With current IoT architectures, once a single device in a network is compromised, it can be used to disrupt the behavior of other devices on the same network. Even though system administrators can secure critical devices in the network using best practices and state-of-the-art technology, a single vulnerable device can undermine the security of the entire network. The goal of this work is to limit the ability of an attacker to exploit a vulnerable device on an IoT network and fabricate deceitful messages to co-opt other devices. The approach is to limit attackers by using device proxies that are used to retransmit and control network communications. We present an architecture that prevents deceitful messages generated by compromised devices from affecting the rest of the network. The design assumes a centralized and trustworthy machine that can observe the behavior of all devices on the network. The central machine collects application layer data, as opposed to low-level network traffic, from each IoT device. The collected data is used to train models that capture the normal behavior of each individual IoT device. The normal behavioral data is then used to monitor the IoT devices and detect anomalous behavior. This paper reports on our experiments using both a binary classifier and a density-based clustering algorithm to model benign IoT device behavior with a realistic test-bed, designed to capture normal behavior in an IoT-monitored environment. Results from the IoT testbed show that both the classifier and the clustering algorithms are promising and encourage the use of application-level data for detecting compromised IoT devices.

中文翻译：

---

物联网的抗攻击架构


在当前的物联网架构中，一旦网络中的单个设备受到损害，它就可以用来破坏同一网络上其他设备的行为。尽管系统管理员可以使用最佳实践和最先进的技术来保护网络中的关键设备，但单个易受攻击的设备可能会破坏整个网络的安全。这项工作的目标是限制攻击者利用物联网网络上易受攻击的设备并伪造欺骗性消息来拉拢其他设备的能力。该方法是通过使用用于重新传输和控制网络通信的设备代理来限制攻击者。我们提出了一种架构，可以防止受感染设备生成的欺骗性消息影响网络的其余部分。该设计假设有一个集中且值得信赖的机器，可以观察网络上所有设备的行为。中央机器从每个物联网设备收集应用层数据，而不是低层网络流量。收集的数据用于训练捕获每个物联网设备正常行为的模型。然后，正常行为数据用于监控物联网设备并检测异常行为。本文报告了我们使用二元分类器和基于密度的聚类算法的实验，通过真实的测试台对良性物联网设备行为进行建模，旨在捕获物联网监控环境中的正常行为。物联网测试台的结果表明，分类器和聚类算法都很有前途，并鼓励使用应用程序级数据来检测受损的物联网设备。