Data-driven Intelligent Attack Detection in Multilateral, Large-Scale and Heterogeneous Internet of Things Environments

物联网（IoT）的主要思想是使设备（例如智能汽车，家用设备等）能够感知环境，收集相关数据，分析这些数据并根据提取的见解做出一些行动。这种设备通常具有较低的处理能力和有限的内存和存储容量。云计算一直是物联网设备所依赖的主要支柱，以满足其存储和分析需求。然而，云服务器通常部署在远离物联网设备的位置，以及延迟关键型物联网应用的出现，迫切需要扩展云架构以支持延迟关键型服务。在这种情况下，雾计算的概念被提出，以提供更接近物联网设备的数据分析和决策。由于该环境由数十亿不同类型和大小的物联网、雾和云设备组成，因此上述物联网多玩家架构可能面临非传统的安全挑战。我们这项研究计划的长期目标是提高在物联网雾云环境中检测高级攻击模式的效率。本研究项目的新颖之处在于，在物联网、雾层和云层共存、相互作用的综合多边环境下研究物联网的安全性，从而考虑新的非常规漏洞和威胁。提出的研究计划跨越三个主要研究轨道，即：(1)攻击识别的大数据分析，其中将设计和实施深度和集成学习方法来识别高级攻击模式；(2)多方信任建立，研究多方（即物联网到雾、物联网到物联网、物联网到云、云到物联网、雾到云、云到雾）信任建立解决方案，以提高不同共存方之间通信渠道的安全性；(3)数据驱动的网络安全决策，利用从数据分析和信任跟踪中提取的见解，设计数据驱动的数学模型，帮助安全管理员有效地反击攻击者的狡猾策略，并有效地处理资源和预算限制问题。拟议的研究计划预计将在经济、社会和学术层面产生积极影响，通过(a)通过为物联网资产提供先进的安全解决方案，保护加拿大公共和私营部门在物联网技术方面的大量投资，(b)保护流经不同物联网层（即物联网、雾和云）的个人数据，以及(c)为博士生提供高质量的培训。硕士和本科水平，以这样的方式为加拿大就业市场的需求和标准做好准备。

The main idea of the Internet of Things (IoT) is to enable devices (e.g., smart vehicles, home gadgets, etc.) to sense the environment, collect pertinent data, analyse these data and make some actions based on the extracted insights. Such devices often possess low processing capabilities and limited memory and storage capacity. Cloud computing has always been the main backbone that IoT devices rely on to accommodate their storage and analytical needs. However, the fact that cloud servers are often deployed in locations that are quite far from the IoT devices and the emergence of delay-critical IoT applications urged the need for extending the cloud architecture to support delay-critical services. In this context, the concept of fog computing has been proposed to provide data analytics and decision-making closer to the IoT devices. The above-described IoT multi-player architecture is likely to be faced with non-conventional security challenges due to the multi-lateral, heterogeneous and large-scale nature of this environment which consists of billions of IoT, fog and cloud devices of different types and sizes. Our long-term goal of this research program is to improve the efficiency of detecting advanced attack patterns in the IoT-fog-cloud environments. The novelty of this research program lies in studying the security of the IoT in a comprehensive multilateral environment wherein the IoT, fog and cloud layers coexist and interact, thus considering new non-conventional vulnerabilities and threats. The proposed research program spans over three main research tracks, which are: (1) big data analytics for attack recognition in which deep and ensemble learning approaches will be designed and implemented to recognize advanced attack patterns; (2) multi-sided trust establishment in which multi-sided (i.e., IoT-to-fog, fog-to-IoT, IoT-to-cloud, cloud-to-IoT, fog-to-cloud and cloud-to-fog) trust establishment solutions will be investigated to improve the security of the communication channels among these different coexisting parties; and (3) data-driven cyber-security decision-making in which data-driven mathematical models that capitalize on the insights extracted from the data analytics and trust tracks will be designed to help security administrators effectively counter attackers' wily strategies and efficiently deal with the resource and budget limitation problems. The proposed research program is anticipated to have positive impacts at the economic, social and academic levels through (a) protecting the massive investments that are being made by the public and private sectors in Canada in the IoT technology by offering advanced security solutions for the IoT assets, (b) protecting individuals' data as they flow through the different IoT layers (i.e., IoT, fog and cloud), and (c) offering high-quality training to students at the PhD, Master's and undergraduate levels in such a way to prepare them for the Canadian job market's needs and standards.