Smart homes, enterprises, and cities are increasingly being equipped with a
plethora of Internet of Things (IoT), ranging from smart-lights to security
cameras. While IoT networks have the potential to benefit our lives, they
create privacy and security challenges not seen with traditional IT networks.
Due to the lack of visibility, operators of such smart environments are not
often aware of their IoT assets, let alone whether each IoT device is
functioning properly safe from cyber-attacks. This thesis is the culmination of
our efforts to develop techniques to profile the network behavioral pattern of
IoTs, automate IoT classification, deduce their operating context, and detect
anomalous behavior indicative of cyber-attacks.
We begin this thesis by surveying IoT ecosystem, while reviewing current
approaches to vulnerability assessments, intrusion detection, and behavioral
monitoring. For our first contribution, we collect traffic traces and
characterize the network behavior of IoT devices via attributes from traffic
patterns. We develop a robust machine learning-based inference engine trained
with these attributes and demonstrate real-time classification of 28 IoT
devices with over 99% accuracy. Our second contribution enhances the
classification by reducing the cost of attribute extraction while also
identifying IoT device states. Prototype implementation and evaluation
demonstrate the ability of our supervised machine learning method to detect
behavioral changes for five IoT devices. Our third and final contribution
develops a modularized unsupervised inference engine that dynamically
accommodates the addition of new IoT devices and/or updates to existing ones,
without requiring system-wide retraining of the model. We demonstrate via
experiments that our model can automatically detect attacks and firmware
changes in ten IoT devices with over 94% accuracy.