Data-driven Intelligent Attack Detection in Multilateral, Large-Scale and Heterogeneous Internet of Things Environments

物联网（IoT）的主要思想是使设备（例如，智能车辆、家用小工具等）感知环境，收集相关数据，分析这些数据，并根据提取的见解采取一些行动。这样的设备通常具有低处理能力和有限的存储器和存储容量。云计算一直是物联网设备用来满足其存储和分析需求的主要支柱。然而，云服务器通常部署在距离物联网设备相当远的位置，以及延迟关键型物联网应用的出现，都迫切需要扩展云架构以支持延迟关键型服务。在这种情况下，人们提出了雾计算的概念，以提供更接近物联网设备的数据分析和决策。上述物联网多玩家架构可能面临非传统的安全挑战，这是由于该环境的多边、异构和大规模性质，该环境由数十亿不同类型和大小的物联网、雾和云设备组成。我们这项研究计划的长期目标是提高在物联网雾云环境中检测高级攻击模式的效率。该研究计划的新奇在于研究物联网在综合多边环境中的安全性，其中物联网，雾和云层共存并相互作用，从而考虑新的非传统漏洞和威胁。拟议的研究计划涵盖三个主要研究方向，分别是：（1）用于攻击识别的大数据分析，其中将设计和实施深度和集成学习方法以识别高级攻击模式;（2）多边信任建立，其中多边（即，物联网到雾，雾到物联网，物联网到云，云到物联网，雾到云和云到雾）信任建立解决方案将被研究，以提高这些不同共存方之间通信通道的安全性;以及（3）数据驱动的网络安全决策，其中数据-利用从数据分析和信任跟踪中提取的洞察力的驱动数学模型将被设计为有效地帮助安全管理员有效地应对资源和预算限制问题。拟议的研究计划预计将在经济，社会和学术层面产生积极影响，通过（a）通过为物联网资产提供先进的安全解决方案，保护加拿大公共和私营部门在物联网技术方面的大量投资，（B）保护个人数据，因为它们流经不同的物联网层（即，物联网、雾和云），以及（c）为博士、硕士和本科生提供高质量的培训，使他们为加拿大就业市场的需求和标准做好准备。

The main idea of the Internet of Things (IoT) is to enable devices (e.g., smart vehicles, home gadgets, etc.) to sense the environment, collect pertinent data, analyse these data and make some actions based on the extracted insights. Such devices often possess low processing capabilities and limited memory and storage capacity. Cloud computing has always been the main backbone that IoT devices rely on to accommodate their storage and analytical needs. However, the fact that cloud servers are often deployed in locations that are quite far from the IoT devices and the emergence of delay-critical IoT applications urged the need for extending the cloud architecture to support delay-critical services. In this context, the concept of fog computing has been proposed to provide data analytics and decision-making closer to the IoT devices. The above-described IoT multi-player architecture is likely to be faced with non-conventional security challenges due to the multi-lateral, heterogeneous and large-scale nature of this environment which consists of billions of IoT, fog and cloud devices of different types and sizes. Our long-term goal of this research program is to improve the efficiency of detecting advanced attack patterns in the IoT-fog-cloud environments. The novelty of this research program lies in studying the security of the IoT in a comprehensive multilateral environment wherein the IoT, fog and cloud layers coexist and interact, thus considering new non-conventional vulnerabilities and threats. The proposed research program spans over three main research tracks, which are: (1) big data analytics for attack recognition in which deep and ensemble learning approaches will be designed and implemented to recognize advanced attack patterns; (2) multi-sided trust establishment in which multi-sided (i.e., IoT-to-fog, fog-to-IoT, IoT-to-cloud, cloud-to-IoT, fog-to-cloud and cloud-to-fog) trust establishment solutions will be investigated to improve the security of the communication channels among these different coexisting parties; and (3) data-driven cyber-security decision-making in which data-driven mathematical models that capitalize on the insights extracted from the data analytics and trust tracks will be designed to help security administrators effectively counter attackers' wily strategies and efficiently deal with the resource and budget limitation problems. The proposed research program is anticipated to have positive impacts at the economic, social and academic levels through (a) protecting the massive investments that are being made by the public and private sectors in Canada in the IoT technology by offering advanced security solutions for the IoT assets, (b) protecting individuals' data as they flow through the different IoT layers (i.e., IoT, fog and cloud), and (c) offering high-quality training to students at the PhD, Master's and undergraduate levels in such a way to prepare them for the Canadian job market's needs and standards.