IoT networks are increasingly becoming target of sophisticated new cyber-attacks. Anomaly-based detection methods are promising in finding new attacks, but there are certain practical challenges like false-positive alarms, hard to explain, and difficult to scale cost-effectively. The IETF recent standard called Manufacturer Usage Description (MUD) seems promising to limit the attack surface on IoT devices by formally specifying their intended network behavior. In this paper, we use SDN to enforce and monitor the expected behaviors of each IoT device, and train one-class classifier models to detect volumetric attacks. Our specific contributions are fourfold. (1) We develop a multi-level inferencing model to dynamically detect anomalous patterns in network activity of MUD-compliant traffic flows via SDN telemetry, followed by packet inspection of anomalous flows. This provides enhanced fine-grained visibility into distributed and direct attacks, allowing us to precisely isolate volumetric attacks with microflow (5-tuple) resolution. (2) We collect traffic traces (benign and a variety of volumetric attacks) from network behavior of IoT devices in our lab, generate labeled datasets, and make them available to the public. (3) We prototype a full working system (modules are released as open-source), demonstrates its efficacy in detecting volumetric attacks on several consumer IoT devices with high accuracy while maintaining low false positives, and provides insights into cost and performance of our system. (4) We demonstrate how our models scale in environments with a large number of connected IoTs (with datasets collected from a network of IP cameras in our university campus) by considering various training strategies (per device unit versus per device type), and balancing the accuracy of prediction against the cost of models in terms of size and training time.

翻译：物联网网络日益成为复杂新型网络攻击的目标。基于异常的检测方法在发现新攻击方面具有潜力，但存在实际挑战，如误报率高、难以解释及成本效益扩展困难。IETF最新标准——制造商使用描述（MUD）通过形式化规定物联网设备的预期网络行为，有望限制攻击面。本文利用SDN对每台物联网设备的预期行为进行强制执行与监控，并训练单类分类器模型以检测体量攻击。具体贡献包括四方面：（1）开发多层次推理模型，通过SDN遥测动态检测符合MUD规则的流量中的异常模式，继而对异常流进行数据包检测，增强对分布式与直接攻击的细粒度可见性，从而以微流（5元组）精度精确隔离体量攻击；（2）采集实验室物联网设备网络行为中的流量痕迹（含良性流量及多种体量攻击），生成标注数据集并公开；（3）设计完整工作系统原型（模块以开源形式发布），验证其在高精度检测多种消费级物联网设备体量攻击的同时保持低误报率，并提供系统成本与性能分析；（4）通过考虑不同训练策略（设备单元级vs设备类型级），平衡预测准确性与模型规模及训练时间成本，证明模型在包含大量物联网连接的环境（基于校园IP摄像头网络收集的数据集）中的可扩展性。