One of the central problems in massive Internet of Things (IoT) deployments is the monitoring of the status of a massive number of links. The problem is aggravated by the irregularity of the traffic transmitted over the link, as the traffic intermittency can be disguised as a link failure and vice versa. In this work we present a traffic model for IoT devices running quasi-periodic applications and we present both supervised and unsupervised machine learning methods for monitoring the network performance of IoT deployments with quasi-periodic reporting, such as smart-metering, environmental monitoring and agricultural monitoring. The unsupervised methods are based on the Lomb-Scargle periodogram, an approach developed by astronomers for estimating the spectral density of unevenly sampled time series.
The recent spate of cyber attacks towards Internet of Things (IoT) devices in smart homes calls for effective techniques to understand, characterize, and unveil IoT device activities. In this paper, we present a new system, named IoTAthena, to unveil IoT device activities from raw network traffic consisting of timestamped IP packets. IoTAthena characterizes each IoT device activity using an activity signature consisting of an ordered sequence of IP packets with inter-packet time intervals. IoTAthena has two novel polynomial time algorithms, sigMatch and actExtract. For any given signature, sig…
Understanding network traffic characteristics of IoT devices plays a critical role in improving both the performance and security of IoT devices, including IoT device identification, classification, and anomaly detection. Although a number of existing research efforts have developed machine-learning based algorithms to help address the challenges in improving the security of IoT devices, none of them have provided detailed studies on the network traffic characteristics of IoT devices. In this paper we collect and analyze the network traffic generated in a typical smart homes environment consis…
Network traffic generation is one of the primary techniques that is used to design and analyze the performance of network security systems. However, due to the diversity of IoT networks in terms of devices, applications and protocols, the traditional network traffic generator tools are unable to generate the IoT specific protocols traffic. Hence, the traditional traffic generator tools cannot be used for designing and testing the performance of IoT-specific security solutions. In order to design an IoT-based traffic generation framework, two main challenges include IoT device modelling and gen…
IoT device identification plays an important role in monitoring and improving the performance and security of IoT devices. Compared to traditional non-IoT devices, IoT devices provide us with both unique challenges and opportunities in detecting the types of IoT devices. Based on critical insights obtained in our previous work on understanding the network traffic characteristics of IoT devices, in this paper we develop an effective machine-learning based IoT device identification scheme, named iotID. In developing iotID, we extract 70 features of TCP flows from three complementary aspects: rem…
As the smart home IoT ecosystem flourishes, it is imperative to gain a better understanding of the unique challenges it poses in terms of management, security, and privacy. Prior studies are limited because they examine smart home IoT devices in testbed environments or at a small scale. To address this gap, we present a measurement study of smart home IoT devices in the wild by instrumenting home gateways and passively collecting real-world network traffic logs from more than 200 homes across a large metropolitan area in the United States. We characterize smart home IoT traffic in terms of its…
Salvador University (UNIFACS)（萨尔瓦多大学（UNIFACS））；University of Paris-Saclay（巴黎萨克雷大学）
Sensors are being extensively deployed and are expected to expand at significant rates in the coming years. They typically generate a large volume of data on the internet of things (IoT) application areas like smart cities, intelligent traffic systems, smart grid, and e-health. Cloud, edge and fog computing are potential and competitive strategies for collecting, processing, and distributing IoT data. However, cloud, edge, and fog-based solutions need to tackle the distribution of a high volume of IoT data efficiently through constrained and limited resource network infrastructures. This paper…
The adoption of Internet of Things (IoT) technologies is increasing and thus IoT is seemingly shifting from hype to reality. However, the actual use of IoT over significant timescales has not been empirically analyzed. In other words the reality remains unexplored. Furthermore, despite the variety of IoT verticals, the use of IoT across vertical industries has not been compared. This paper uses a two-year IoT dataset from a major Finnish mobile network operator to investigate different aspects of cellular IoT traffic including temporal evolution and the use of IoT devices across industries. We…
The University of New South Wales（新南威尔士大学）；School of Electrical Engineering and Telecommunications（电气与电信工程学院）
Smart homes, enterprises, and cities are increasingly being equipped with a plethora of Internet of Things (IoT), ranging from smart-lights to security cameras. While IoT networks have the potential to benefit our lives, they create privacy and security challenges not seen with traditional IT networks. Due to the lack of visibility, operators of such smart environments are not often aware of their IoT assets, let alone whether each IoT device is functioning properly safe from cyber-attacks. This thesis is the culmination of our efforts to develop techniques to profile the network behavioral pa…
Singapore University of Technology and Design（新加坡科技设计大学）；National University of Singapore（新加坡国立大学）；University of Sydney（悉尼大学）
