Network traffic generation is one of the primary techniques that is used to design and analyze the performance of network security systems. However, due to the diversity of IoT networks in terms of devices, applications and protocols, the traditional network traffic generator tools are unable to generate the IoT specific protocols traffic. Hence, the traditional traffic generator tools cannot be used for designing and testing the performance of IoT-specific security solutions. In order to design an IoT-based traffic generation framework, two main challenges include IoT device modelling and generating the IoT normal and attack traffic simultaneously. Therefore, in this work, we propose an open-source framework for IoT traffic generation which supports the two widely used IoT application layer protocols, i.e., MQTT and CoAP. The proposed framework allows a user to create an IoT use case, add customized IoT devices into it and generate normal and malicious IoT traffic over a real-time network. Furthermore, we set up a real-time IoT smart home use case to manifest the applicability of the proposed framework for developing the security solutions for IoT smart home by emulating the real world IoT devices. The experimental results demonstrate that the proposed framework can be effectively used to develop better security solutions for IoT networks without physically deploying the real-time use case.
We propose Flock; a simple and scalable protocol that enables live migration of Virtual Machines (VMs) across heterogeneous edge and conventional cloud platforms to improve the responsiveness of cloud services. Flock is designed with properties that are suitable for the use cases of the Internet of Things (IoT). We describe the properties of regularized latency measurements that Flock can use for asynchronous and autonomous migration decisions. Such decisions allow communicating VMs to follow a flocking-like behavior that consists of three simple rules: separation, alignment, and cohesion. Usi…
The recent spate of cyber attacks towards Internet of Things (IoT) devices in smart homes calls for effective techniques to understand, characterize, and unveil IoT device activities. In this paper, we present a new system, named IoTAthena, to unveil IoT device activities from raw network traffic consisting of timestamped IP packets. IoTAthena characterizes each IoT device activity using an activity signature consisting of an ordered sequence of IP packets with inter-packet time intervals. IoTAthena has two novel polynomial time algorithms, sigMatch and actExtract. For any given signature, sig…
Understanding network traffic characteristics of IoT devices plays a critical role in improving both the performance and security of IoT devices, including IoT device identification, classification, and anomaly detection. Although a number of existing research efforts have developed machine-learning based algorithms to help address the challenges in improving the security of IoT devices, none of them have provided detailed studies on the network traffic characteristics of IoT devices. In this paper we collect and analyze the network traffic generated in a typical smart homes environment consis…
IoT device identification plays an important role in monitoring and improving the performance and security of IoT devices. Compared to traditional non-IoT devices, IoT devices provide us with both unique challenges and opportunities in detecting the types of IoT devices. Based on critical insights obtained in our previous work on understanding the network traffic characteristics of IoT devices, in this paper we develop an effective machine-learning based IoT device identification scheme, named iotID. In developing iotID, we extract 70 features of TCP flows from three complementary aspects: rem…
As the smart home IoT ecosystem flourishes, it is imperative to gain a better understanding of the unique challenges it poses in terms of management, security, and privacy. Prior studies are limited because they examine smart home IoT devices in testbed environments or at a small scale. To address this gap, we present a measurement study of smart home IoT devices in the wild by instrumenting home gateways and passively collecting real-world network traffic logs from more than 200 homes across a large metropolitan area in the United States. We characterize smart home IoT traffic in terms of its…
Excessive tail end-to-end latency occurs with conventional message brokers as a result of having massive numbers of geographically distributed devices communicate through a message broker. On the other hand, broker-less messaging systems, though ensure low latency, are highly dependent on the limitation of direct device-to-device (D2D) communication technologies, and cannot scale well as large numbers of resource-limited devices exchange messages. In this paper, we propose FogMQ, a cloud-based message broker system that overcomes the limitations of conventional systems by enabling autonomous d…
