IoTEnsemble: Detection of Botnet Attacks on Internet of Things

Abstract

As the Internet of Things (IoT) plays an increasingly important role in real life, the concern about IoT malware and botnet attacks is considerably growing. Meanwhile, with new techniques such as edge computing and artificial intelligence applied to IoT networks, these devices nowadays become more functional than ever before, which challenges many existing network anomaly detection systems due to the lack of generalization ability to profile diverse activities.

To address it, this paper proposes IoTEnsemble, an ensemble network anomaly detection framework. We propose a tree-based activity clustering method that aggregates network flows dedicated to the same activity so that their traffic patterns remain identical. Based on the clustering result, we implement an ensemble model in which each submodel only needs to profile a specific activity, which highly reduces the burden of a single model’s generalization ability. For evaluation, we build a 57.1 GB IoT dataset collected in 9 months composed of comprehensive normal and malicious traffic. Our evaluation proves that IoTEnsemble possesses a state-of-the-art detection performance on various IoT botnet malware and attack traffic, exhibiting a significantly better result than other baselines in a more intelligent and functional IoT network.

This work is supported by the National Key Research and Development Project of China under grant No. 2020AAA0107704, National Natural Science Foundation of China under grant No. 61972189 and 62073263, Shenzhen Key Lab of Software Defined Networking under grant No. ZDSYS20140509172959989, and Research Center for Computer Network (Shenzhen) Ministry of Education.

Appendices

A A Maximum Likelihood Estimation

Suppose N observations of packet inter-arrival time $t_1, t_2, ..., t_N$ that conform to an exponential distribution $f(t)=\lambda e^{-\lambda t}$ are sampled. T represents the sum of each observation, i.e., $T=\sum _{i=1}^{N}t_i$. The maximum likelihood estimation of the parameter $\lambda$ is derived as follow:

$$\begin{aligned} \begin{aligned} \lambda&=\mathop {\arg \max }\limits _{\lambda }\prod _{i=1}^{N}\lambda e^{-\lambda t_i}=\mathop {\arg \max }\limits _{\lambda }\sum _{i=1}^{N}\ln {\lambda } e^{-\lambda t_i}\\&=\mathop {\arg \max }\limits _{\lambda }N\ln {\lambda } -\sum _{i=1}^{N}\lambda t_i\\ {}&=\frac{N}{\sum _{i=1}^{N}t_i}=\frac{N}{T} \end{aligned} \end{aligned}$$

B B Complete Dataset Information and Evaluation Result

See Table 4.

Table 4. Complete experimental result of each device in the testbed; $N_{c}$ is the number of activity clusters; $t_0$ and $t_1$ are required time to observe all activities of a device by manual use and automated script; the last 8 devices are not IP-enabled and they are connected to the corresponding gateways.