Identification of anomaly and malicious traffic in the Internet-of-Things (IoT) network is essential for the IoT security to keep eyes and block unwanted traffic flows in the IoT network. For this purpose, numerous machine-learning (ML) technique models are presented by many researchers to block malicious traffic flows in the IoT network. However, due to the inappropriate feature selection, several ML models prone misclassify mostly malicious traffic flows. Nevertheless, the significant problem still needs to be studied more in-depth that is how to select effective features for accurate malicious traffic detection in the IoT network. To address the problem, a new framework model is proposed. First, a novel feature selection metric approach named CorrAUC is proposed, and then based on CorrAUC, a new feature selection algorithm named CorrAUC is developed and designed, which is based on the wrapper technique to filter the features accurately and select effective features for the selected ML algorithm by using the area under the curve (AUC) metric. Then, we applied the integrated TOPSIS and Shannon entropy based on a bijective soft set to validate selected features for malicious traffic identification in the IoT network. We evaluate our proposed approach by using the Bot-IoT data set and four different ML algorithms. The experimental results analysis showed that our proposed method is efficient and can achieve >96% results on average.

/pdf/corrauc-a-malicious-bot-iot-traffic-detection-method-in-iot-2npu38584o.pdf

CorrAUC: A Malicious Bot-IoT Traffic Detection Method in IoT Network Using Machine-Learning Techniques

With the development of Internet-of-Things (IoT) technology, various types of information, such as social resources and physical resources, are deeply integrated for different comprehensive applications. Social networking, car networking, medical services, video surveillance, and other forms of the IoT information service model gradually change people’s daily lives. Facing the vast amounts of IoT information data, the IoT search technology is used to quickly find accurate information to meet the real-time search needs of users. However, IoT search requires using a large amount of user private information, such as personal health information, location information, and social relations information, to provide personalized services. Employing private information from users will encounter security problems if an effective access control mechanism is missing during the IoT search process. An access control mechanism can effectively monitor the access activities of resources and ensure that authorized users access information resources under legitimate conditions. This survey examines the growing literature on access control for an IoT search. Problems and challenges of access control mechanisms are analyzed to facilitate the adoption of access control solutions in real-life settings. This article aims to provide theoretical, methodological, and technical guidance for IoT search access control mechanisms in large-scale dynamic heterogeneous environments. Based on a literature review, we also analyzed the future development direction of access control in the age of IoT.

A Survey on Access Control in the Age of Internet of Things

Block-DEF: A secure digital evidence framework using blockchain

IoT malicious traffic identification using wrapper-based feature selection mechanisms

With the development of the Internet of Things and big data technology, the intelligent transportation system is becoming the main development direction of future transportation systems. The time required for a given trajectory in a transportation system can be accurately estimated using the trajectory data of the taxis in a city. This is a very challenging task. Although historical data have been used in existing research, excessive use of trajectory information in historical data or inaccurate neighbor trajectory information does not allow for a better prediction accuracy of the query trajectory. In this article, we propose a deep learning method based on neighbors for travel time estimation (TTE), called the Nei-TTE method. We divide the entire trajectory into multiple disjoint segments and use the historical trajectory data approximated at the time level. Our model captures the characteristics of each segment and utilizes the trajectory characteristics of adjacent segments as the road network topology and speed interact. We use velocity features to effectively represent adjacent segment structures. The experiments on the Porto dataset show that the experimental results of our model are significantly better than those of the existing models.

Nei-TTE: Intelligent Traffic Time Estimation Based on Fine-Grained Time Derivation of Road Segments for Smart City

Tor hidden services (HSs) are used to provide anonymity services to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor HSs use decentralized architecture that makes it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor HSs that allow an adversary with an extremely low cost to block arbitrary Tor HSs. We found that the dominant cost of this attack is IP address resources, the experimental results show that we can use only three IP addresses to eclipse an arbitrary HS with 100% success probability. To understand the severity of the Eclipse attack problems on Tor HSs, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of HSs at any time. Finally, we discuss countermeasures and future works.

Toward a Comprehensive Insight Into the Eclipse Attacks of Tor Hidden Services

Ethereum, one of the most popular cryptocurrencies, has attracted increasing attention of people in various fields. As the backbone of Ethereum, its peer-to-peer network has an effect on almost every aspect of the ecosystem. Consequently, it’s necessary to understand the topological properties of Ethereum P2P network. In this paper, we conducted a measurement of Ethereum P2P network. Our result shows that the graphs of Ethereum network have a small average shortest path length and a large clustering coefficient, and the degree distribution of nodes does not follow a pure power-law distribution. These indicate that Ethereum network is very close to a small world network. Though there are a large number of stale nodes and useless nodes, Ethereum is still resilient to both random failures and targeted attacks. What’s more, we find that there are around one hundred abnormal nodes in the network. The IP addresses of nodes included in the neighbors messages they reply are replaced with their own IP addresses. Those nodes might have a bad influence on network routing.

Topology Measurement and Analysis on Ethereum P2P Network

Tor hidden Services are used to provide anonymity service to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor hidden services use decentralized architecture making it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor hidden services that allow an adversary with an extremely low cost to block arbitrary Tor hidden services. We found that the dominant cost of this attack is IP address resources. The experimental results show that we can eclipse an arbitrary hidden service with 100% success probability with only 6 IP addresses. To understand the severity of the Eclipse attack problems on Tor's hidden services, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of hidden services at any time.

A closer look at Eclipse attacks against Tor hidden services

Tor is one of the most well-known anonymity networks that provides anonymity to service providers such as hidden web services. Recently size and content of Tor hidden services are highly concerned because of emerging illegal content. It is necesary to have discovery and analysis approaches to collect and analyze Tor hidden services. Previous in-band approaches are mostly based on the protocol and design principles of Tor network, which mostly have a great deal of resource consumption. In this paper, we propose an out-of-band approach to discover Tor hidden services, which is simpler and owns less resource consumption: using multiple search engines with specific keywords. In our experiments we collected 173667 unique .onion addresses in all using a single Amazon EC2 instances in 1 hour and found 4857 hidden web services online. We also propose a modified PageRank algrithm: OnionRank Algorithm to evaluate the importance of hidden web services, which concentrates more on Tor users' actions. Results showed that the top-ranking hidden web services are mostly famous in Tor network.

Out-of-band discovery and evaluation for tor hidden services

The high anonymity of Darknet makes it attractive to users who want to avoid Internet censorship and surveillance. As a result, in recent years, Darknet is abused for various illegal purposes. Undoubtedly, measurement and analysis towards the attributes of people in the Darknet can obtain a comprehensive characterization of dangerous users and help trace malicious users, reducing cybercrimes. However, it is still challenging to extract person attributes in Darknet scenario due to its anonymity and content sparsity. Therefore, in this paper, we propose a new person attribute extraction method consisting of three steps: block filtration, attribute candidate generation and attribute candidate verification. Experiments show that our extraction method performs better than traditional extraction methods. Using the extracted information as input, we measure and analyze the number of attributes, Top-K name entities, email domain name, etc. of people in Darknet, revealing the characteristics of the person attributes in the dark web pages.

Gao Yue

Papers

Toward a Comprehensive Insight Into the Eclipse Attacks of Tor Hidden Services

Topology Measurement and Analysis on Ethereum P2P Network

A closer look at Eclipse attacks against Tor hidden services

Out-of-band discovery and evaluation for tor hidden services

Who are in the Darknet? Measurement and Analysis of Darknet Person Attributes