The adoption of Internet of Things (IoT) technologies is increasing and thus IoT is seemingly shifting from hype to reality. However, the actual use of IoT over significant timescales has not been empirically analyzed. In other words the reality remains unexplored. Furthermore, despite the variety of IoT verticals, the use of IoT across vertical industries has not been compared. This paper uses a two-year IoT dataset from a major Finnish mobile network operator to investigate different aspects of cellular IoT traffic including temporal evolution and the use of IoT devices across industries. We…
Despite the prevalence of Internet of Things (IoT) devices, there is little information about the purpose and risks of the Internet traffic these devices generate, and consumers have limited options for controlling those risks. A key open question is whether one can mitigate these risks by automatically blocking some of the Internet connections from IoT devices, without rendering the devices inoperable. In this paper, we address this question by developing a rigorous methodology that relies on automated IoT-device experimentation to reveal which network connections (and the information they ex…
Use-cases in the Internet of Things (IoT) typically involve a high number of interconnected, heterogeneous devices. Due to the criticality of many IoT scenarios, systems and applications need to be tested thoroughly before rollout. Existing staging environments and testing frameworks are able to emulate network properties but fail to deliver actual network-wide traffic control to test systems application independently. To extend existing frameworks, we present the distributed traffic replaying tool IoTreeplay. The tool embeds TCPLivePlay into an environment that allows the synchronous replayin…
Fifth generation (5G) networks are expected to connect a huge number of Internet of Things (IoT) devices in many usage scenarios. The challenges of typical massive IoT applications with sporadic and short packet uplink transmissions are well studied, while not enough attention is given to the delivery of content of common interest, such as software/firmware updates and remote control, towards IoT devices in emerging point-to-multipoint scenarios. Moreover, the delivery of delay-sensitive IoT traffic is not sufficiently addressed in the literature. In this work we (i) identify the drawbacks of …
The Internet of Things (IoT) is advancing and the adoption of internet-connected devices in everyday use is constantly growing. This increase not only affects the traffic from other sources in the network, but also the communication quality requirements, like Quality of Service (QoS), for the IoT devices and applications. With the rise of dynamic network management and dynamic network programming technologies like Software-Defined Networking (SDN), traffic management and communication quality requirements can be tailored to fit niche use cases and characteristics. We propose a publish/subscrib…
One of the central problems in massive Internet of Things (IoT) deployments is the monitoring of the status of a massive number of links. The problem is aggravated by the irregularity of the traffic transmitted over the link, as the traffic intermittency can be disguised as a link failure and vice versa. In this work we present a traffic model for IoT devices running quasi-periodic applications and we present both supervised and unsupervised machine learning methods for monitoring the network performance of IoT deployments with quasi-periodic reporting, such as smart-metering, environmental mo…
The widespread adoption of 5G cellular technology will evolve as one of the major drivers for the growth of IoT-based applications. In this paper, we consider a Service Provider (SP) that launches a smart city service based on IoT data readings: in order to serve IoT data collected across different locations, the SP dynamically negotiates and rescales bandwidth and service functions. 5G network slicing functions are key to lease an appropriate amount of resources over heterogeneous access technologies and different site types. Also, different infrastructure providers will charge slicing servic…
One of the main use cases for advanced cellular networks is represented by massive Internet-of-things (MIoT), i.e., an enormous number of IoT devices that transmit data toward the cellular network infrastructure. To make cellular MIoT a reality, data transfer and control procedures specifically designed for the support of IoT are needed. For this reason, 3GPP has introduced the Control Plane Cellular IoT optimization, which foresees a simplified bearer instantiation, with the Mobility Management Entity (MME) handling both control and data traffic. The performance of the MME has therefore becom…
Internet of Things (IoT) application deployment requires the allocation of resources such as virtual machines, storage, and network elements that must be deployed over distinct infrastructures such as cloud computing, Cloud of Things (CoT), datacenters and backbone networks. For massive IoT data acquisition, a gateway-based data aggregation approach is commonly used featuring sensor/ actuator seamless access and providing cache/ buffering and preprocessing functionality. In this perspective , gateways acting as producers need to allocate network resources to send IoT data to consumers. In this…
