[Paper Review] DÏoT: A Crowdsourced Self-learning Approach for Detecting Compromised IoT Devices

Thien Duc Nguyen, Samuel Marchal+4 more|arXiv (Cornell University)|Apr 20, 2018

Network Security and Intrusion Detection39 citations

TL;DR

DÅoT proposes a self-learning, crowdsourced system for detecting compromised IoT devices by autonomously building device-type-specific normal communication profiles without labeled data. It achieves 96% detection rate with 1% false alarms and sub-0.03s response time against Mirai malware on real-world devices.

ABSTRACT

IoT devices are being widely deployed. Many of them are vulnerable due to insecure implementations and configuration. As a result, many networks already have vulnerable devices that are easy to compromise. This has led to a new category of malware specifically targeting IoT devices. Existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different manufacturers involved. In this paper, we present D\IoT, a system for detecting compromised IoT devices effectively. In contrast to prior work, D\IoT uses a novel self-learning approach to classify devices into device types and build for each of these normal communication profiles that can subsequently be used to detect anomalous deviations in communication patterns. D\IoT is completely autonomous and can be trained in a distributed crowdsourced manner without requiring human intervention or labeled training data. Consequently, D\IoT copes with the emergence of new device types as well as new attacks. By systematic experiments using more than 30 real-world IoT devices, we show that D\IoT is effective (96% detection rate with 1% false alarms) and fast (<0.03 s.) at detecting devices compromised by the infamous Mirai malware.

Motivation & Objective

• To address the challenge of detecting compromised IoT devices at scale due to diverse manufacturers and insecure configurations.
• To overcome limitations of existing intrusion detection systems that rely on labeled data and fail to adapt to new device types or zero-day attacks.
• To develop an autonomous, self-learning system capable of building normal communication profiles for different IoT device types without human intervention.
• To enable real-time detection of anomalous behavior indicative of malware compromise, such as Mirai, across heterogeneous IoT deployments.

Proposed method

• DÅoT uses a crowdsourced data collection mechanism to gather network traffic from diverse IoT devices in real-world environments.
• It automatically classifies devices into device types using unsupervised clustering based on network communication patterns.
• For each device type, it learns a normal communication profile using statistical modeling of traffic characteristics such as packet size, timing, and protocol usage.
• The system employs a self-learning framework that continuously updates profiles as new devices or behaviors emerge, ensuring adaptability to new device types and attack variants.
• Anomalies are detected by comparing real-time traffic against learned profiles, flagging deviations as potential compromises.
• The entire pipeline operates autonomously, requiring no labeled training data or manual configuration.

Experimental results

Research questions

• RQ1 Can a self-learning system detect compromised IoT devices without relying on labeled training data or human intervention?
• RQ2 How effective is a crowdsourced, device-type-specific profiling approach in detecting zero-day or emerging IoT malware like Mirai?
• RQ3 To what extent can the system adapt to new device types and evolving attack patterns in real time?
• RQ4 What is the detection accuracy and latency of such a system in real-world deployments with heterogeneous IoT devices?

Key findings

• DÅoT achieved a 96% detection rate for Mirai malware on more than 30 real-world IoT devices.
• The system maintained a low false positive rate of only 1% in detecting compromised devices.
• Detection latency was under 0.03 seconds per device, enabling real-time monitoring.
• The system successfully identified compromised devices across diverse manufacturers and device types without prior labeling.
• The self-learning mechanism enabled continuous adaptation to new device types and attack behaviors.
• The crowdsourced data collection approach ensured broad coverage and realistic profiling of real-world IoT communication patterns.