirschberg. 2007. V-measure: A conditional entropy-based external cluster evaluation measure. In Proceedings of the 2007 joint conference on empirical methods in natural language processing and computational natural language learning (EMNLP-CoNLL). 410–420.
[53]
Morteza Safaei Pour, Antonio Mangino, Kurt Friday, Matthias Rathbun, Elias Bou-Harb, Farkhund Iqbal, Sagar Samtani, Jorge Crichigno, and Nasir Ghani. 2020-04-01. On data-driven curation, learning, and analysis for inferring evolving internet-of-Things (IoT) botnets in the wild. Computers & Security 91(2020-04-01), 101707. https://doi.org/10.1016/j.cose.2019.101707
[54]
Syed Muhammad Sajjad, Muhammad Yousaf, Humaira Afzal, and Muhammad Rafiq Mufti. 2020. eMUD: Enhanced Manufacturer Usage Description for IoT Botnets Prevention on Home WiFi Routers. IEEE Access 8(2020), 164200–164213. https://doi.org/10.1109/ACCESS.2020.3022272
[55]
Jibran Saleem, Mohammad Hammoudeh, Umar Raza, Bamidele Adebisi, and Ruth Ande. 2018-06-26. IoT standardisation: challenges, perspectives and solution. In Proceedings of the 2nd International Conference on Future Networks and Distributed Systems(ICFNDS ’18). Association for Computing Machinery, 1–9. https://doi.org/10.1145/3231053.3231103
[56]
[56] Scapy.n.d. https://scapy.net/
[57]
C. J. T. M. Schutijser. 2018-08-30. Towards automated DDoS abuse protection using MUD device profiles. (2018-08-30). http://essay.utwente.nl/76207/
[58]
[58] Scikit-learn.n.d. https://scikit-learn.org/stable/
[59]
Tara Seals. 2021-09-06. IoT Attacks Skyrocket, Doubling in 6 Months. https://threatpost.com/iot-attacks-doubling/169224/
[60]
Farooq Shaikh, Elias Bou-Harb, Nataliia Neshenko, Andrea P. Wright, and Nasir Ghani. 2018-09. Internet of Malicious Things: Correlating Active and Passive Measurements for Inferring and Characterizing Internet-Scale Unsolicited IoT Devices. IEEE Communications Magazine 56, 9 (2018-09), 170–177. https://doi.org/10.1109/MCOM.2018.1700685
[61]
[61] Shodan.n.d. https://www.shodan.io
[62]
Armin Ziaie Tabari and Xinming Ou. 2020. A First Step Towards Understanding Real-world Attacks on IoT Devices. CoRR abs/2003.01218(2020). arXiv:2003.01218https://arxiv.org/abs/2003.01218
[63]
Sahrish Khan Tayyaba, Munam Ali Shah, Omair Ahmad Khan, and Abdul Wahab Ahmed. 2017-07-19. Software Defined Network (SDN) Based Internet of Things (IoT): A Road Ahead. In Proceedings of the International Conference on Future Networks and Distributed Systems. ACM.
[64]
[64] tcpdump.n.d. https://www.tcpdump.org/
[65]
Sadegh Torabi, Elias Bou-Harb, Chadi Assi, Mario Galluscio, Amine Boukhtouta, and Mourad Debbabi. 2018. Inferring, Characterizing, and Investigating Internet-Scale Malicious IoT Device Activities: A Network Telescope Perspective. In Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN).
[66]
Haseeb Touqeer, Shakir Zaman, Rashid Amin, Mudassar Hussain, Fadi Al-Turjman, and Muhammad Bilal. 2021. Smart home security: challenges, issues and solutions at different IoT layers. The Journal of Supercomputing 77, 12 (2021), 14053–14089.
[67]
Ubuntu. 2019. nfdump manual. https://manpages.ubuntu.com/manpages/xenial/man1/nfdump.1.html
[68]
M. van Staalduinen and Y. Joshi. 2019. The IoT security landscape: adoption and harmonisation of security solutions for the internet of things. Technical Report. TNO. https://repository.tno.nl/islandora/object/uuid%3A989e7450-206f-4f7c-93aa-5587e4674781
[69]
Alexander Vetterl and Richard Clayton. 2018. Bitter Harvest: Systematically Fingerprinting Low- and Medium-interaction Honeypots at Internet Scale. In Proceedings of the USENIX Workshop on Offensive Technologies (WOOT).
[70]
Nguyen Xuan Vinh, Julien Epps, and James Bailey. 2010. Information theoretic measures for clusterings comparison: Variants, properties, normalization and correction for chance. The Journal of Machine Learning Research(2010).
[71]
[71] Wireshark.n.d. https://www.wireshark.org/
[72]
Chun-Jung Wu, Katsunari Yoshioka, and Tsutomu Matsumoto. 2020. ThingGate: A Gateway for Managing Traffic of Bare-metal IoT Honeypot. Journal of Information Processing 28, 0 (2020), 481–492. https://doi.org/10.2197/ipsjjip.28.481