The adoption of Internet of Things (IoT) technologies in businesses is increasing and thus enterprise IoT (EIoT) is seemingly shifting from hype to reality. However, the actual use of EIoT over significant timescales has not been empirically analyzed. In other words, the reality remains unexplored. Furthermore, despite the variety of EIoT verticals, the use of IoT across vertical industries has not been compared. This paper uses a two-year EIoT dataset from a major Finnish mobile network operator to investigate device use across industries, cellular traffic patterns, and mobility patterns. We …
Internet-connected devices are increasingly present in our homes, and privacy breaches, data thefts, and security threats are becoming commonplace. In order to avoid these, we must first understand the behaviour of these devices. In this work, we analyse network traces from a testbed of common IoT devices, and describe general methods for fingerprinting their behavior. We then use the information and insights derived from this data to assess where privacy and security risks manifest themselves, as well as how device behavior affects bandwidth. We demonstrate simple measures that circumvent att…
In this paper we address the problem of resource allocation for alarm traffic in industrial Internet of Things networks using massive MIMO. We formulate the general problem of how to allocate pilot signals to alarm traffic such that delivery is guaranteed, while also minimising the number of pilots reserved for alarms, thus maximising the channel resources available for other traffic, such as industrial control traffic. We present an algorithm that fulfils these requirements, and evaluate its performance both analytically and through a simulation study. For realistic alarm traffic characterist…
With the widespread adoption of Internet of Things (IoT), billions of everyday objects are being connected to the Internet. Effective management of these devices to support reliable, secure and high quality applications becomes challenging due to the scale. As one of the key cornerstones of IoT device management, automatic cross-device classification aims to identify the semantic type of a device by analyzing its network traffic. It has the potential to underpin a broad range of novel features such as enhanced security (by imposing the appropriate rules for constraining the communications of c…
Internet of Things (IoT) defines a network of devices connected to the internet and sharing a massive amount of data between each other and a central location. These IoT devices are connected to a network therefore prone to attacks. Various management tasks and network operations such as security, intrusion detection, Quality-of-Service provisioning, performance monitoring, resource provisioning, and traffic engineering require traffic classification. Due to the ineffectiveness of traditional classification schemes, such as port-based and payload-based methods, researchers proposed machine lea…
Recent standardization efforts in IEEE 802.15.4-2015 Time Scheduled Channel Hopping (TSCH) and the IETF 6TiSCH Working Group (WG), aim to provide deterministic communications and efficient allocation of resources across constrained Internet of Things (IoT) networks, particularly in Industrial IoT (IIoT) scenarios. Within 6TiSCH, Software Defined Networking (SDN) has been identified as means of providing centralized control in a number of key situations. However, implementing a centralized SDN architecture in a Low Power and Lossy Network (LLN) faces considerable challenges: not only is control…
Salvador University (UNIFACS)（萨尔瓦多大学（UNIFACS））；University of Paris-Saclay（巴黎萨克雷大学）
Sensors are being extensively deployed and are expected to expand at significant rates in the coming years. They typically generate a large volume of data on the internet of things (IoT) application areas like smart cities, intelligent traffic systems, smart grid, and e-health. Cloud, edge and fog computing are potential and competitive strategies for collecting, processing, and distributing IoT data. However, cloud, edge, and fog-based solutions need to tackle the distribution of a high volume of IoT data efficiently through constrained and limited resource network infrastructures. This paper…
The University of New South Wales（新南威尔士大学）；School of Electrical Engineering and Telecommunications（电气与电信工程学院）
Smart homes, enterprises, and cities are increasingly being equipped with a plethora of Internet of Things (IoT), ranging from smart-lights to security cameras. While IoT networks have the potential to benefit our lives, they create privacy and security challenges not seen with traditional IT networks. Due to the lack of visibility, operators of such smart environments are not often aware of their IoT assets, let alone whether each IoT device is functioning properly safe from cyber-attacks. This thesis is the culmination of our efforts to develop techniques to profile the network behavioral pa…
Singapore University of Technology and Design（新加坡科技设计大学）；National University of Singapore（新加坡国立大学）；University of Sydney（悉尼大学）
