Lightweight collaborative anomaly detection for the IoT using blockchain

Highlights

• Efficient software exploit detection can be performed on IoT devices by modeling the application’s control-flow over regions of memory. The additional overhead of using the proposed method is negligible (6% CPU and 0.8% memory of a Raspberry Pi 3B).

• The modeling (training) of an anomaly detection model can be performed across numerous devices in parallel using an Extensible Markov chain. Safe collaboration requires both self-attestation and abnormality-filtration when sharing and merging knowledge among participants.

• Using a blockchain protocol, IoT devices can collaborate with each other on forming a single trusted and robust anomaly detection model.

• Collaborative training, using the proposed framework, significantly reduces the train-time, lowers the false positive rate, and makes the overall process resistant to adversarial poising attacks.

• Deadlocks in p2p blockchain sharing/collaboration can be prevented through a direct messaging protocol, proven in this paper.

Abstract

Due to their rapid growth and deployment, the Internet of things (IoT) have become a central aspect of our daily lives. Unfortunately, IoT devices tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can be used to secure these devices in a plug-and-protect manner. However, anomaly detection models must be trained for a long time in order to capture all benign behaviors. Furthermore, the anomaly detection model is vulnerable to adversarial attacks since, during the training phase, all observations are assumed to be benign. In this paper, we propose (1) a novel approach for anomaly detection and (2) a lightweight framework that utilizes the blockchain to ensemble an anomaly detection model in a distributed environment. Blockchain framework incrementally updates a trusted anomaly detection model via self-attestation and consensus among the IoT devices. We evaluate our method on a distributed IoT simulation platform, which consists of 48 Raspberry Pis. The simulation demonstrates how the approach can enhance the security of each device and the security of the network as a whole.

Introduction

The Internet of Things (IoT) is the next evolution of the Internet [30] where devices, of any kind and size, will exchange and share data autonomously among themselves. By exchanging data, each device can improve their decision-making processes. IoT devices are ubiquitous in our daily lives and critical infrastructure. For example, air conditioners, irrigation systems, refrigerators, and railway sensors [59] have been connected to the Internet in order to provide services and share information with the relevant controllers. Due to the benefits of connecting devices to the Internet, massive quantities of IoT devices have been developed and deployed. This has led leading experts to believe that by 2020 there will be more than 20 billion devices connected to the Internet [18].

While the potential for IoT devices is vast, their success depends on how well we can secure these devices. However, IoTs are diverse and have limited resources. Therefore, securing them is a difficult challenge which has taken a central stage in both industry and academia. One significant security concern with IoTs is that many manufactures do not invest in the security of these devices during their development. Furthermore, discovered vulnerabilities are seldom patched by the manufacture [52]. These vulnerabilities enable attackers to exploit the IoT devices for nefarious purposes [53] which endanger the users’ security and privacy.

There are various security tools for detecting attacks on embedded devices. One such tool is an intrusion detection system (IDS). An anomaly-based IDSs learn the normal behavior of a network or host, and detect when the behavior deviates from the norm. In this way, these systems have the potential to detect new threats without being explicit programmed to do so (e.g., via remote updates). Aside from being able to detect novel ‘zero-day’ attacks, this approach is desirable because there is vertically no maintenance required.

In order to prepare an anomaly-based IDS (or any anomaly detection model), the system must collect and learn from normal observations acquired during a time-limited “training phase”. A fundamental assumption is that the observations obtained during the training phase are both benign and capture all of the device’s possible behaviors. This assumption might hold true in some systems. However, when considering the IoT environment, this assumption is challenging for the following reasons:

• Model Generality It is possible to train the anomaly detection model safely in a lab environment. However, it is difficult to simulate all the possible deployments and interactions with the device. This is because some logic may be dependent on one or more environmental sensors, human interaction, and event based triggers. This approach is also costly and required additional resources. Alternatively, the model can be trained on-site during the deployment itself. However, the model will not be available for execution (detection of threats) until the training phase is complete. Furthermore, it is questionable whether the trained model will capture benign yet rare behaviors. For example, the behavior of the motion detection logic of a smart camera or the response generated by a smoke detector while sensing a fire. These rare but legitimate behaviors will generate false alarms during regular execution.

• Adversarial Attacks Although training on-site is a more natural approach to learning the normal behavior of an IoT device, the model must assume that all observation during the training-phase are benign. This approach exposes the model to malicious observations, thus enabling an attacker to exploit the device to evade detection or cause some other adverse effect.

