Characterizing and Mining Traffic Patterns of IoT Devices in Edge Networks
Characterizing and Mining Traffic Patterns of IoT Devices in Edge Networks
复制标题
DOI：
10.1109/tnse.2020.3026961
复制
发表时间：
2021-01
影响因子：
6.6
通讯作者：
Yinxin Wan;Kuai Xu;Feng Wang;G. Xue
中科院分区：
文献类型：
--
作者：
Yinxin Wan;Kuai Xu;Feng Wang;G. Xue
随着智能家居、智能城市和智能行业中的物联网（IoT）设备的规模和复杂性不断增长，在分布式边缘网络中管理和保护它们已成为令人生畏但至关重要的任务。最近一系列利用物联网设备的漏洞和安全管理不足的网络攻击凸显了保护数十亿物联网设备和应用程序的紧迫性和挑战。作为了解和缓解物联网设备各种安全威胁的第一步，本文在可编程和智能边缘路由器上开发了物联网流量测量框架，以自动收集边缘网络中物联网设备的传入、传出和内部网络流量，并构建多维行为配置文件，描述谁、何时、做什么、以及为什么基于连续收集的流量数据的物联网设备的行为模式。据我们所知，本文首次揭示了边缘网络中物联网设备的IP空间，时间，熵和云服务模式，并探索这些多维行为指纹，用于物联网设备分类，异常流量检测和网络安全监控互联网上脆弱和资源受限的物联网设备。
As connected Internet-of-things (IoT) devices in smart homes, smart cities, and smart industries continue to grow in size and complexity, managing and securing them in distributed edge networks have become daunting but crucial tasks. The recent spate of cyber attacks exploiting the vulnerabilities and insufficient security management of IoT devices have highlighted the urgency and challenges for securing billions of IoT devices and applications. As a first step towards understanding and mitigating diverse security threats of IoT devices, this paper develops an IoT traffic measurement framework on programmable and intelligent edge routers to automatically collect incoming, outgoing, and internal network traffic of IoT devices in edge networks, and to build multidimensional behavioral profiles which characterize who, when, what, and why on the behavioral patterns of IoT devices based on continuously collected traffic data. To the best of our knowledge, this paper is the first effort to shed light on the IP-spatial, temporal, entropy, and cloud service patterns of IoT devices in edge networks, and to explore these multidimensional behavioral fingerprints for IoT device classification, anomaly traffic detection, and network security monitoring for vulnerable and resource-constrained IoT devices on the Internet.