In this work, we present a lightweight IoT botnet detection solution, EDIMA, which is designed to be deployed at the edge gateway installed in home networks and targets early detection of botnets prior to the launch of an attack. EDIMA includes a novel two-stage Machine Learning (ML)-based detector developed specifically for IoT bot detection at the edge gateway. The ML-based bot detector first employs ML algorithms for aggregate traffic classification and subsequently Autocorrelation Function (ACF)-based tests to detect individual bots. The EDIMA architecture also comprises a malware traffic …
Internet of Things (IoT) devices and applications are generating and communicating vast quantities of data, and the rate of data collection is increasing rapidly. These high communication volumes are challenging for energy-constrained, data-capped, wireless mobile devices and networked sensors. Compression is commonly used to reduce web traffic, to save energy, and to make network transfers faster. If not used judiciously, however, compression can hurt performance. This work proposes and evaluates mechanisms that employ selective compression at the network's edge, based on data characteristics…
5G network is envisioned to deploy a massive Internet-of-Things (IoTs) with requirements of low-latency, low control overhead and low power. Current 4G network is optimized for large bandwidth applications and inefficient to handle short sporadic IoT messages. The challenge here spans multiple layer including the radio access and the network layer. This paper focus on reusing CDMA access for IoT devices considering event-driven and latency sensitive traffic profile. We propose a PHY/MAC layer design for CDMA based communication for low power IoT devices. We propose and evaluate coexisting oper…
Massive Internet of Things (IoT) is foreseen to introduce plethora of applications for a fully connected world. Heterogeneous traffic is envisaged, where packets generated at each IoT device should be differentiated and served according to their priority. This paper develops a novel priority-aware spatiotemporal mathematical model to characterize massive IoT networks with uplink prioritized multistream traffic (PMT). Particularly, stochastic geometry is utilized to account for the macroscopic network wide mutual interference between the coexisting IoT devices. Discrete time Markov chains (DTMC…
Colgate University（科尔盖特大学）；University of Chicago（芝加哥大学）
Consumer Internet of things research often involves collecting network traffic sent or received by IoT devices. These data are typically collected via crowdsourcing or while researchers manually interact with IoT devices in a laboratory setting. However, manual interactions and crowdsourcing are often tedious, expensive, inaccurate, or do not provide comprehensive coverage of possible IoT device behaviors. We present a new method for generating IoT network traffic using a robotic arm to automate user interactions with devices. This eliminates manual button pressing and enables permutation-base…
Estimating the performance of multimedia traffic is important in numerous contexts, including routing and forwarding, QoS provisioning, and adaptive video streaming. This paper proposes a network performance estimator which aims at providing, in quasi real-time, network performance estimates for IoT multimedia traffic in IEEE 802.11 multihop wireless networks. To our knowledge, the proposed multimedia-aware performance estimator, or MAPE, is the first deterministic simulation-based estimator that provides real-time per-flow throughput, packet loss and delay estimates while considering inter-fl…
The DDoS attack is a serious threat to Internet of Things (IoT). As a new class of DDoS attack, Link-flooding attack (LFA) disrupts connectivity between legitimate IoT devices and target servers by flooding only a small number of links. In this paper, we propose an active LFA mitigation mechanism, called Linkbait, that is a proactive and preventive defense to throttle LFA for IoT. We propose a link obfuscation algorithm in Linkbait that selectively reroutes probing flows to hide target links from adversaries and mislead them to identify bait links as target links. To block attack traffic and f…
The consumer Internet of Things (IoT) space has experienced a significant rise in popularity in the recent years. From smart speakers, to baby monitors, and smart kettles and TVs, these devices are increasingly found in households around the world while users may be unaware of the risks associated with owning these devices. Previous work showed that these devices can threaten individuals' privacy and security by exposing information online to a large number of service providers and third party analytics services. Our analysis shows that many of these Internet connections (and the information t…
Maintaining IoT Device Identification under Concept Drift via Budget-Aware Traffic Labeling
School of Electrical Engineering and Telecommunications, University of New South Wales（新南威尔士大学电气工程与电信学院）；School of Computer Science and Engineering, University of New South Wales（新南威尔士大学计算机科学与工程学院）；KDDI Research（KDDI研究所）