In this work, we present a lightweight IoT botnet detection solution, EDIMA, which is designed to be deployed at the edge gateway installed in home networks and targets early detection of botnets prior to the launch of an attack. EDIMA includes a novel two-stage Machine Learning (ML)-based detector developed specifically for IoT bot detection at the edge gateway. The ML-based bot detector first employs ML algorithms for aggregate traffic classification and subsequently Autocorrelation Function (ACF)-based tests to detect individual bots. The EDIMA architecture also comprises a malware traffic …
Consumer Internet of Things (IoT) devices are increasingly common in everyday homes, from smart speakers to security cameras. Along with their benefits come potential privacy and security threats. To limit these threats we must implement solutions to filter IoT traffic at the edge. To this end the identification of the IoT device is the first natural step. In this paper we demonstrate a novel method of rapid IoT device identification that uses neural networks trained on device DNS traffic that can be captured from a DNS server on the local network. The method identifies devices by fitting a mo…
Use-cases in the Internet of Things (IoT) typically involve a high number of interconnected, heterogeneous devices. Due to the criticality of many IoT scenarios, systems and applications need to be tested thoroughly before rollout. Existing staging environments and testing frameworks are able to emulate network properties but fail to deliver actual network-wide traffic control to test systems application independently. To extend existing frameworks, we present the distributed traffic replaying tool IoTreeplay. The tool embeds TCPLivePlay into an environment that allows the synchronous replayin…
Despite the prevalence of Internet of Things (IoT) devices, there is little information about the purpose and risks of the Internet traffic these devices generate, and consumers have limited options for controlling those risks. A key open question is whether one can mitigate these risks by automatically blocking some of the Internet connections from IoT devices, without rendering the devices inoperable. In this paper, we address this question by developing a rigorous methodology that relies on automated IoT-device experimentation to reveal which network connections (and the information they ex…
Fifth generation (5G) networks are expected to connect a huge number of Internet of Things (IoT) devices in many usage scenarios. The challenges of typical massive IoT applications with sporadic and short packet uplink transmissions are well studied, while not enough attention is given to the delivery of content of common interest, such as software/firmware updates and remote control, towards IoT devices in emerging point-to-multipoint scenarios. Moreover, the delivery of delay-sensitive IoT traffic is not sufficiently addressed in the literature. In this work we (i) identify the drawbacks of …
The Internet of Things (IoT) is advancing and the adoption of internet-connected devices in everyday use is constantly growing. This increase not only affects the traffic from other sources in the network, but also the communication quality requirements, like Quality of Service (QoS), for the IoT devices and applications. With the rise of dynamic network management and dynamic network programming technologies like Software-Defined Networking (SDN), traffic management and communication quality requirements can be tailored to fit niche use cases and characteristics. We propose a publish/subscrib…
Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling
School of Electrical Engineering and Telecommunications, University of New South Wales（新南威尔士大学电气工程与电信学院）；School of Computer Science and Engineering, University of New South Wales（新南威尔士大学计算机科学与工程学院）；KDDI Research（KDDI研究所）
As network size continues to grow exponentially, there has been a proportionate increase in the number of nodes in the corresponding network. With the advent of Internet of things (IOT), it is assumed that many more devices will be connected to the existing network infrastructure. As a result, monitoring is expected to get more complex for administrators as networks tend to become more heterogeneous. Moreover, the addressing for IOTs would be more complex given the scale at which devices will be added to the network and hence monitoring is bound to become an uphill task due to management of la…
The widespread adoption of 5G cellular technology will evolve as one of the major drivers for the growth of IoT-based applications. In this paper, we consider a Service Provider (SP) that launches a smart city service based on IoT data readings: in order to serve IoT data collected across different locations, the SP dynamically negotiates and rescales bandwidth and service functions. 5G network slicing functions are key to lease an appropriate amount of resources over heterogeneous access technologies and different site types. Also, different infrastructure providers will charge slicing servic…
Internet of Things (IoT) application deployment requires the allocation of resources such as virtual machines, storage, and network elements that must be deployed over distinct infrastructures such as cloud computing, Cloud of Things (CoT), datacenters and backbone networks. For massive IoT data acquisition, a gateway-based data aggregation approach is commonly used featuring sensor/ actuator seamless access and providing cache/ buffering and preprocessing functionality. In this perspective , gateways acting as producers need to allocate network resources to send IoT data to consumers. In this…
One of the main use cases for advanced cellular networks is represented by massive Internet-of-things (MIoT), i.e., an enormous number of IoT devices that transmit data toward the cellular network infrastructure. To make cellular MIoT a reality, data transfer and control procedures specifically designed for the support of IoT are needed. For this reason, 3GPP has introduced the Control Plane Cellular IoT optimization, which foresees a simplified bearer instantiation, with the Mobility Management Entity (MME) handling both control and data traffic. The performance of the MME has therefore becom…
