With current IoT architectures, once a single device in a network is compromised, it can be used to disrupt the behavior of other devices on the same network. Even though system administrators can secure critical devices in the network using best practices and state-of-the-art technology, a single vulnerable device can undermine the security of the entire network. The goal of this work is to limit the ability of an attacker to exploit a vulnerable device on an IoT network and fabricate deceitful messages to co-opt other devices. The approach is to limit attackers by using device proxies that are used to retransmit and control network communications. We present an architecture that prevents deceitful messages generated by compromised devices from affecting the rest of the network. The design assumes a centralized and trustworthy machine that can observe the behavior of all devices on the network. The central machine collects application layer data, as opposed to low-level network traffic, from each IoT device. The collected data is used to train models that capture the normal behavior of each individual IoT device. The normal behavioral data is then used to monitor the IoT devices and detect anomalous behavior. This paper reports on our experiments using both a binary classifier and a density-based clustering algorithm to model benign IoT device behavior with a realistic test-bed, designed to capture normal behavior in an IoT-monitored environment. Results from the IoT testbed show that both the classifier and the clustering algorithms are promising and encourage the use of application-level data for detecting compromised IoT devices.

中文翻译：

---

物联网的抗攻击架构

使用当前的物联网架构，一旦网络中的单个设备受到威胁，就可以用来破坏同一网络中其他设备的行为。即使系统管理员可以使用最佳实践和最新技术保护网络中的关键设备，单个易受攻击的设备也可能破坏整个网络的安全性。这项工作的目标是限制攻击者利用物联网网络上易受攻击的设备并捏造欺骗性消息以选择其他设备的能力。该方法是通过使用用于重新传输和控制网络通信的设备代理来限制攻击者。我们提出了一种架构，可以防止受感染设备生成的欺骗性消息影响网络的其余部分。该设计假设一个集中的，可信赖的机器可以观察网络上所有设备的行为。中央机器从每个IoT设备收集应用程序层数据，而不是底层网络流量。收集的数据用于训练模型，以捕获每个单独的IoT设备的正常行为。然后，将正常的行为数据用于监视IoT设备并检测异常行为。本文报告了我们的实验，该实验使用二进制分类器和基于密度的聚类算法，通过真实的测试台对良性IoT设备行为进行建模，旨在捕获IoT监控环境中的正常行为。