Jinke Song
Skip Abstract Section
Abstract
With the increasing number of Internet of Things (IoT) devices connected to the internet, the industry and research community have become increasingly concerned about their security impact. Adversaries or hackers often exploit public security flaws to compromise IoT devices and launch cyber attacks. However, despite this growing concern, little effort has been made to investigate the detection of IoT devices and their underlying risks. To address this gap, this article proposes to automatically establish relationships between IoT devices and their vulnerabilities in the wild. Specifically, we construct a deep neural network (DNN) to extract semantic information from IoT packets and generate fine-grained fingerprints of IoT devices. This enables us to annotate IoT devices in cyberspace, including their device type, vendor, and product information. We collect vulnerability reports from various security sources and extract IoT device information from these reports to automatically match vulnerabilities with the fingerprints of IoT devices. We implemented a prototype system and conducted extensive experiments to validate the effectiveness of our approach. The results show that our DNN model achieved a 98% precision rate and a 95% recall rate in IoT device fingerprinting. Furthermore, we collected and analyzed over 13,063 IoT-related vulnerability reports and our method automatically built 5,458 connections between IoT device fingerprints and their vulnerabilities. These findings shed light on the ongoing threat of cyber-attacks on IoT systems as both IoT devices and disclosed vulnerabilities are targets for malicious attackers.
- [1] . 2019. Automated iot device identification using network traffic. In Proceedings of the IEEE International Conference on Communications (ICC’19). IEEE, 1–7.Google Scholar
Cross Ref
- [2] Fadele Ayotunde Alaba, Mazliza Othman, Ibrahim Abaker Targio Hashem, and Faiz Alotaibi. 2017. Internet of things security: A survey. Journal of Network and Computer Applications 88 (2017), 10–28.Google Scholar
- [3] . 2017. Understanding the mirai botnet. In Proceedings of the 26th USENIX Conference on Security Symposium (SEC’17). 1093–1110.Google ScholarDigital Library
- [4] Bruhadeshwar Bezawada, Maalvika Bachani, Jordan Peterson, Hossein Shirazi, Indrakshi Ray, and Indrajit Ray. 2018. Behavioral fingerprinting of IoT devices. In Proceedings of the 2018 Workshop on Attacks and Solutions in Hardware Security (ASHES’18). Association for Computing Machinery, New York, NY, 41–50.Google Scholar
- [5] . 2016. A novel cyber security capability: Inferring internet-scale infections by correlating malware and probing activities. Comput. Netw. 94 (2016), 327–343.Google ScholarDigital Library
- [6] Censys. 2015. A Search Engine Based on Internet-wide Scanning for the Devices and Networks. Retrieved from https://censys.io/Google Scholar
- [7] . 2023. CVE, Common Vulnerabilities and Exposures. Retrieved from http://cve.mitre.org/Google Scholar
- [8] . 2023. A Free and Open Industry Standard for Assessing the Severity of Computer System Security Vulnerabilities.Retrieved from https://nvd.nist.gov/vuln-metrics/cvssGoogle Scholar
- [9] . 2023. A Community-developed List of Common Software Security Weaknesses.Retrieved from https://cwe.mitre.org/Google Scholar
- [10] . 2021. Number of Connected IoT Devices Will Surge to 125 Billion by 2030. Retrieved from https://www.iot-now.com/tag/ihs-markit/Google Scholar
- [11] . 2019. Towards the detection of inconsistencies in public security vulnerability reports. In Proceedings of the 28th USENIX Security Symposium (USENIX Security’19). 869–885.Google Scholar
- [12] . 2013. ZMap: Fast internet-wide scanning and its security applications. In Proceedings of the USENIX Security Symposium, Vol. 8.605–620.Google Scholar
- [13] . 2017. Internet-scale probing of CPS: Inference, characterization and orchestration analysis. In Proceedings of the Network and Distributed System Security (NDSS) Symposium (NDSS’17).Google ScholarCross Ref
- [14] . 2016. Characterizing industrial control system devices on the internet. In Proceedings of the IEEE 24th International Conference on Network Protocols (ICNP’16). IEEE, 1–10.Google Scholar
- [15] . 2018. Acquisitional rule-based engine for discovering internet-of-things devices. In Proceedings of the 27th USENIX Security Symposium (USENIX Security’18). Baltimore, MD, 327–341.Google Scholar
- [16] . 2019. Understanding and securing device vulnerabilities through automated bug report analysis. In Proceedings of the 28th USENIX Security Symposium (USENIX Security’19). USENIX Association, Berkeley, CA, 887–903.Google Scholar
