201. A novel approach for detecting vulnerable IoT devices connected behind a home NAT
- Author
-
Yuval Elovici, Asaf Shabtai, Yair Meidan, Racheli Sagron, Hongyi Peng, and Vinay Sachidananda
- Subjects
Device Identification ,Service (systems architecture) ,General Computer Science ,Computer science ,business.industry ,Telecommunications service ,020206 networking & telecommunications ,02 engineering and technology ,DeNAT ,Encryption ,GeneralLiterature_MISCELLANEOUS ,Internet of Things (IoT) ,Domain (software engineering) ,Machine Learning ,Nat ,0202 electrical engineering, electronic engineering, information engineering ,Benchmark (computing) ,020201 artificial intelligence & image processing ,Network Address Translation (NAT) ,Internet of Things ,business ,Law ,Computer network - Abstract
Telecommunication service providers (telcos) are exposedto cyber-attacks executed by compromised IoT devicesconnected to their customers’ networks. Such attacks mighthave severe effects on the attack target, as well as the telcosthemselves. To mitigate those risks, we propose a machinelearning-based method that can detect specific vulnerable IoTdevice models connected behind a domestic NAT, therebyidentifying home networks that pose a risk to the telcosinfrastructure and service availability. To evaluate our method,we collected a large quantity of network traffic data fromvarious commercial IoT devices in our lab and comparedseveral classification algorithms. We found that (a) the LGBMalgorithm produces excellent detection results, and (b) ourflow-based method is robust and can handle situations forwhich existing methods used to identify devices behind a NATare unable to fully address, e.g., encrypted, non-TCP or non-DNS traffic. To promote future research in this domain weshare our novel labeled benchmark dataset.
- Published
- 2020
- Full Text
- View/download PDF