IoTAthena: Unveiling IoT Device Activities From Network Traffic
IoTAthena: Unveiling IoT Device Activities From Network Traffic
复制标题
DOI：
10.1109/twc.2021.3098608
复制
发表时间：
2021-05
影响因子：
10.4
通讯作者：
Yinxin Wan;Kuai Xu;Feng Wang;G. Xue
中科院分区：
文献类型：
--
作者：
Yinxin Wan;Kuai Xu;Feng Wang;G. Xue
最近针对智能家居中物联网（IoT）设备的一连串网络攻击需要有效的技术来理解、表征和揭示物联网设备的活动。在本文中，我们提出了一个名为IoTAthena的新系统，用于从包含时间戳IP数据包的原始网络流量中揭示物联网设备活动。IoTAthena使用由有序的IP数据包序列和数据包间时间间隔组成的活动签名来表征每个物联网设备的活动。IoTAthena有两种新颖的多项式时间算法，sigMatch和actExtract。对于任何给定的签名，sigMatch可以捕获原始网络流量中签名的所有匹配项。使用sigMatch作为子函数，actExtract可以从原始网络流量中准确地揭示各种物联网设备活动的顺序。利用在现实世界智能家居测试平台的路由器上收集的异构物联网设备的网络流量和公共物联网数据集，我们证明了IoTAthena能够表征和生成物联网设备活动的活动签名，并从原始网络流量中准确揭示物联网设备活动的顺序。
The recent spate of cyber attacks towards Internet of Things (IoT) devices in smart homes calls for effective techniques to understand, characterize, and unveil IoT device activities. In this paper, we present a new system, named IoTAthena, to unveil IoT device activities from raw network traffic consisting of timestamped IP packets. IoTAthena characterizes each IoT device activity using an activity signature consisting of an ordered sequence of IP packets with inter-packet time intervals. IoTAthena has two novel polynomial time algorithms, sigMatch and actExtract. For any given signature, sigMatch can capture all matches of the signature in the raw network traffic. Using sigMatch as a subfunction, actExtract can accurately unveil the sequence of various IoT device activities from the raw network traffic. Using the network traffic of heterogeneous IoT devices collected at the router of a real-world smart home testbed and a public IoT dataset, we demonstrate that IoTAthena is able to characterize and generate activity signatures of IoT device activities and accurately unveil the sequence of IoT device activities from raw network traffic.