An increasing number of Internet of Things (IoT) devices are connecting to the Internet, yet many of these devices are fundamentally insecure, exposing the Internet to a variety of attacks. Botnets such as Mirai have used insecure consumer IoT devices to conduct distributed denial of service (DDoS) attacks on critical Internet infrastructure. This motivates the development of new techniques to automatically detect consumer IoT attack traffic. In this paper, we demonstrate that using IoT-specific network behaviors (e.g., limited number of endpoints and regular time intervals between packets) to inform feature selection can result in high accuracy DDoS detection in IoT network traffic with a variety of machine learning algorithms, including neural networks. These results indicate that home gateway routers or other network middleboxes could automatically detect local IoT device sources of DDoS attacks using low-cost machine learning algorithms and traffic data that is flow-based and protocol-agnostic.

/pdf/machine-learning-ddos-detection-for-consumer-internet-of-2atsfu6zta.pdf

Machine Learning DDoS Detection for Consumer Internet of Things Devices

Video streaming is an increasingly popular way to consume media content. Adaptive video streaming is an emerging delivery technology which aims to increase user QoE and maximise connection utilisation. Many implementations naively estimate bandwidth from a one-sided client perspective, without taking into account other devices in the network. This behaviour results in unfairness and could potentially lower QoE for all clients. We propose an OpenFlow-assisted QoE Fairness Framework that aims to fairly maximise the QoE of multiple competing clients in a shared network environment. By leveraging a Software Defined Networking technology, such as OpenFlow, we provide a control plane that orchestrates this functionality. The evaluation of our approach in a home networking scenario introduces user-level fairness and network stability, and illustrates the optimisation of QoE across multiple devices in a network.

/pdf/towards-network-wide-qoe-fairness-using-openflow-assisted-4acdrz972l.pdf

Towards network-wide QoE fairness using openflow-assisted adaptive video streaming

Mobile edge computing (MEC) and fog are emerging computing models that extend the cloud and its services to the edge of the network. The emergence of both MEC and fog introduce new requirements, which mean their supported deployment models must be investigated. In this paper, we point out the influence and strong impact of the extended cloud (i.e., the MEC and fog) on existing communication and networking service models of the cloud. Although the relation between them is fairly evident, there are important properties, notably those of security and resilience, that we study in relation to the newly posed requirements from the MEC and fog. Although security and resilience have been already investigated in the context of the cloud-to a certain extent-existing solutions may not be applicable in the context of the extended cloud. Our approach includes the examination of models and architectures that underpin the extended cloud, and we provide a contemporary discussion on the most evident characteristics associated with them. We examine the technologies that implement these models and architectures, and analyze them with respect to security and resilience requirements. Furthermore, approaches to security and resilience-related mechanisms are examined in the cloud (specifically, anomaly detection and policy-based resilience management), and we argue that these can also be applied in order to improve security and achieve resilience in the extended cloud environment.

/pdf/the-extended-cloud-review-and-analysis-of-mobile-edge-1wctpal0nk.pdf

The Extended Cloud: Review and Analysis of Mobile Edge Computing and Fog From a Security and Resilience Perspective

As expectations for the Internet to support multimedia applications grow, new services need to be deployed. One of them is the group communication service for one-to-many or many-to-many data delivery. After more than a decade of important research and development efforts, the deployment of multicast routing in the Internet is far behind expectations. Therefore, a first motivation for an alternative group communication service is to bypass the lack of native IP multicast routing. Although less efficient and scalable than native multicast routing, such alternative services are generally suitable for the purpose. A second possible motivation is to go beyond the limitations of classic multicast routing for very specific working environments. We identify, classify, and discuss some of these alternative approaches.

/pdf/a-survey-of-proposals-for-an-alternative-group-communication-2dp8xt082q.pdf

A survey of proposals for an alternative group communication service

We outline an anomaly detection method for industrial control systems (ICS) that combines the analysis of network package contents that are transacted between ICS nodes and their time-series structure. Specifically, we take advantage of the predictable and regular nature of communication patterns that exist between so-called field devices in ICS networks. By observing a system for a period of time without the presence of anomalies we develop a base-line signature database for general packages. A Bloom filter is used to store the signature database which is then used for package content level anomaly detection. Furthermore, we approach time-series anomaly detection by proposing a stacked Long Short Term Memory (LSTM) network-based softmax classifier which learns to predict the most likely package signatures that are likely to occur given previously seen package traffic. Finally, by the inspection of a real dataset created from a gas pipeline SCADA system, we show that an anomaly detection scheme combining both approaches can achieve higher performance compared to various current state-of-the-art techniques.