To overcome these challenges, the IoT devices can collaborate and train an anomaly detection model together. Consider the following scenario:

Assume that all IoT devices of the same type simultaneously begin training an anomaly detection model, based on their own locally observed behaviors. The devices then share their models with other devices of the same type. Finally, each device merges the received models, into a single model by filtering out potentially malicious behaviors. Finally, each device uses the combined model as it’s own local anomaly detection model. As a result, the devices (1) collectively obtain an anomaly detection model which captures a much wider scope of all possible benign behaviors, and (2) are able to significantly limit adversarial attacks during the training phase. The latter point is because the initial training phase is much shorter (scaled according to the number of devices), and rare behaviors unseen by the majority are filtered out.

Using concept, we present a lightweight, scalable framework which utilizes the blockchain concept to perform distributed and collaborative anomaly detection on devices with limited resources.

A blockchain is an innovative protocol for a distributed database, which is implemented as a chain of blocks and managed by the majority of participants in the network [61]. Each block contains a list of records and a hash value of the previous block and is accepted into the chain if it satisfies a specific criteria (e.g., bitcoin’s proof-of-work criterion [43]). The framework uses the blockchain’s concept to define a collaboration protocol which enables devices to autonomously train a trusted anomaly detection model incrementally. The protocol uses self-attestation and consensus among the IoT devices to protect the integrity of the trained model. In our blockchain, a record in a block is a model trained on a specific device, and a block in the chain represents a potential anomaly detection model which has been verified by a significant mass/majority of devices in the system. By using the blockchain as a secured distributed ledger, we ensure that the devices (1) are using the latest validated anomaly detection model, and (2) can continuously contribute to each other’s model with newly observed benign behaviors.

Furthermore, in this paper we also propose a novel approach for performing anomaly detection on a local device using an Extensible Markov Model (EMM) [10]. The EMM tracks a program’s jump sequences between regions on the application’s memory space. The EMM can be incrementally updated and merged with other models, and therefore can be trained with real-world observations across multiple devices in parallel. Although there are many other methods for modeling sequences, we chose the EMM model because:

• The update and prediction procedures have a complexity of $O\left(1\right)$. This is critical considering that many IoT devices have weak processors.

• Our collaborative framework requires a model which can be merged with other models efficiently. Moreover, to filter out malicious transitions during the combine step, we needed an efficient and clear algorithm for comparing learned behaviors between different models. The process of comparing and combining other discrete transitional anomaly detection models can be complex or simply has not been defined.

• In our evaluations, we found that the EMM performs better than other algorithms in our anomaly detection task.

We evaluate both the framework and the anomaly detection model on our own IoT emulation platform, involving 48 Raspberry Pis. We simulate several different IoT devices to assert that the evaluation results do not depend on the IoT device’s functionality. Moreover, we exploit real vulnerabilities in order to evaluate our method’s capability in detecting actual attacks. From our evaluations, we found that our method is capable in creating strong anomaly detection models in a short period of time, which are resistant to adversarial attacks. To encourage further research and development, the reader may download our data sets and source code from GitHub.¹ We have also published a blockchain simulator for our protocol to help the reader understand and implement the work in this paper.²

In summary, this paper’s contributions are:

• A method for detecting code execution attacks by modeling memory jumps sequences — We define and evaluate a novel approach to efficiently detect abnormal control-flows at a set granularity. The approach is efficient because we track the program counter’s flow between regions of memory, and not actual memory addresses or system calls. As a result, the model is compact (has relatively few states) and is suitable for devices with limited resources (IoT devices).

• A method for enabling safe distributed and collaborative model training on IoTs — We outline a novel framework and protocol which uses the concept of blockchain to collaboratively train an anomaly detection model. The method is decentralized, reduces train time, false positives, and is robust against potential adversarial attacks during the initial training phase.

The rest of the paper is organized as follows. In Section 2, we review related work, and discuss how the proposed method overcomes their limitations. In Sections 3 The anomaly detection model, 4 The framework, we present introduce our novel host-based anomaly detection algorithm and the framework for applying the algorithm in the collaborative distributed setting using the blockchain. In Section 5, we evaluate the proposed method on several different applications and use-cases, and discuss our insights. In Section 6 we analyze the framework’s security. In Section 7, we provide a discussion on the security and challenges of implementing the proposed framework. Finally, in Section 8 we present a summary and conclusion.