Detecção de ataques de negação de serviço em dispositivos IoT

Abstract

The increasing popularization of the Internet of Things (IoT) and the wide range of devices connected to the Internet increases the risk of malware infection, due to the many vulnerabilities of the IoT. Therefore, it is essential to develop mechanisms capable of mitigating the impacts of these attacks. In order to identify malicious data flows, several studies in the literature have used synthetic data or very small real datasets to develop models based primarily on Deep Packet Inspection (DPI). The main objective of this work is to efficiently detect Denial of Service attacks (DoS) on IoT devices, using as little information as possible. The dataset used in the experiments has real traffic data collected from more than 800 customers from an ISP and attack traffic generated in the laboratory using the source code of the BASHLITE and Mirai botnets. Initially, a methodology for identifying equipment in the dataset was developed and then a framework for attack detection was proposed. The framework has two key elements: algorithm for feature selection and supervised machine learning models. The results obtained showed that Random Forest was the algorithm with the best performance to identify the presence of attacks on IoT devices, with precision and recall values higher than 0.9776 and 0.9930, respectively. It is also shown that Random Forest’s performance for malicious traffic detection was better than threshold-based policies, which confirms that IoT attack detection is a non-trivial task. Thus, the simple approach proposed in this work demonstrated to be able to detect different attack vectors in a very efficient way.