/pdf/multi-level-anomaly-detection-in-industrial-control-systems-4jb6ms37nl.pdf

Multi-level Anomaly Detection in Industrial Control Systems via Package Signatures and LSTM Networks

Attacks on critical infrastructures' Supervisory Control and Data Acquisition (SCADA) systems are beginning to increase. They are often initiated by highly skilled attackers, who are capable of deploying sophisticated attacks to exfiltrate data or even to cause physical damage. In this paper, we rehearse the rationale for protecting against cyber attacks and evaluate a set of Anomaly Detection (AD) techniques in detecting attacks by analysing traffic captured in a SCADA network. For this purpose, we have implemented a tool chain with a reference implementation of various state-of-the-art AD techniques to detect attacks, which manifest themselves as anomalies. Specifically, in order to evaluate the AD techniques, we apply our tool chain on a dataset created from a gas pipeline SCADA system in Mississippi State University's lab, which include artefacts of both normal operations and cyber attack scenarios. Our evaluation elaborate on several performance metrics of the examined AD techniques such as precision; recall; accuracy; F-score and G-score. The results indicate that detection rate may change significantly when considering various attack types and different detections modes (i.e., supervised and unsupervised), and also provide indications that there is a need for a robust, and preferably real-time AD technique to introduce resilience in critical infrastructures.

/pdf/evaluation-of-anomaly-detection-techniques-for-scada-1oy9pkzirm.pdf

Evaluation of Anomaly Detection techniques for SCADA communication resilience

Modern IPTV services are comprised of multiple comprehensive service elements in the entire content delivery chain to maximise the efficiency in networking. Audio-visual content may experience various types of impairments during content ingest, processing, distribution and reception. While some impairments do not cause noticeable distortions to the delivered content, many others such as the network transmission loss can be highly detrimental to the user experience in content consumption. In order to optimise service quality and to provide a benchmarking platform to evaluate the designs for future audio-visual content distribution system, a quality evaluation framework is essential. We introduce such an evaluation framework to assess video service with respect of user perception, while supporting service diagnosis to identify root-causes of any detected quality degradation. Compared with existing QoE frameworks, our solution offers an advanced but practical design for the real-time analysis of IPTV services in multiple service layers.

Quality evaluation in peer-to-peer IPTV services

Distributed denial-of-service (DDoS) attacks continue to trouble network operators and service providers, and with increasing intensity. Effective response to DDoS can be slow (because of manual diagnosis and interaction) and potentially self-defeating (as indiscriminate filtering accomplishes a likely goal of the attacker), and this is the result of the discrepancy between the service provider’s flow-based, application-level view of traffic and the network operator’s packet-based, network-level view and limited functionality. Furthermore, a network required to take action may be in an autonomous system (AS) several AS-hops away from the service, so it has no direct relationship with the service on whose behalf it acts. This paper presents Antidose , a means of interaction between a vulnerable peripheral service and an indirectly related AS that allows the AS to confidently deploy local filtering with discrimination under the control of the remote service. We implement the core filtering mechanism of antidose, and provide an analysis of it to demonstrate that conscious attacks against the mechanism will not expose the AS to additional attacks. We present a performance evaluation to show that the mechanism is operationally feasible in the emerging trend of operators’ willingness to increase the programmability of their hardware with SDN technologies such as OpenFlow, as well as to act to mitigate attacks on downstream customers.

/pdf/an-inter-domain-collaboration-scheme-to-remedy-ddos-attacks-2e0zl1kqsu.pdf

An Inter-Domain Collaboration Scheme to Remedy DDoS Attacks in Computer Networks

Virtualized cloud environments have emerged as a necessity within modern unified ICT infrastructures and have established themselves as a reliable backbone for numerous always-on services. `Live' intra-cloud virtual-machine (VM) migration is a widely used technique for efficient resource management employed within modern cloud infrastructures. Despite the benefits of such functionality, there are still several security issues which have not yet been thoroughly assessed and quantified. We investigate the impact of live virtual-machine migration on state-of-the-art anomaly detection (AD) techniques (namely PCA and K-means), by evaluating live migration under various attack types and intensities. We find that the performance for both detectors degrades as shown by their Receiver Operating Characteristics (ROC) curves when intra-cloud live migration is initiated while VMs are under a netscan (NS) or a denial-of-service (DoS) attack.

/pdf/assessing-the-impact-of-intra-cloud-live-migration-on-f6lcb5fksu.pdf

Assessing the impact of intra-cloud live migration on anomaly detection

We propose a new application-level clustering algorithm capable of building an overlay spanning tree among participants of large multicast sessions, without any specific help from the network routers. The algorithm and associated protocol are shown to exhibit scalable properties.

/pdf/scalable-adaptive-hierarchical-clustering-2od2unpsva.pdf

Steven Simpson

Papers

Evaluation of Anomaly Detection techniques for SCADA communication resilience

Quality evaluation in peer-to-peer IPTV services

An Inter-Domain Collaboration Scheme to Remedy DDoS Attacks in Computer Networks

Assessing the impact of intra-cloud live migration on anomaly detection

Scalable adaptive hierarchical clustering