Detecting cyber attacks in the network environments used by Internet-of-things (IoT) and preventing them from causing physical perturbations play an important role in delivering dependable services. To achieve this goal, we propose in-network Honeypot based on Software-Defined Networking (SDN) to disrupt and mislead adversaries into exposures while they are in an early stage of preparing an attack. Different from traditional Honeypot requiring dedicated hardware setup, the in-network Honeypot directly reroutes traffic from suspicious nodes and intelligently spoofs the network traffic to them b…
In this work, we present a novel traffic prediction and fast uplink framework for IoT networks controlled by binary Markovian events. First, we apply the forward algorithm with hidden Markov models (HMM) in order to schedule the available resources to the devices with maximum likelihood activation probabilities via fast uplink grant. In addition, we evaluate the regret metric as the number of wasted transmission slots to evaluate the performance of the prediction. Next, we formulate a fairness optimization problem to minimize the age of information while keeping the regret as minimum as possib…
This is the era of smart devices or things which are fueling the growth of Internet of Things (IoT). It is impacting every sphere around us, making our life dependent on this technological feat. It is of high concern that these smart things are being targeted by cyber criminals taking advantage of heterogeneity, minuscule security features and vulnerabilities within these devices. Conventional centralized IT security measures have limitations in terms of scalability and cost. Therefore, these smart devices are required to be monitored closer to their location ideally at the edge of IoT network…
Consumer Internet of Things (IoT) devices are increasingly common in everyday homes, from smart speakers to security cameras. Along with their benefits come potential privacy and security threats. To limit these threats we must implement solutions to filter IoT traffic at the edge. To this end the identification of the IoT device is the first natural step. In this paper we demonstrate a novel method of rapid IoT device identification that uses neural networks trained on device DNS traffic that can be captured from a DNS server on the local network. The method identifies devices by fitting a mo…
Millions of vulnerable consumer IoT devices in home networks are the enabler for cyber crimes putting user privacy and Internet security at risk. Internet service providers (ISPs) are best poised to play key roles in mitigating risks by automatically inferring active IoT devices per household and notifying users of vulnerable ones. Developing a scalable inference method that can perform robustly across thousands of home networks is a non-trivial task. This paper focuses on the challenges of developing and applying data-driven inference models when labeled data of device behaviors is limited an…
Faculty of Integrated Technologies（综合技术学院）；Institute of Applied Data Analytics（应用数据分析研究所）
Device identification is the process of identifying a device on Internet without using its assigned network or other credentials. The sharp rise of usage in Internet of Things (IoT) devices has imposed new challenges in device identification due to a wide variety of devices, protocols and control interfaces. In a network, conventional IoT devices identify each other by utilizing IP or MAC addresses, which are prone to spoofing. Moreover, IoT devices are low power devices with minimal embedded security solution. To mitigate the issue in IoT devices, fingerprint (DFP) for device identification c…
The growing use of IoT devices in organizations has increased the number of attack vectors available to attackers due to the less secure nature of the devices. The widely adopted bring your own device (BYOD) policy which allows an employee to bring any IoT device into the workplace and attach it to an organization's network also increases the risk of attacks. In order to address this threat, organizations often implement security policies in which only the connection of white-listed IoT devices is permitted. To monitor adherence to such policies and protect their networks, organizations must b…
Traditional techniques to detect malware infections were not meant to be used by the end-user and current malware removal tools and security software cannot handle the heterogeneity of IoT devices. In this paper, we design, develop and evaluate a tool, called NURSE, to fill this information gap, i.e., enabling end-users to detect IoT-malware infections in their home networks. NURSE follows a modular approach to analyze IoT traffic as captured by means of an ARP spoofing technique which does not require any network modification or specific hardware. Thus, NURSE provides zero-configuration IoT t…
We propose a coordinated random access scheme for industrial internet-of-things (IIoT) scenarios, with machine-type devices (MTDs) generating sporadic correlated traffic. This occurs, e.g., when external events trigger data generation at multiple MTDs simultaneously. Time is divided into frames, each split into slots and each MTD randomly selects one slot for (re)transmission, with probability density functions (PDFs) specific of both the MTD and the number of the current retransmission. PDFs are locally optimized to minimize the probability of packet collision. The optimization problem is mod…
