Congratulations to iTrust’s Research Director Professor Yuval Elovici and Asst Profs Martin Ochoa and Nils Tippenahuer for achieving the following awards! Well done!
Best Paper Award for the paper “SIPHON: Towards Scalable High-Interaction Physical Honeypots” at the 3rd ACM Cyber-Physical System Security Workshop
Abstract: In recent years, the emerging Internet-of-Things (IoT) has led to rising concerns about the security of networked embedded devices. In this work, we propose the SIPHON architecture—a Scalable high-Interaction Honeypot platform for IoT devices. Our architecture leverages IoT devices that are physically at one location and are connected to the Internet through so-called \emph{wormholes} distributed around the world. The resulting architecture allows exposing few physical devices over a large number of geographically distributed IP addresses. We demonstrate the proposed architecture in a large scale experiment with 39 wormhole instances in 16 cities in 9 countries. Based on this setup, five physical IP cameras, one NVR and one IP printer are presented as 85 real IoT devices on the Internet, attracting a daily traffic of 700MB for a period of two months. A preliminary analysis of the collected traffic indicates that devices in some cities attracted significantly more traffic than others (ranging from 600 000 incoming TCP connections for the most popular destination to less than 50 000 for the least popular). We recorded over 400 brute-force login attempts to the web-interface of our devices using a total of 1826 distinct credentials, from which 11 attempts were successful. Moreover, we noted login attempts to Telnet and SSH ports some of which used credentials found in the recently disclosed Mirai malware.
Best Poster Paper Award (Internet of Things Track) for the paper “ProfilIoT: A Machine Learning Approach for IoT Device Identification Based on Network Traffic Analysis” at the ACM Symposium on Applied Computing
Abstract: With a significant proliferation of IoT devices and their integration into systems, it is necessary to identify them in cooperatives networks. ProfilIoT, therefore, provides a flexible, generic, and efficient solution to evolve IoT landscape in different environments. This novel method uses network traffic analysis to distinguish between IoT and non-IoT devices. Moreover, the performed analysis could not be easily avoided by attackers due to advanced statistics metrics and machine learning techniques used to profile accurately each element connected to a network. ProfilIoT can recognise IoT devices with an effectiveness of 99%, and is flexible to be implemented in any organisation.