Millions of vulnerable consumer IoT devices in home networks are the enabler for cyber crimes putting user privacy and Internet security at risk. Internet service providers (ISPs) are best poised to play key roles in mitigating risks by automatically inferring active IoT devices per household and notifying users of vulnerable ones. Developing a scalable inference method that can perform robustly across thousands of home networks is a non-trivial task. This paper focuses on the challenges of developing and applying data-driven inference models when labeled data of device behaviors is limited an…
The adoption of Internet of Things (IoT) technologies in businesses is increasing and thus enterprise IoT (EIoT) is seemingly shifting from hype to reality. However, the actual use of EIoT over significant timescales has not been empirically analyzed. In other words, the reality remains unexplored. Furthermore, despite the variety of EIoT verticals, the use of IoT across vertical industries has not been compared. This paper uses a two-year EIoT dataset from a major Finnish mobile network operator to investigate device use across industries, cellular traffic patterns, and mobility patterns. We …
Internet-connected devices are increasingly present in our homes, and privacy breaches, data thefts, and security threats are becoming commonplace. In order to avoid these, we must first understand the behaviour of these devices. In this work, we analyse network traces from a testbed of common IoT devices, and describe general methods for fingerprinting their behavior. We then use the information and insights derived from this data to assess where privacy and security risks manifest themselves, as well as how device behavior affects bandwidth. We demonstrate simple measures that circumvent att…
In this paper we address the problem of resource allocation for alarm traffic in industrial Internet of Things networks using massive MIMO. We formulate the general problem of how to allocate pilot signals to alarm traffic such that delivery is guaranteed, while also minimising the number of pilots reserved for alarms, thus maximising the channel resources available for other traffic, such as industrial control traffic. We present an algorithm that fulfils these requirements, and evaluate its performance both analytically and through a simulation study. For realistic alarm traffic characterist…
We propose a coordinated random access scheme for industrial internet-of-things (IIoT) scenarios, with machine-type devices (MTDs) generating sporadic correlated traffic. This occurs, e.g., when external events trigger data generation at multiple MTDs simultaneously. Time is divided into frames, each split into slots and each MTD randomly selects one slot for (re)transmission, with probability density functions (PDFs) specific of both the MTD and the number of the current retransmission. PDFs are locally optimized to minimize the probability of packet collision. The optimization problem is mod…
With the widespread adoption of Internet of Things (IoT), billions of everyday objects are being connected to the Internet. Effective management of these devices to support reliable, secure and high quality applications becomes challenging due to the scale. As one of the key cornerstones of IoT device management, automatic cross-device classification aims to identify the semantic type of a device by analyzing its network traffic. It has the potential to underpin a broad range of novel features such as enhanced security (by imposing the appropriate rules for constraining the communications of c…
IoT cloud enabled societal applications have dramatically increased in the recent past due to the thrust for innovations, notably through startup initiatives, in various sectors such as agriculture, healthcare, industry, and so forth. The existing IoT cloud solutions have led practitioners or researchers to a haphazard clutter of serious security hazards and performance inefficiencies. This paper proposes a blockchain enabled IoT cloud implementation to tackle the existing issues in smart cities. It particularly highlights the implementation of chaincodes for air quality monitoring systems in …
Internet of Things (IoT) defines a network of devices connected to the internet and sharing a massive amount of data between each other and a central location. These IoT devices are connected to a network therefore prone to attacks. Various management tasks and network operations such as security, intrusion detection, Quality-of-Service provisioning, performance monitoring, resource provisioning, and traffic engineering require traffic classification. Due to the ineffectiveness of traditional classification schemes, such as port-based and payload-based methods, researchers proposed machine lea…
Recent standardization efforts in IEEE 802.15.4-2015 Time Scheduled Channel Hopping (TSCH) and the IETF 6TiSCH Working Group (WG), aim to provide deterministic communications and efficient allocation of resources across constrained Internet of Things (IoT) networks, particularly in Industrial IoT (IIoT) scenarios. Within 6TiSCH, Software Defined Networking (SDN) has been identified as means of providing centralized control in a number of key situations. However, implementing a centralized SDN architecture in a Low Power and Lossy Network (LLN) faces considerable challenges: not only is control…
Crowdsourcing wireless energy is a novel and convenient solution to charge nearby IoT devices. Several applications have been proposed to enable peer-to-peer wireless energy charging. However, none of them considered the energy efficiency of the wireless transfer of energy. In this paper, we propose an energy estimation framework that predicts the actual received energy. Our framework uses two machine learning algorithms, namely XGBoost and Neural Network, to estimate the received energy. The result shows that the Neural Network model is better than XGBoost at predicting the received energy. W…
