[Paper Review] ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks

Phillip Rieger, Marco Chilese+4 more|arXiv (Cornell University)|Feb 15, 2023

Network Security and Intrusion Detection4 citations

TL;DR

ARGUS is a self-learning, unsupervised deep learning-based intrusion detection system that detects stealthy IoT contextual attacks by modeling normal device behavior in context, using real-time sensor and action data to identify anomalous command invocations. It achieves an F1-score of at least 99.64% and a false positive rate of ≤0.03% across diverse real-world smart-home deployments.

ABSTRACT

IoT application domains, device diversity and connectivity are rapidly growing. IoT devices control various functions in smart homes and buildings, smart cities, and smart factories, making these devices an attractive target for attackers. On the other hand, the large variability of different application scenarios and inherent heterogeneity of devices make it very challenging to reliably detect abnormal IoT device behaviors and distinguish these from benign behaviors. Existing approaches for detecting attacks are mostly limited to attacks directly compromising individual IoT devices, or, require predefined detection policies. They cannot detect attacks that utilize the control plane of the IoT system to trigger actions in an unintended/malicious context, e.g., opening a smart lock while the smart home residents are absent. In this paper, we tackle this problem and propose ARGUS, the first self-learning intrusion detection system for detecting contextual attacks on IoT environments, in which the attacker maliciously invokes IoT device actions to reach its goals. ARGUS monitors the contextual setting based on the state and actions of IoT devices in the environment. An unsupervised Deep Neural Network (DNN) is used for modeling the typical contextual device behavior and detecting actions taking place in abnormal contextual settings. This unsupervised approach ensures that ARGUS is not restricted to detecting previously known attacks but is also able to detect new attacks. We evaluated ARGUS on heterogeneous real-world smart-home settings and achieve at least an F1-Score of 99.64% for each setup, with a false positive rate (FPR) of at most 0.03%.

Motivation & Objective

• Address the gap in detecting stealthy IoT attacks that exploit the control plane to trigger legitimate commands in malicious contexts.
• Overcome limitations of existing systems that rely on predefined policies, semantic information, or known attack signatures.
• Enable detection of zero-day and unknown contextual attacks without requiring labeled attack data or prior knowledge of device semantics.
• Support heterogeneous IoT environments with devices from multiple manufacturers using different protocols and communication technologies.
• Ensure low false positive rates while maintaining high detection accuracy in real-world, dynamic smart-home scenarios.

Proposed method

• Collects real-time contextual data from IoT devices, including sensor values and device actions, across diverse communication protocols.
• Employs an unsupervised Deep Neural Network (DNN) to learn the normal distribution of device behavior patterns based on observed sensor states and actions.
• Models the system state as a dynamic context vector derived from aggregated sensor and action data over time windows.
• Uses a dynamic threshold tuning mechanism to adaptively distinguish between normal behavior and contextual anomalies.
• Detects anomalies by identifying command executions that occur in statistically improbable or inconsistent contextual states.
• Does not require labeled attack data, semantic device descriptions, or predefined policy rules, enabling zero-day detection.

Experimental results

Research questions

• RQ1 Can an unsupervised learning approach effectively detect contextual attacks in heterogeneous IoT environments without relying on known attack signatures?
• RQ2 How well can a DNN-based model learn and generalize normal device behavior patterns across diverse smart-home configurations?
• RQ3 To what extent can the system detect zero-day attacks that exploit legitimate control commands in malicious contexts?
• RQ4 How does the system perform in terms of detection accuracy and false positive rate across real-world, complex IoT deployments?
• RQ5 Can the system detect attacks that are semantically benign but contextually malicious, such as unlocking a door when the home is unoccupied?

Key findings

• ARGUS achieves an F1-score of at least 99.64% across five distinct real-world smart-home configurations, demonstrating high detection accuracy.
• The system maintains a false positive rate (FPR) of at most 0.03% across all evaluated setups, indicating strong reliability and low noise.
• ARGUS successfully detects contextual attacks such as unlocking a door during user absence or turning on a stove when unattended, even when commands are syntactically and network-wise indistinguishable from benign ones.
• The system operates effectively without requiring semantic information, source code, or predefined policies, making it applicable to user-built or third-party devices.
• The unsupervised DNN-based approach enables detection of previously unknown attacks, including those not seen during training.
• Dynamic threshold tuning enhances robustness in real-time operation, adapting to environmental variations without retraining.