Internet of Things (IoT) devices can be exploited by the attackers as entry points to break into the IoT networks without early detection. Little work has taken hybrid approaches that combine different defense mechanisms in an optimal way to increase the security of the IoT against sophisticated attacks. In this work, we propose a novel approach to generate the strategic deployment of adaptive deception technology and the patch management solution for the IoT under a budget constraint. We use a graphical security model along with three evaluation metrics to measure the effectiveness and efficiency of the proposed defense mechanisms. We apply the multi-objective genetic algorithm (GA) to compute the Pareto optimal deployments of defense mechanisms to maximize the security and minimize the deployment cost. We present a case study to show the feasibility of the proposed approach and to provide the defenders with various ways to choose optimal deployments of defense mechanisms for the IoT. We compare the GA with the exhaustive search algorithm (ESA) in terms of the runtime complexity and performance accuracy in optimality. Our results show that the GA is much more efficient in computing a good spread of the deployments than the ESA, in proportion to the increase of the IoT devices.
La @cite_7 introduced a game theoretic model to analyze the security of honeypot-enabled IoT networks. They assumed that the attacker may deceive the defender with suspicious or seemingly normal traffic and used the honeypot-enabled intrusion detection component which reroutes the suspicious traffic to the honeypots as a defense mechanism. The interaction between the attacker and defender was modeled based on a Bayesian game with incomplete information. Anirudh @cite_10 used honeypots for online servers to mitigate Distributed-Denial-of-Service (DDoS) attacks launched from the IoT devices. Pa @cite_13 developed an IoT honeypot to emulate the IoT devices and capture Telnet-based attacks and designed the IoT sandbox to analyze these attacks against the IoT devices running different CPU architectures. Dowling @cite_8 created a honeypot that simulates a ZigBee gateway and used it to capture attacks for a further analysis.
@cite_13 @cite_10 @cite_7 @cite_8
2320597598 2622206102 1669806660 1510508184
In modern days, breakthroughs in information and communications technologies lead to more and more devices of every imaginable type being connected to the Internet. This also strengthens the need for protection against cyber-attacks, as virtually any devices with a wireless connection could be vulnerable to malicious hacking attempts. Meanwhile, honeypot-based deception mechanism has been considered as one of the methods to ensure security for modern networks in the Internet of Things (IoT). In this paper, we address the problem of defending against attacks in honeypot-enabled networks by looking at a game-theoretic model of deception involving an attacker and a defender. The attacker may try to deceive the defender by employing different types of attacks ranging from a suspicious to a seemingly normal activity, while the defender in turn can make use of honeypots as a tool of deception to trap attackers. The problem is modeled as a Bayesian game of incomplete information, where equilibria are identified for both the one-shot game and the repeated game versions. Our results show that there is a threshold for the frequency of active attackers, above which both players will take deceptive actions and below which the defender can mix up his her strategy while keeping the attacker’s success rate low. Every day, a new technology comes up and the primary reason why it fails to attract many people in this era is the concern of privacy and security. Each day, along with the new technology comes a load of vulnerabilities waiting to be exploited. IoT (Internet of Things) is the latest trend and like all technology, it is open for exploitation. The most common attack which is used to bring down a whole network, without even finding a loophole in the security — DoS can be used to pull down any IoT network as well. In this paper, we propose a honeypot model for mitigating DoS attacks launched on IoT devices. Honeypots are commonly used in online servers as a decoy to the main server so that the attack is mitigated to the decoy instead of the main server. Here a similar methodology is used to avoid the whole IoT system from being shut down due to a DoS attack. We analyze the increasing threats against IoT devices. We show that Telnet-based attacks that target IoT devices have rocketed since 2014. Based on this observation, we propose an IoT honeypot and sandbox, which attracts and analyzes Telnet-based attacks against various IoT devices running on different CPU architectures such as ARM, MIPS, and PPC. By analyzing the observation results of our honeypot and captured malware samples, we show that there are currently at least 4 distinct DDoS malware families targeting Telnet-enabled IoT devices and one of the families has quickly evolved to target more devices with as many as 9 different CPU architectures. We present Shadow Honeypots, a novel hybrid architecture that combines the best features of honeypots and anomaly detection. At a high level, we use a variety of anomaly detectors to monitor all traffic to a protected network service. Traffic that is considered anomalous is processed by a "shadow honeypot" to determine the accuracy of the anomaly prediction. The shadow is an instance of the protected software that shares all internal state with a regular ("production") instance of the application, and is instrumented to detect potential attacks. Attacks against the shadow are caught, and any incurred state changes are discarded. Legitimate traffic that was misclassified will be validated by the shadow and will be handled correctly by the system transparently to the end user. The outcome of processing a request by the shadow is used to filter future attack instances and could be used to update the anomaly detector. Our architecture allows system designers to fine-tune systems for performance, since false positives will be filtered by the shadow. Contrary to regular honeypots, our architecture can be used both for server and client applications. We demonstrate the feasibility of our approach in a proof-of-concept implementation of the Shadow Honeypot architecture for the Apache web server and the Mozilla Firefox browser. We show that despite a considerable overhead in the instrumentation of the shadow honeypot (up to 20 for Apache), the overall impact on the system is diminished by the ability to minimize the rate of false-positives.