Internet of Things (IoT) devices and applications are generating and communicating vast quantities of data, and the rate of data collection is increasing rapidly. These high communication volumes are challenging for energy-constrained, data-capped, wireless mobile devices and networked sensors. Compression is commonly used to reduce web traffic, to save energy, and to make network transfers faster. If not used judiciously, however, compression can hurt performance. This work proposes and evaluates mechanisms that employ selective compression at the network's edge, based on data characteristics…
The growing use of IoT devices in organizations has increased the number of attack vectors available to attackers due to the less secure nature of the devices. The widely adopted bring your own device (BYOD) policy which allows an employee to bring any IoT device into the workplace and attach it to an organization's network also increases the risk of attacks. In order to address this threat, organizations often implement security policies in which only the connection of white-listed IoT devices is permitted. To monitor adherence to such policies and protect their networks, organizations must b…
Efficient Network Traffic Feature Sets for IoT Intrusion Detection
Research Group on Intelligent Engineering and Computing for Advanced Innovation and Development (GECAD), School of Engineering, Polytechnic of Porto (ISEP/IPP)（波尔图理工学院工程学院智能工程与先进创新计算研究组）
本文组合多种特征选择方法，在多个 IoT 网络数据集上筛选高效流量特征，以在保持分类泛化性能的同时降低 ML 模型训练开销。
Massive Internet of Things (IoT) is foreseen to introduce plethora of applications for a fully connected world. Heterogeneous traffic is envisaged, where packets generated at each IoT device should be differentiated and served according to their priority. This paper develops a novel priority-aware spatiotemporal mathematical model to characterize massive IoT networks with uplink prioritized multistream traffic (PMT). Particularly, stochastic geometry is utilized to account for the macroscopic network wide mutual interference between the coexisting IoT devices. Discrete time Markov chains (DTMC…
Internet of Things (IoT) technologies have received significant attention in recent years by encompassing a set of technologies that enable a variety of heterogeneous physical objects, called things, to interact and communicate through efficient networking protocols. These technologies have already been used in several domains such as in manufacturing, healthcare, agriculture, etc. Another domain in which IoT can be applicable and useful, is that of supply chain tracing, where products are monitored throughout the whole supply chain. IoT data collection can enable the proliferation of applicat…
5G network is envisioned to deploy a massive Internet-of-Things (IoTs) with requirements of low-latency, low control overhead and low power. Current 4G network is optimized for large bandwidth applications and inefficient to handle short sporadic IoT messages. The challenge here spans multiple layer including the radio access and the network layer. This paper focus on reusing CDMA access for IoT devices considering event-driven and latency sensitive traffic profile. We propose a PHY/MAC layer design for CDMA based communication for low power IoT devices. We propose and evaluate coexisting oper…
Colgate University（科尔盖特大学）；University of Chicago（芝加哥大学）
Consumer Internet of things research often involves collecting network traffic sent or received by IoT devices. These data are typically collected via crowdsourcing or while researchers manually interact with IoT devices in a laboratory setting. However, manual interactions and crowdsourcing are often tedious, expensive, inaccurate, or do not provide comprehensive coverage of possible IoT device behaviors. We present a new method for generating IoT network traffic using a robotic arm to automate user interactions with devices. This eliminates manual button pressing and enables permutation-base…
This article explores the concepts of online protocol synthesis using Reinforcement Learning (RL). The study is performed in the context of sensor and IoT networks with ultra low complexity wireless transceivers. The paper introduces the use of RL and Multi Armed Bandit (MAB), a specific type of RL, for Medium Access Control (MAC) under different network and traffic conditions. It then introduces a novel learning based protocol synthesis framework that addresses specific difficulties and limitations in medium access for both random access and time slotted networks. The mechanism does not rely …
The consumer Internet of Things (IoT) space has experienced a significant rise in popularity in the recent years. From smart speakers, to baby monitors, and smart kettles and TVs, these devices are increasingly found in households around the world while users may be unaware of the risks associated with owning these devices. Previous work showed that these devices can threaten individuals' privacy and security by exposing information online to a large number of service providers and third party analytics services. Our analysis shows that many of these Internet connections (and the information t…
Air pollution is ranked as the second most serious risk for public health in India after malnutrition. The lack of spatially and temporally distributed air quality information prevents a scientific study on its impact on human health and on the national economy. In this paper, we present our initial efforts toward SATVAM, Streaming Analytics over Temporal Variables for Air quality Monitoring, that aims to address this gap. We introduce the multi-disciplinary, multi-institutional project and some of the key IoT technologies used. These cut across hardware integration of gas sensors with a wirel…
