D-Score: An Expert-Based Method for Assessing the Detectability of IoT-Related Cyber-Attacks

by   Yair Meidan, et al.

IoT devices are known to be vulnerable to various cyber-attacks, such as data exfiltration and the execution of flooding attacks as part of a DDoS attack. When it comes to detecting such attacks using network traffic analysis, it has been shown that some attack scenarios are not always equally easy to detect if they involve different IoT models. That is, when targeted at some IoT models, a given attack can be detected rather accurately, while when targeted at others the same attack may result in too many false alarms. In this research, we attempt to explain this variability of IoT attack detectability and devise a risk assessment method capable of addressing a key question: how easy is it for an anomaly-based network intrusion detection system to detect a given cyber-attack involving a specific IoT model? In the process of addressing this question we (a) investigate the predictability of IoT network traffic, (b) present a novel taxonomy for IoT attack detection which also encapsulates traffic predictability aspects, (c) propose an expert-based attack detectability estimation method which uses this taxonomy to derive a detectability score (termed `D-Score') for a given combination of IoT model and attack scenario, and (d) empirically evaluate our method while comparing it with a data-driven method.


page 1

page 15

page 24


N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders

The proliferation of IoT devices which can be more easily compromised th...

Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT

The rapid increase in the use of IoT devices brings many benefits to the...

Cyber-attack Mitigation and Impact Analysis for Low-power IoT Devices

Recent years have seen exponential development in wireless sensor device...

Detection and Classification of Novel Attacks and Anomaly in IoT Network using Rule based Deep Learning Model

Attackers are now using sophisticated techniques, like polymorphism, to ...

Detecting FDI Attack on Dense IoT Network with Distributed Filtering Collaboration and Consensus

The rise of IoT has made possible the development of personalized servi...

On the Effectiveness of Clone Detection for Detecting IoT-related Vulnerable Clones

Since IoT systems provide services over the Internet, they must continue...

Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset

The proliferation of IoT systems, has seen them targeted by malicious th...

Please sign up or login with your details

Forgot password? Click here to reset