Cited By

View all
  • (2024)Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused ProtocolsProceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3678890.3678899(561-578)Online publication date: 30-Sep-2024
  • (2024)Realizing Open and Decentralized Marketplace for Exchanging Data of Expected IoT BehaviorsNOMS 2024-2024 IEEE Network Operations and Management Symposium10.1109/NOMS59830.2024.10575272(1-5)Online publication date: 6-May-2024
  • (2024)Traditional IOCs Meet Dynamic App–Device Interactions for IoT-Specific Threat IntelligenceIEEE Internet of Things Journal10.1109/JIOT.2024.341335111:19(30571-30593)Online publication date: 1-Oct-2024
  • Show More Cited By

Index Terms

  1. Stepping out of the MUD: Contextual threat information for IoT devices with manufacturer-provided behavior profiles

        Recommendations

        Comments

        Information & Contributors

        Information

        Published In

        cover image ACM Other conferences
        ACSAC '22: Proceedings of the 38th Annual Computer Security Applications Conference
        December 2022
        1021 pages
        ISBN:9781450397599
        DOI:10.1145/3564625
        This work is licensed under a Creative Commons Attribution International 4.0 License.

        Publisher

        Association for Computing Machinery

        New York, NY, United States

        Publication History

        Published: 05 December 2022

        Check for updates

        Badges

        Author Tags

        1. IoT
        2. MUD
        3. network security
        4. threat intelligence

        Qualifiers

        • Research-article
        • Research
        • Refereed limited

        Funding Sources

        • NWO

        Conference

        ACSAC

        Acceptance Rates

        Overall Acceptance Rate 104 of 497 submissions, 21%

        Contributors

        Other Metrics

        Bibliometrics & Citations

        Bibliometrics

        Article Metrics

        • Downloads (Last 12 months)411
        • Downloads (Last 6 weeks)31
        Reflects downloads up to 26 Dec 2024

        Other Metrics

        Citations

        Cited By

        View all
        • (2024)Large-Scale Security Analysis of Real-World Backend Deployments Speaking IoT-Focused ProtocolsProceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses10.1145/3678890.3678899(561-578)Online publication date: 30-Sep-2024
        • (2024)Realizing Open and Decentralized Marketplace for Exchanging Data of Expected IoT BehaviorsNOMS 2024-2024 IEEE Network Operations and Management Symposium10.1109/NOMS59830.2024.10575272(1-5)Online publication date: 6-May-2024
        • (2024)Traditional IOCs Meet Dynamic App–Device Interactions for IoT-Specific Threat IntelligenceIEEE Internet of Things Journal10.1109/JIOT.2024.341335111:19(30571-30593)Online publication date: 1-Oct-2024
        • (2023)Comparative Analysis of State-of-the-Art Attack Detection Models2023 14th International Conference on Computing Communication and Networking Technologies (ICCCNT)10.1109/ICCCNT56998.2023.10306428(1-7)Online publication date: 6-Jul-2023
        • (2023)Detecting compromised IoT devicesComputers and Security10.1016/j.cose.2023.103384132:COnline publication date: 1-Sep-2023

        View Options

        View options

        PDF

        View or Download as a PDF file.

        PDF

        eReader

        View online with eReader.

        eReader

        HTML Format

        View this article in HTML Format.

        HTML Format

        Login options

        Media

        Figures

        Other

        Tables

        Share

        Share

        Share this Publication link

        Share on social media