[Paper Review] CIoTA: Collaborative IoT Anomaly Detection via Blockchain

Tomer Golomb, Yisroel Mirsky+1 more|arXiv (Cornell University)|Mar 10, 2018

Network Security and Intrusion Detection21 references43 citations

TL;DR

CIoTA is a lightweight, blockchain-based framework for distributed, collaborative anomaly detection on resource-constrained IoT devices, using Extensible Markov Models and peer consensus to update trusted models. It is evaluated on a 48-node Raspberry Pi IoT testbed.

ABSTRACT

Due to their rapid growth and deployment, Internet of things (IoT) devices have become a central aspect of our daily lives. However, they tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can help us secure the IoT devices. However, an anomaly detection model must be trained for a long time in order to capture all benign behaviors. This approach is vulnerable to adversarial attacks since all observations are assumed to be benign while training the anomaly detection model. In this paper, we propose CIoTA, a lightweight framework that utilizes the blockchain concept to perform distributed and collaborative anomaly detection for devices with limited resources. CIoTA uses blockchain to incrementally update a trusted anomaly detection model via self-attestation and consensus among IoT devices. We evaluate CIoTA on our own distributed IoT simulation platform, which consists of 48 Raspberry Pis, to demonstrate CIoTA's ability to enhance the security of each device and the security of the network as a whole.

Motivation & Objective

• Address the vulnerabilities of unsupervised anomaly-based IDS during training and deployment phases.
• Propose a scalable, distributed framework that improves detection through collaborative model updates while preserving device constraints.
• Leverage blockchain-based consensus to incrementally merge locally trained models into trusted global models.
• Evaluate robustness to adversarial attacks and measure lightweight operational overhead on IoT hardware.

Proposed method

• Use an Extensible Markov Model (EMM) to represent control-flow behavior as memory regions and transitions.
• Organize locally trained models into blocks and chains; a block is closed when it contains L reports and is verified by consensus.
• Merge multiple EMMs into a Combined Model using a consensus rule pc and the merging equation M = nij/ni for each transition.
• Verify a merged model against local models using a distance-based criterion α (VerifyML).
• Secure inter-device communication and block integrity via signatures and a TrustZone-based symmetric-key approach (PKI optional).
• Evaluate scalability and security on a 48-device IoT simulation platform (Raspberry Pis) with predefined parameters (T, L, pc, α, pthr).

Experimental results

Research questions

• RQ1 How effectively can collaboration across many IoT devices improve anomaly detection performance compared to isolated models?
• RQ2 Can CIoTA withstand adversarial manipulation of local models while preserving security and trust in the global chain?
• RQ3 What is the onboard computational and memory overhead of CIoTA on resource-constrained devices?
• RQ4 Does the blockchain-based consensus reliably prevent the acceptance of poisoned or malformed models within a block?
• RQ5 What is the impact of block size and consensus thresholds on detection latency and false positive rate?

Key findings

• Jointly formed Combined Models converge faster and provide stronger anomaly detection than single models, enabling clear malware detection with low false positives for L = 20.
• Attacks where malicious code is dissimilar to the application are rejected due to consensus filtering in the combined model.
• Even when attacked models resemble legitimate control-flow, the consensus mechanism prevents widespread acceptance of infected models unless pc of models are compromised.
• CIoTA’s runtime overhead on IoT devices is modest in the evaluated setup: ~6.5% CPU, ~60 KB memory, and ~260 KB executable size.
• Evaluation on 48 Raspberry Pi devices demonstrates CIoTA’s capability to detect local attacks and resist adversarial manipulation.
• The framework is suitable for large industrial settings and smart cities, with each IoT model/firmware maintaining its own chain.