- [17] 2016. Retrieved from https://www.symantec.com/security/OIS_Guidelines%20for%20responsible%20disclosure.pdfGoogle Scholar
- [18] . 2016. Who’s in control of your control system? Device fingerprinting for cyber-physical systems. In Proceedings of the Network and Distributed System Security (NDSS) Symposium (NDSS’16).Google ScholarCross Ref
- [19] . 2023. GoogleScraper. Retrieved from https://github.com/NikolaiT/GoogleScraperGoogle Scholar
- [20] . 2015. Security for the internet of things: A survey of existing protocols and open research issues. IEEE Commun. Surv. Tutor. 17, 3 (2015), 1294–1312.Google ScholarDigital Library
- [21] . 2020. Verifying and monitoring iots network behavior using mud profiles. IEEE Trans. Depend. Sec. Comput. (2020).Google Scholar
- [22] . 2022. An automated context-aware IoT vulnerability assessment rule-set generator. Comput. Commun. 186 (2022), 133–152.Google ScholarDigital Library
- [23] . 2019. Iot device identification using deep learning. In Computational Intelligence in Security for Information Systems Conference. Springer, 76–86.Google Scholar
- [24] . 2017. A large-scale empirical study of security patches. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS’17). ACM, New York, NY, 2201–2215. Google ScholarDigital Library
- [25] . 2021. Machine learning for the detection and identification of internet of things devices: A survey. IEEE IoT J. 9, 1 (2021), 298–320.Google Scholar
- [26] . 2019. Audi: Toward autonomous iot device-type identification using periodic communication. IEEE J. Select. Areas Commun. 37, 6 (2019), 1402–1412.Google ScholarCross Ref
- [27] . 2017. Iot sentinel: Automated device-type identification for security enforcement in iot. In Proceedings of the IEEE 37th International Conference on Distributed Computing Systems (ICDCS’17). IEEE, 2177–2184.Google Scholar
- [28] . 2013. Efficient estimation of word representations in vector space. arXiv:1301.3781. Retrieved from https://arxiv.org/abs/1301.3781Google Scholar
- [29] . 2016. A comprehensive study of security of internet-of-things. IEEE Trans. Emerg. Top. Comput. 5, 4 (2016), 586–602.Google ScholarCross Ref
- [30] . 2019. Iot device fingerprinting: Machine learning based encrypted traffic analysis. In Proceedings of the IEEE Wireless Communications and Networking Conference (WCNC’19). IEEE, 1–8.Google ScholarDigital Library
- [31] . 2018. Understanding the reproducibility of crowd-reported security vulnerabilities. In Proceedings of the 27th \(\lbrace\)USENIX\(\rbrace\) Security Symposium (\(\lbrace\)USENIX\(\rbrace\) Security’18). 919–936.Google Scholar
- [32] . 2013. The (un) reliability of nvd vulnerable versions data: An empirical experiment on google chrome vulnerabilities. In Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security. 493–498.Google ScholarDigital Library
- [33] . 2001. A Suite of Libraries and Programs for Symbolic and Statistical Natural Language Processing. Retrieved from http://www.nltk.org/Google Scholar
- [34] . 1997. Network Security Scanner Tool.Google Scholar
- [35] . 2022. Risk prediction of IoT devices based on vulnerability analysis. ACM Trans. Priv. Secur. 25, 2 (2022), 1–36.Google ScholarDigital Library
- [36] . 2018. Design of a hybrid RF fingerprint extraction and device classification scheme. IEEE IoT J. 6, 1 (2018), 349–360.Google Scholar
- [37] . 2015. Wireless device identification based on RF oscillator imperfections. IEEE Trans. Inf. Forens. Secur. 10, 12 (2015), 2492–2501.Google ScholarDigital Library
- [38] . 2018. An Open Source Machine Learning Framework That Accelerates the Path from Research Prototyping to Production Deployment. Retrieved from https://pytorch.org/Google Scholar
- [39] . 2016. The Cyber Attack Disrupts Internet Service across Europe and US via Mirai.Google Scholar
- [40] . 2018. Deep learning convolutional neural networks for radio identification. IEEE Commun. Mag. 56, 9 (2018), 146–152.Google ScholarCross Ref
- [41] . 2015. Vulnerability disclosure in the age of social media: Exploiting twitter for predicting real-world exploits. In Proceedings of the 24th USENIX Security Symposium. USENIX Association, Berkeley, CA, 1041–1056.Google ScholarDigital Library
- [42] . 2017. Faulds: A non-parametric iterative classifier for internet-wide OS fingerprinting. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 971–982.Google ScholarDigital Library
- [43] . 2014. Hershel: Single-packet Os fingerprinting. In Proceedings of the ACM International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS’14). 195–206.Google ScholarDigital Library
