Machine Learning DDoS Detection for Consumer Internet of Things Devices

Abstract

An increasing number of Internet of Things (IoT) devices are connecting to the Internet, yet many of these devices are fundamentally insecure, exposing the Internet to a variety of attacks. Botnets such as Mirai have used insecure consumer IoT devices to conduct distributed denial of service (DDoS) attacks on critical Internet infrastructure. This motivates the development of new techniques to automatically detect consumer IoT attack traffic. In this paper, we demonstrate that using IoT-specific network behaviors (e.g. limited number of endpoints and regular time intervals between packets) to inform feature selection can result in high accuracy DDoS detection in IoT network traffic with a variety of machine learning algorithms, including neural networks. These results indicate that home gateway routers or other network middleboxes could automatically detect local IoT device sources of DDoS attacks using low-cost machine learning algorithms and traffic data that is flow-based and protocol-agnostic.

7 pages, 3 figures, 3 tables, appears in the 2018 Workshop on Deep Learning and Security (DLS '18)

Cited by in corpus (9)

• Resilient Machine Learning for Networked Cyber Physical Systems: A Survey for Machine Learning Security to Securing Machine Learning for CPS
• Machine and Deep Learning for IoT Security and Privacy: Applications, Challenges, and Future Directions
• Online Self-Supervised Deep Learning for Intrusion Detection Systems
• CADeSH: Collaborative Anomaly Detection for Smart Homes
• Anomalous Communications Detection in IoT Networks Using Sparse Autoencoders
• Network Traffic Characteristics of IoT Devices in Smart Homes
• Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
• NURSE: eNd-UseR IoT malware detection tool for Smart homEs
• Evaluation of an Anomaly Detector for Routers using Parameterizable Malware in an IoT Ecosystem