Collaborative Research: CISE-MSI: Active and Passive Internet Measurements for Inferring IoT Maliciousness at Scale

物联网(IoT)范式下的智能传感技术继续部署在卫生、农业、能源和制造业等关键部门。事实上，据估计，到2030年，将有大约300亿台物联网设备配备仪器，以提高效率和可用性，同时降低成本和维护时间。然而，这类物联网设备甚至缺乏最基本的安全措施、访问策略控制和补丁管理功能，这使得它们成为攻击者和国家支持的行为者的诱人目标，他们将滥用它们获得对关键网络的非法访问，同时精心策划它们，以损害其他与互联网连接的实体。鉴于此类物联网设备的广泛部署，迅速在规模上解决它们的安全问题变得极其具有挑战性。这主要是因为缺乏可扩展的方法来分析大规模的、有代表性的数据，以及缺乏足够有效的技术来接近实时地操作。为此，该项目服务于NSF的使命，即通过开发经验驱动的方法和技术来量化物联网的不安全性，同时提供数字取证手段来理解其遗传漏洞的原因，从而促进科学进步。该项目还提供了以物联网为中心的补救策略，以支持互联网安全。该项目促进了一系列教育活动，同时组织了以妇女为重点的讲习班，此外还指导来自三个合作的少数群体中代表性不足的群体的学生。该项目设计了数据驱动的方法，对主动和被动收集的网络流量和相关服务横幅进行操作，以建立唯一的标有恶意物联网标签的经验数据集。然后，该项目设计并实施了植根于有监督的深度学习的算法和正式方法，以提取互联网规模利用的物联网设备的指纹，同时开发物联网特定的功能工程和群集算法，以表征和分析物联网活动的恶意编排。此外，该项目执行恶意软件自动反汇编、反编译和分析，同时通过求解线性方程组来设计对数据包序列的计算方法，以研究物联网无状态扫描模块和相关欺骗技术。这被利用来使用精心编制的数据包与受感染的设备建立虚假连接，以便捕获关键的物联网恶意软件和数字取证文物。为了支持特定于物联网的运营网络安全行动，该项目构建并向公众提供网络基础设施，其中索引推断的受危害的物联网设备及其相关威胁信息，包括采用的恶意软件二进制文件和攻击的战术、技术和程序。该奖项旨在实现主动的物联网安全补救、实践研究和培训以及法医调查。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Smart sensing technologies within the context of the Internet-of-Things (IoT) paradigm continue to be deployed in key sectors such as health, agriculture, energy and manufacturing. Indeed, it is estimated that around 30 billion IoT devices will be instrumented by 2030 to increase efficiencies and usability while decreasing costs and maintenance time. Nevertheless, such IoT devices lack even the most fundamental security measures, access policy controls, and patch management capabilities, making them attractive targets for attackers and state-sponsored actors who will abuse them to gain illegitimate access into critical networks while orchestrating them in order to impair other Internet-connected entities. Given the widespread deployment of such IoT devices, it becomes extremely challenging to promptly address their security concerns at-scale. This is mainly due to the lack of scalable methods, which could analyze large-scale, representative data, and the shortage of techniques that are efficient enough to be operated in near real-time. To this end, this project servers NSF’s mission to promote the progress of science by developing empirically-driven methods and techniques to quantity IoT insecurities at-large, while offering digital forensics means to comprehend the causes of their inherit vulnerabilities. The project also offers IoT-centric remediation tactics for supporting Internet security. The project fosters a number of educational activities while organizing female-focused workshops in addition to mentoring students within underrepresented groups from the three collaborating minority institutions. The project devises data-driven methodologies operating on actively and passively-collected network traffic and associated service banners to establish unique malicious IoT labeled empirical datasets. The project then designs and implements algorithms and formal methods rooted in supervised deep learning to fingerprint Internet-scale exploited IoT devices while developing IoT-specific feature engineering and clustering algorithms for characterizing and analyzing the malicious orchestration of IoT campaigns. Additionally, the project executes malware automated disassembly, decompilation, and analysis while engineering computational approaches on packet sequences via solving linear equation sets to investigate IoT stateless scanning modules and related deceiving techniques. This is leveraged to establish bogus connections with the infected devices using crafted packets in order to capture key IoT malware and digital forensic artifacts. To support operational IoT-specific cyber security operations, the project builds and makes available to the public a cyberinfrastructure, which indexes the inferred compromised IoT devices along with their related threat information including employed malware binaries and attacks’ tactics, techniques, and procedures. This aims at enabling proactive IoT security remediation, hands-on research and training, and forensic investigations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.