- [44] Shodan. 2009. The Search Engine for Internet-connected Devices. Retrieved from https://www.shodan.io/Google Scholar
- [45] . 2019. Vulnerabilities analysis and security assessment framework for the internet of things. In Proceedings of the Cybersecurity and Cyberforensics Conference (CCC’19). IEEE, 22–29.Google ScholarCross Ref
- [46] . 2015. Security, privacy and trust in internet of things: The road ahead. Comput. Netw. 76 (2015), 146–164.Google ScholarDigital Library
- [47] . 2020. IoT behavioral monitoring via network traffic analysis. arXiv:2001.10632. Retrieved from https://arxiv.org/abs/2001.10632Google Scholar
- [48] . 2018. Classifying IoT devices in smart environments using network traffic characteristics. IEEE Trans. Mob. Comput. 18, 8 (2018), 1745–1759.Google ScholarCross Ref
- [49] . 2020. Managing IoT cyber-security using programmable telemetry and machine learning. IEEE Trans. Netw. Serv. Manage. 17, 1 (2020), 60–74.Google ScholarDigital Library
- [50] . 2020. Under the concealing surface: Detecting and understanding live webcams in the wild. In Proceedings of the ACM on Measurement and Analysis of Computing Systems, SIGMETRICS ’20. 4, 1 (2020), 1–25.Google ScholarDigital Library
- [51] Beautiful Soup. 2012. Package for Parsing HTML and XML Documents. Retrieved from https://www.crummy.com/software/BeautifulSoup/Google Scholar
- [52] . 2018. DEFT: A distributed IoT fingerprinting technique. IEEE IoT J. 6, 1 (2018), 940–952.Google Scholar
- [53] . 2007. Fig: Automatic fingerprint generation. In Proceedings of the Network and Distributed System Security Symposium (NDSS’07).Google Scholar
- [54] . 2016. Cybersecurity in the internet of things: Legal aspects. Comput. Law Secur. Rev. 32, 5 (2016), 715–728.Google ScholarCross Ref
- [55] . 2017. Identifying vulnerabilities of consumer internet of things (IoT) devices: A scalable approach. In Proceedings of the IEEE International Conference on Intelligence and Security Informatics (ISI’17). IEEE, 179–181.Google ScholarDigital Library
- [56] . 2023. Yake. Retrieved from https://github.com/LIAAD/yakeGoogle Scholar
- [57] . 2019. Towards automatic fingerprinting of IoT devices in the cyberspace. Comput. Netw. 148 (2019), 318–327. Google ScholarCross Ref
- [58] . 2019. A robust RF fingerprinting approach using multisampling convolutional neural network. IEEE IoT J. 6, 4 (2019), 6786–6799.Google Scholar
- [59] . 2019. FID: Function modeling-based data-independent and channel-robust physical-layer identification. In Proceedings of the IEEE Conference on Computer Communications (INFOCOM’19). IEEE, 199–207.Google ScholarDigital Library
- [60] . 2019. Design of a robust RF fingerprint generation and classification scheme for practical device identification. In Proceedings of the IEEE Conference on Communications and Network Security (CNS’19). IEEE, 196–204.Google ScholarCross Ref
- [61] . 2020. Scaffisd: A scalable framework for fine-grained identification and security detection of wireless routers. In Proceedings of the IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom’20). IEEE, 1194–1199.Google ScholarCross Ref
- [62] . 2023. ZTag, an Utility for Annotating Raw Scan Data with Additional Metadata. Retrieved from http://github.com/zmap/ztagGoogle Scholar
Index Terms
- Toward Automatically Connecting IoT Devices with Vulnerabilities in the Wild
Recommendations
Fingerprinting IoT Devices Using Latent Physical Side-Channels
The proliferation of low-end low-power internet-of-things (IoT) devices in "smart" environments necessitates secure identification and authentication of these devices via low-overhead fingerprinting methods. Previous work typically utilizes ...
A taxonomy of vulnerabilities in implantable medical devices
SPIMACS '10: Proceedings of the second annual workshop on Security and privacy in medical and home-care systemsOnce the domain of science fiction, devices connecting biological systems with computers have become reality. Security vulnerabilities that might be exploited in such systems by malicious parties or by inadvertent manipulation are also now a reality. ...
Discovering buffer overflow vulnerabilities in the wild: an empirical study
ESEM '14: Proceedings of the 8th ACM/IEEE International Symposium on Empirical Software Engineering and MeasurementContext: Reporters of security vulnerabilities possess rich information about the security engineering process. Goal: We performed an empirical study on reporters of buffer overflow vulnerabilities to understand the methods and tools used during the ...
Comments