[论文解读] Detection of Unauthorized IoT Devices Using Machine Learning Techniques

Yair Meidan, Michael Bohadana+5 more|arXiv (Cornell University)|Sep 14, 2017

Network Security and Intrusion Detection参考文献 6被引用 198

一句话总结

该论文使用基于 TCP/IP 流量特征的随机森林来自动检测未授权的物联网设备并正确对白名单类型进行分类，在20会话滑动窗口下实现约96%的未知检测率和99%的白名单分类正确率。

ABSTRACT

Security experts have demonstrated numerous risks imposed by Internet of Things (IoT) devices on organizations. Due to the widespread adoption of such devices, their diversity, standardization obstacles, and inherent mobility, organizations require an intelligent mechanism capable of automatically detecting suspicious IoT devices connected to their networks. In particular, devices not included in a white list of trustworthy IoT device types (allowed to be used within the organizational premises) should be detected. In this research, Random Forest, a supervised machine learning algorithm, was applied to features extracted from network traffic data with the aim of accurately identifying IoT device types from the white list. To train and evaluate multi-class classifiers, we collected and manually labeled network traffic data from 17 distinct IoT devices, representing nine types of IoT devices. Based on the classification of 20 consecutive sessions and the use of majority rule, IoT device types that are not on the white list were correctly detected as unknown in 96% of test cases (on average), and white listed device types were correctly classified by their actual types in 99% of cases. Some IoT device types were identified quicker than others (e.g., sockets and thermostats were successfully detected within five TCP sessions of connecting to the network). Perfect detection of unauthorized IoT device types was achieved upon analyzing 110 consecutive sessions; perfect classification of white listed types required 346 consecutive sessions, 110 of which resulted in 99.49% accuracy. Further experiments demonstrated the successful applicability of classifiers trained in one location and tested on another. In addition, a discussion is provided regarding the resilience of our machine learning-based IoT white listing method to adversarial attacks.

研究动机与目标

• 通过自动检测网络中的未授权设备来提升企业物联网安全。
• 开发一个可扩展、基于流量的白名单系统，无需专用硬件。
• 演示利用机器学习在 TCP/IP 流量数据上对物联网设备类型进行分类。
• 展示在不同实验室之间已训练模型的可迁移性并讨论对抗性攻击的鲁棒性。

提出的方法

• 将设备类型识别视为使用带标签的 TCP/IP 会话特征的多类分类问题。
• 在白名单设备类型的会话上训练随机森林分类器，以为每种类型产生后验概率。
• 使用分类阈值 tr 根据后验概率将会话标记为某一设备类型或未知。
• 对连续20个会话的滑动窗口进行多数表决以决定数据流的设备类型并提升鲁棒性。
• 将数据按时间划分为训练、验证和测试集，以模拟现实部署并减少过拟合。
• 为解决类别不平衡进行下采样，并在验证集上使用 F1 来优化阈值。

实验结果

研究问题

• RQ1 在真实企业环境中，TCP/IP 流量特征是否能够区分授权的物联网设备类型？
• RQ2 单个会话和会话序列是否能够可靠地将未知（未授权）物联网设备类型检测为“未知”？
• RQ3 对一系列会话进行多数表决是否能提升对授权和未授权设备的检测与分类准确性？
• RQ4 在一个实验室训练的分类器能否在另一实验室的数据上实现可移植性（transferability）？

主要发现

• 在使用 110 会话的滑动窗口进行移动分析时，未授权物联网设备类型在测试用例中被检测为未知的比例为 96%（在抽象/章节中报告了单阶段分析）。
• 在测试集中，白名单设备类型在 20 会话多数表决下被正确按实际类型分类的比例为 99%。
• 在九组实验中（每次从白名单中排除一个设备类型），在测试集中检测未知设备的平均准确率为 96%，对白名单设备的平均分类准确率为 99%。
• 迁移性实验表明，在 Lab A 训练的分类器在 Lab B 测试未授权电视时的平均准确率为 85%，在跨实验室检测未授权安防摄像头时达到完全可移植性（100%）。
• 多数表决阶段显著提升了总体性能，在大多数设备类型上将未授权检测提升至 96%，对白名单分类提升至 99%。