In recent years, the emerging Internet-of-Things (IoT) has led to rising concerns about the security of networked embedded devices. In this work, we focus on the adaptation of Honeypots for improving the security of IoTs. Low-interaction honeypots are used so far in the context of IoT. Such honeypots are limited and easily detectable, and thus, there is a need to find ways how to develop high-interaction, reliable, IoT honeypots that will attract skilled attackers. In this work, we propose the SIPHON architecture - a Scalable high-Interaction Honeypot platform for IoT devices. Our architecture leverages IoT devices that are physically at one location and are connected to the Internet through so-called wormholes distributed around the world. The resulting architecture allows exposing few physical devices over a large number of geographically distributed IP addresses. We demonstrate the proposed architecture in a large scale experiment with 39 wormhole instances in 16 cities in 9 countries. Based on this setup, six physical IP cameras, one NVR and one IP printer are presented as 85 real IoT devices on the Internet, attracting a daily traffic of 700MB for a period of two months. A preliminary analysis of the collected traffic indicates that devices in some cities attracted significantly more traffic than others (ranging from 600 000 incoming TCP connections for the most popular destination to less than 50000 for the least popular). We recorded over 400 brute-force login attempts to the web-interface of our devices using a total of 1826 distinct credentials, from which 11 attempts were successful. Moreover, we noted login attempts to Telnet and SSH ports some of which used credentials found in the recently disclosed Mirai malware.
Another recent paper @cite_14 proposes a Bayesian game to defend against attacks in a honeypot enabled IoT network. In that paper, various game scenarios are described depending on the changing strategies of both the attacker and defender. The authors perform systematic mathematical analysis of the games and evaluate the Bayesian model through simulation.
@cite_14
2320597598 2784241349 2152421692 2765659133
In modern days, breakthroughs in information and communications technologies lead to more and more devices of every imaginable type being connected to the Internet. This also strengthens the need for protection against cyber-attacks, as virtually any devices with a wireless connection could be vulnerable to malicious hacking attempts. Meanwhile, honeypot-based deception mechanism has been considered as one of the methods to ensure security for modern networks in the Internet of Things (IoT). In this paper, we address the problem of defending against attacks in honeypot-enabled networks by looking at a game-theoretic model of deception involving an attacker and a defender. The attacker may try to deceive the defender by employing different types of attacks ranging from a suspicious to a seemingly normal activity, while the defender in turn can make use of honeypots as a tool of deception to trap attackers. The problem is modeled as a Bayesian game of incomplete information, where equilibria are identified for both the one-shot game and the repeated game versions. Our results show that there is a threshold for the frequency of active attackers, above which both players will take deceptive actions and below which the defender can mix up his her strategy while keeping the attacker’s success rate low. A collaborative security detection method is investigated for the Internet of Things (IoT) systems. Consensus protocol is utilized to implement the information sharing and fusion in a collaborative manner. A game theoretical analysis framework is developed for the collaborative security detection by considering the confrontation between the defender and the attacker. The objective is to achieve the maximum security protection for the entire IoT systems. The existence and uniqueness of the Nash equilibrium of game model with complete consensus are analyzed. Then an iteration learning based calculation method is presented to determine the Nash equilibrium. Quantitative analysis is provided for the relationship between the Nash equilibriums of the game models in the cases of complete and incomplete consensus with infinite and finite number of iterations. Simulation results by considering DDoS attack are also provided to verify our theoretical results. We study competition between wireless devices with incomplete information about their opponents. We model such interactions as Bayesian interference games. Each wireless device selects a power profile over the entire available bandwidth to maximize its data rate. Such competitive models represent situations in which several wireless devices share spectrum without any central authority or coordinated protocol. In contrast to games where devices have complete information about their opponents, we consider scenarios where the devices are unaware of the interference they cause to other devices. Such games, which are modeled as Bayesian games, can exhibit significantly different equilibria. We first consider a simple scenario of simultaneous move games, where we show that the unique Bayes-Nash equilibrium is where both devices spread their power equally across the entire bandwidth. We then extend this model to a two-tiered spectrum sharing case where users act sequentially. Here one of the devices, called the primary user, is the owner of the spectrum and it selects its power profile first. The second device (called the secondary user) then responds by choosing a power profile to maximize its Shannon capacity. In such sequential move games, we show that there exist equilibria in which the primary user obtains a higher data rate by using only a part of the bandwidth. In a repeated Bayesian interference game, we show the existence of reputation effects: an informed primary user can bluff to prevent spectrum usage by a secondary user who suffers from lack of information about the channel gains. The resulting equilibrium can be highly inefficient, suggesting that competitive spectrum sharing is highly suboptimal. We study the problem of allocating limited security countermeasures to protect network data from cyber-attacks, for scenarios modeled by Bayesian attack graphs. We consider multi-stage interactions between a network administrator and cybercriminals, formulated as a security game. This formulation is capable of representing security environments with significant dynamics and uncertainty, and very large strategy spaces. For the game model, we propose parameterized heuristic strategies for both players. Our heuristics exploit the topological structure of the attack graphs and employ different sampling methodologies to overcome the computational complexity in determining players' actions. Given the complexity of the game, we employ a simulation-based methodology, and perform empirical game analysis over an enumerated set of these heuristic strategies. Finally, we conduct experiments based on a variety of game settings to demonstrate the advantages of our heuristics in obtaining effective defense strategies which are robust to the uncertainty of the security environment.