OAC Core: MedKnights - Towards Secure and Flexible Medical IoT (IoMT) Infrastructure using Generative Adversarial Networks

随着医疗保健需求的增长，医疗物联网(IoMT)近年来显著增长，并主导着医疗保健行业。然而，这些更智能、更先进的医疗设备在软件和硬件方面都非常复杂，存在定期发现的缺陷和漏洞，也容易受到可能的恶意攻击。医疗保健组织是攻击者实施以物联网为重点的网络攻击的新焦点，这种攻击正变得越来越常见。近年来，勒索软件和分布式拒绝服务(DDoS)攻击是物联网设备上流行的基于恶意软件的攻击。网络攻击和临床护理中断可能会对患者的安全产生灾难性的影响，这取决于医务人员的反应能力。此外，由于不同的医疗设备具有不同的重要功能，因此为这些设备提供差异化的网络服务至关重要，这些设备在不同的网络动态下具有不同的关键操作级别。因此，有效地检测和识别任何恶意网络活动，以消除或最大限度地减少这些攻击的影响，以及检测和识别属于不同医疗设备的网络流量至关重要。MedKnight项目将扩展网络、机器学习和数字取证领域的知识，开发可部署在网络边缘组件的整体框架，并有效支持物联网网络和设备的不同细粒度安全服务。该项目的主要目标包括：(1)创建新型医疗设备试验床、IoMT网络流量数据集、IoMT设备行为特征数据集和攻击数据集；(2)利用产生式对抗网络(GAN)识别医疗网络和设备的许多有趣特征，执行多类分类、自动特征提取，并对噪声具有健壮性，支持网络中的漂移，并支持新设备的持续学习，以确保IoMT网络和设备的安全；以及(3)启用IoMT设备的远程内存取证能力。该项目还将开展一系列涉及K-12、本科生和研究生的教育活动，大力招收和指导来自代表性不足群体的学生，并通过让学生接触网络、安全和机器学习方面的尖端研究来丰富本科生和研究生课程。此外，在该项目的范围内，预计将有多个行业合作。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

With growing healthcare demands, the Internet of Medical Things (IoMT) has grown significantly in recent years and is dominating the healthcare industry. However, these smarter and advanced medical devices are very complicated in terms of software and hardware, with defects and vulnerabilities that are found regularly and they are also vulnerable to possible malicious attacks. Healthcare organizations are the new focus of attackers for carrying out IoMT-focused cyberattacks, which are becoming more common. In recent years, ransomware and distributed denial of service (DDoS) attacks are malware-based popular attacks on IoMT devices. Cyberattacks and disruptions in clinical care can have a catastrophic effect on patient safety, which trickles down to the medical staff’s responsiveness. Moreover, because different medical devices have varying vital capabilities, it is critical to enable differentiated network services for these devices with varying critical levels of operation under varying network dynamics. Hence it is crucial to efficiently detect and identify any malicious network activities to eliminate or minimize the impact of these attacks, as well as to detect and identify network traffic belonging to different medical devices.The MedKnights project will extend knowledge in networking, machine learning, and the digital forensic domains in developing a holistic framework that can be deployed at the network edge components and effectively support different fine-grained security services for IoMT networks and devices. The main objectives of the project include: (1) creating a novel medical device testbed, IoMT network traffic datasets, IoMT device behavior signature datasets, and attack datasets; (2) employing generative adversarial networks (GANs) to identify many of the interesting features for medical networks and devices, to perform multi-class classification, automatic feature extraction, and be robust to noise, support drifts in networks, and support continual learning for new devices for securing IoMT networks and devices; and (3) enabling remote memory forensic capabilities for IoMT devices. The project will also carry out a number of educational activities involving K-12, undergraduate, and graduate students, make strong outreach efforts for recruiting and mentoring students from underrepresented groups, as well as enrich undergraduate and graduate curricula through exposing students to cutting-edge research in networking, security, and machine learning. In addition, multiple industrial collaborations are expected within the scope of the project.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.