Data-driven Intelligent Attack Detection in Multilateral, Large-Scale and Heterogeneous Internet of Things Environments

物联网(IoT)的主要思想是支持设备(例如，智能汽车、家用电器等)。感知环境，收集相关数据，分析这些数据，并根据提取的洞察力采取一些行动。此类设备通常具有较低的处理能力以及有限的内存和存储容量。云计算一直是物联网设备满足其存储和分析需求所依赖的主要支柱。然而，云服务器通常部署在远离物联网设备的位置，以及延迟关键型物联网应用的出现，促使需要扩展云架构以支持延迟关键型服务。在这种背景下，雾计算的概念被提出，以提供更接近物联网设备的数据分析和决策。由于该环境的多边性、异构性和规模性，上述物联网多玩家架构可能面临非常规安全挑战，该环境由数十亿个不同类型和大小的物联网、雾和云设备组成。我们该研究计划的长期目标是提高在物联网-雾-云环境中检测高级攻击模式的效率。该研究项目的创新之处在于，在物联网、雾和云层共存并相互作用的综合多边环境中研究物联网的安全，从而考虑到新的非常规脆弱性和威胁。提出的研究计划跨越三个主要研究轨道，即：(1)用于攻击识别的大数据分析，其中将设计和实施深度和集成学习方法来识别高级攻击模式；(2)多边信任建立，其中将研究多边(即物联网到雾、物联网到云、云到物联网、云到物联网、云到云和云到雾)信任建立解决方案，以提高这些不同共存各方之间通信通道的安全性；以及(3)数据驱动的网络安全决策，其中数据驱动的数学模型将利用从数据分析和信任跟踪中提取的见解来设计，以帮助安全管理员有效地对抗攻击者的狡猾策略，并有效地处理资源和预算限制问题。预计拟议的研究计划将通过以下方式在经济、社会和学术层面产生积极影响：(A)通过为物联网资产提供先进的安全解决方案，保护加拿大公共和私营部门正在物联网技术上进行的大规模投资，(B)保护通过物联网不同层(即物联网、雾和云)的个人数据，以及(C)为博士、硕士和本科水平的学生提供高质量的培训，使他们为加拿大就业市场的需求和标准做好准备。

The main idea of the Internet of Things (IoT) is to enable devices (e.g., smart vehicles, home gadgets, etc.) to sense the environment, collect pertinent data, analyse these data and make some actions based on the extracted insights. Such devices often possess low processing capabilities and limited memory and storage capacity. Cloud computing has always been the main backbone that IoT devices rely on to accommodate their storage and analytical needs. However, the fact that cloud servers are often deployed in locations that are quite far from the IoT devices and the emergence of delay-critical IoT applications urged the need for extending the cloud architecture to support delay-critical services. In this context, the concept of fog computing has been proposed to provide data analytics and decision-making closer to the IoT devices. The above-described IoT multi-player architecture is likely to be faced with non-conventional security challenges due to the multi-lateral, heterogeneous and large-scale nature of this environment which consists of billions of IoT, fog and cloud devices of different types and sizes. Our long-term goal of this research program is to improve the efficiency of detecting advanced attack patterns in the IoT-fog-cloud environments. The novelty of this research program lies in studying the security of the IoT in a comprehensive multilateral environment wherein the IoT, fog and cloud layers coexist and interact, thus considering new non-conventional vulnerabilities and threats. The proposed research program spans over three main research tracks, which are: (1) big data analytics for attack recognition in which deep and ensemble learning approaches will be designed and implemented to recognize advanced attack patterns; (2) multi-sided trust establishment in which multi-sided (i.e., IoT-to-fog, fog-to-IoT, IoT-to-cloud, cloud-to-IoT, fog-to-cloud and cloud-to-fog) trust establishment solutions will be investigated to improve the security of the communication channels among these different coexisting parties; and (3) data-driven cyber-security decision-making in which data-driven mathematical models that capitalize on the insights extracted from the data analytics and trust tracks will be designed to help security administrators effectively counter attackers' wily strategies and efficiently deal with the resource and budget limitation problems. The proposed research program is anticipated to have positive impacts at the economic, social and academic levels through (a) protecting the massive investments that are being made by the public and private sectors in Canada in the IoT technology by offering advanced security solutions for the IoT assets, (b) protecting individuals' data as they flow through the different IoT layers (i.e., IoT, fog and cloud), and (c) offering high-quality training to students at the PhD, Master's and undergraduate levels in such a way to prepare them for the Canadian job market's needs and standards.