The recent spate of cyber attacks and security threats toward Internet-of-Things (IoT) systems in smart cities, smart homes, and industry 4.0 calls for effective techniques to understand if, when, who, what IoT systems are exploited and compromised by Internet attackers. Toward this end, this article attempts to study DNS behavioral patterns of IoT systems in edge networks as a first step of characterizing their communication patterns and their interactions with IoT users, cloud servers, and other IoT or non-IoT devices in the same edge networks. Specifically, we analyze the temporal-spatial patterns of DNS behaviors of a variety of IoT systems in two dozens of edge networks and develop a simple yet effective Bloom filter mechanism for detecting anomalous traffic patterns based on unusual DNS queries and answers. To the best of our knowledge, this article is the first effort to systematically measure and monitor IoT network traffic from a DNS perspective for providing the security of heterogeneous IoT systems and ensuring IoT user privacy.

中文翻译：

---

表征边缘网络中物联网的 DNS 行为


最近，针对智慧城市、智能家居和工业 4.0 中的物联网 (IoT) 系统的一系列网络攻击和安全威胁，需要有效的技术来了解物联网系统是否、何时、谁以及哪些物联网系统被互联网利用和破坏。攻击者。为此，本文尝试研究边缘网络中物联网系统的 DNS 行为模式，作为表征其通信模式及其与同一边缘网络中的物联网用户、云服务器和其他物联网或非物联网设备的交互的第一步。具体来说，我们分析了两打边缘网络中各种物联网系统的 DNS 行为的时空模式，并开发了一种简单而有效的布隆过滤器机制，用于根据异常的 DNS 查询和答案检测异常流量模式。据我们所知，本文首次从 DNS 角度系统地测量和监控物联网网络流量，以提供异构物联网系统的安全性并确保物联网用户隐私。