English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

IoT networks are increasingly becoming target of sophisticated newcyber-attacks. Anomaly-based detection methods are promising in finding newattacks, but there are certain practical challenges like false-positive alarms,hard to explain, and difficult to scale cost-effectively. The IETF recentstandard called Manufacturer Usage Description (MUD) seems promising to limitthe attack surface on IoT devices by formally specifying their intended networkbehavior. In this paper, we use SDN to enforce and monitor the expectedbehaviors of each IoT device, and train one-class classifier models to detectvolumetric attacks.  Our specific contributions are fourfold. (1) We develop a multi-levelinferencing model to dynamically detect anomalous patterns in network activityof MUD-compliant traffic flows via SDN telemetry, followed by packet inspectionof anomalous flows. This provides enhanced fine-grained visibility intodistributed and direct attacks, allowing us to precisely isolate volumetricattacks with microflow (5-tuple) resolution. (2) We collect traffic traces(benign and a variety of volumetric attacks) from network behavior of IoTdevices in our lab, generate labeled datasets, and make them available to thepublic. (3) We prototype a full working system (modules are released asopen-source), demonstrates its efficacy in detecting volumetric attacks onseveral consumer IoT devices with high accuracy while maintaining low falsepositives, and provides insights into cost and performance of our system. (4)We demonstrate how our models scale in environments with a large number ofconnected IoTs (with datasets collected from a network of IP cameras in ouruniversity campus) by considering various training strategies (per device unitversus per device type), and balancing the accuracy of prediction against thecost of models in terms of size and training time.

Detecting Anomalous Microflows in IoT Volumetric Attacks via Dynamic Monitoring of MUD Activity