| Texto completo | |
| Autor(es): |
Borges, Joao B.
;
Medeiros, Joao P. S.
;
Barbosa, Luiz P. A.
;
Ramos, Heitor S.
;
Loureiro, Antonio A. F.
Número total de Autores: 5
|
| Tipo de documento: | Artigo Científico |
| Fonte: | IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING; v. 35, n. 12, p. 13-pg., 2023-12-01. |
| Resumo | |
In this work, we propose a solution for detecting botnet attacks on the Internet of Things (IoT) by identifying anomalies in the temporal dynamics of their devices. Given their limited computing capabilities, IoT devices are more vulnerable to attacks than conventional computers. In this scenario, botnets have a high degree of severity since they are used to trigging distributed denial-of-service attacks, which are amplified by a large number of IoT devices. Thus, solutions aiming to identify and mitigate the damage caused by botnets in IoT are urgent and essential. We evaluate the number of packets a device transmits, following a multiscale ordinal patterns transformation, and use Isolation Forest for anomaly detection. By investigating how devices evolve, we can distinguish between normal and anomalous behaviors. We apply the proposed solution to detect two major botnets for IoT: Mirai and Bashlite. We evaluated our model throughout two experimental setups. The first, using a single model for all devices, reaching 99.5% of accuracy and 99.6% of specificity, and the second, by tuning a model per device, reaching 100% of accuracy. These results show that, with the proper transformation, it is possible to use simple methods for detecting anomalies in IoT devices' behaviors. (AU) | |
| Processo FAPESP: | 20/05121-4 - Análise de dados heterogêneos em computação urbana |
| Beneficiário: | Heitor Soares Ramos Filho |
| Modalidade de apoio: | Auxílio à Pesquisa - Regular |
| Processo FAPESP: | 15/24494-8 - Comunicação e processamento de big data em nuvens e névoas computacionais |
| Beneficiário: | Nelson Luis Saldanha da Fonseca |
| Modalidade de apoio: | Auxílio à Pesquisa - Temático |
| Processo FAPESP: | 18/23064-8 - Mobilidade na computação urbana: caracterização, modelagem e aplicações (MOBILIS) |
| Beneficiário: | Antonio Alfredo Ferreira Loureiro |
| Modalidade de apoio: | Auxílio à Pesquisa - Temático |