Search

This is the era of smart devices or things which are fueling the growth of Internet of Things (IoT). It is impacting every sphere around us, making our life dependent on this technological feat. It is of high concern that these smart things are being targeted by cyber criminals taking advantage of heterogeneity, minuscule security features and vulnerabilities within these devices. Conventional centralized IT security measures have limitations in terms of scalability and cost. Therefore, these smart devices are required to be monitored closer to their location ideally at the edge of IoT networks. In this paper, we explore how some security features can be implemented at the network edge to secure these smart devices. We explain the importance of Network Function Virtualization (NFV) in order to deploy security functions at the network edge. To achieve this goal, we introduce NETRA - a novel lightweight Docker-based architecture for virtualizing network functions to provide IoT security. Also, we highlight the advantages of the proposed architecture over the standardized NFV architecture in terms of storage, memory usage, latency, throughput, load average, scalability and explain why the standardized architecture is not suitable for IoT. We study the performance of proposed NFV based edge analysis for IoT security and show that attacks can be detected with more than 95% accuracy in less than a second.

In recent years, the emerging Internet-of-Things (IoT) has led to rising concerns about the security of networked embedded devices. In this work, we focus on the adaptation of Honeypots for improving the security of IoTs. Low-interaction honeypots are used so far in the context of IoT. Such honeypots are limited and easily detectable, and thus, there is a need to find ways how to develop high-interaction, reliable, IoT honeypots that will attract skilled attackers. In this work, we propose the SIPHON architecture - a Scalable high-Interaction Honeypot platform for IoT devices. Our architecture leverages IoT devices that are physically at one location and are connected to the Internet through so-called wormholes distributed around the world. The resulting architecture allows exposing few physical devices over a large number of geographically distributed IP addresses. We demonstrate the proposed architecture in a large scale experiment with 39 wormhole instances in 16 cities in 9 countries. Based on this setup, six physical IP cameras, one NVR and one IP printer are presented as 85 real IoT devices on the Internet, attracting a daily traffic of 700MB for a period of two months. A preliminary analysis of the collected traffic indicates that devices in some cities attracted significantly more traffic than others (ranging from 600 000 incoming TCP connections for the most popular destination to less than 50000 for the least popular). We recorded over 400 brute-force login attempts to the web-interface of our devices using a total of 1826 distinct credentials, from which 11 attempts were successful. Moreover, we noted login attempts to Telnet and SSH ports some of which used credentials found in the recently disclosed Mirai malware.