Design and implementation of intelligent packet filtering in IoT microcontroller-based devices
DOI:
https://doi.org/10.5753/jisa.2024.3835Keywords:
Packet Filtering, intrusion detection, internet of things, constrained devicesAbstract
Internet of Things (IoT) devices are increasingly pervasive and essential in enabling new applications and services. However, their widespread use also exposes them to exploitable vulnerabilities and flaws that can lead to significant losses. In this context, ensuring robust cybersecurity measures is essential to protect IoT devices from malicious attacks. However, the current solutions that provide flexible policy specifications and higher security levels for IoT devices are scarce. To address this gap, we introduce T800, a low-resource packet filter that utilizes machine learning (ML) algorithms to classify packets in IoT devices. We present a detailed performance benchmarking framework and demonstrate T800's effectiveness on the ESP32 system-on-chip microcontroller and ESP-IDF framework. Our evaluation shows that T800 is an efficient solution that increases device computational capacity by excluding unsolicited malicious traffic from the processing pipeline. Additionally, T800 is adaptable to different systems and provides a well-documented performance evaluation strategy for security ML-based mechanisms on ESP32-based IoT systems. Our research contributes to improving the cybersecurity of resource-constrained IoT devices and provides a scalable, efficient solution that can be used to enhance the security of IoT systems.
Downloads
References
Abadade, Y., Temouden, A., Bamoumen, H., Benamar, N., Chtouki, Y., and Hafid, A. S. (2023). A comprehensive survey on tinyml. IEEE Access, 11:96892-96922. DOI: 10.1109/ACCESS.2023.3294111.
Al-Sarawi, S., Anbar, M., Abdullah, R., and Al Hawari, A. B. (2020). Internet of things market analysis forecasts, 2020–2030. In 2020 Fourth World Conference on Smart Trends in Systems, Security and Sustainability (WorldS4), pages 449-453. DOI: 10.1109/WorldS450073.2020.9210375.
Alieyan, K., Almomani, A., Anbar, M., Alauthman, M., Abdullah, R., and Gupta, B. B. (2021). Dns rule-based schema to botnet detection. Enterprise Information Systems, 15(4):545-564. DOI: 10.1080/17517575.2019.1644673.
Almakhdhub, N. S., Clements, A. A., Payer, M., and Bagchi, S. (2019). Benchiot: A security benchmark for the internet of things. In 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 234-246. DOI: 10.1109/DSN.2019.00035.
Almeida, F. (2023). Prospects of cybersecurity in smart cities. Future Internet. DOI: 10.3390/fi15090285.
Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J. A., Invernizzi, L., Kallitsis, M., et al. (2017). Understanding the mirai botnet. In 26th USENIX security symposium (USENIX Security 17), pages 1093-1110. Available online [link].
Apruzzese, G., Laskov, P., and Schneider, J. (2023). Sok: Pragmatic assessment of machine learning for network intrusion detection.
Bertino, E. and Islam, N. (2017). Botnets and internet of things security. Computer, 50(2):76-79. DOI: 10.1109/MC.2017.62.
Bertoli, G. D. C., Júnior, L. A. P., Saotome, O., Dos Santos, A. L., Verri, F. A. N., Marcondes, C. A. C., Barbieri, S., Rodrigues, M. S., and De Oliveira, J. M. P. (2021). An end-to-end framework for machine learning-based network intrusion detection system. IEEE Access, 9:106790-106805. DOI: 10.1109/ACCESS.2021.3101188.
Dahlmanns, M., Lohm"oller, J., Pennekamp, J., Bodenhausen, J., Wehrle, K., and Henze, M. (2022). Missed opportunities: Measuring the untapped tls support in the industrial internet of things. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, ASIA CCS '22, page 252–266, New York, NY, USA. Association for Computing Machinery. DOI: 10.1145/3488932.3497762.
de Carvalho Bertoli, G., Alves Pereira Junior, L., Saotome, O., and dos Santos, A. L. (2023). Generalizing intrusion detection for heterogeneous networks: A stacked-unsupervised federated learning approach. Computers & Security, 127:103106. DOI: 10.1016/j.cose.2023.103106.
DeMarinis, N., Tellex, S., Kemerlis, V. P., Konidaris, G., and Fonseca, R. (2019). Scanning the internet for ros: A view of security in robotics research. In 2019 International Conference on Robotics and Automation (ICRA), pages 8514-8521. DOI: 10.1109/ICRA.2019.8794451.
Dunkels, A. (2001). Design and implementation of the lwip tcp/ip stack. Swedish Institute of Computer Science, 2(77). Available online [link].
Durumeric, Z., Adrian, D., Mirian, A., Bailey, M., and Halderman, J. A. (2015). A search engine backed by internet-wide scanning. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pages 542-553. DOI: 10.1145/2810103.2813703.
Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., et al. (2014). The matter of heartbleed. In Proceedings of the 2014 conference on internet measurement conference, pages 475-488. DOI: 10.1145/2663716.2663755.
Eskandari, M., Janjua, Z. H., Vecchio, M., and Antonelli, F. (2020). Passban ids: An intelligent anomaly-based intrusion detection system for iot edge devices. IEEE Internet of Things Journal, 7(8):6882-6897. DOI: 10.1109/JIOT.2020.2970501.
Fernandes, G., Monici, P., Guibo, C., de Carvalho Bertoli, G., Santos, A., and Jr., L. A. P. (2022). Implementação de um filtro de pacotes inteligente para dispositivos de internet das coisas. In Proceedings of the 40th Brazilian Symposium on Computer Networks and Distributed Systems, pages 238-251, Porto Alegre, RS, Brasil. SBC. DOI: 10.5753/sbrc.2022.222301.
Filus, K., Doma'nska, J., and Gelenbe, E. (2021). Random neural network for lightweight attack detection in the iot. In Calzarossa, M. C., Gelenbe, E., Grochla, K., Lent, R., and Czachórski, T., editors, Modelling, Analysis, and Simulation of Computer and Telecommunication Systems, pages 79-91, Cham. Springer International Publishing. DOI: 10.1007/978-3-030-68110-4_5.
Fontugne, R., Borgnat, P., Abry, P., and Fukuda, K. (2010). Mawilab: Combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking. In Proceedings of the 6th International Conference, pages 1-12. DOI: 10.1145/1921168.1921179.
Georgoulias, D., Pedersen, J. M., Falch, M., and Vasilomanolakis, E. (2023). Botnet business models, takedown attempts, and the darkweb market: A survey. ACM Comput. Surv., 55(11). DOI: 10.1145/3575808.
Hafeez, I., Antikainen, M., Ding, A. Y., and Tarkoma, S. (2020). Iot-keeper: Detecting malicious iot network activity using online traffic analysis at the edge. IEEE Transactions on Network and Service Management, 17(1):45-59. DOI: 10.1109/TNSM.2020.2966951.
Jan, S. U., Ahmed, S., Shakhov, V., and Koo, I. (2019). Toward a lightweight intrusion detection system for the internet of things. IEEE Access, 7:42450-42471. DOI: 10.1109/ACCESS.2019.2907965.
Khraisat, A. and Alazab, A. (2021). A critical review of intrusion detection systems in the internet of things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges. Cybersecurity, 4(1):18. DOI: 10.1186/s42400-021-00077-7.
Klint, C. (2021). These are the top risks for business in the post-covid world. Available online [link].
Kovacs, E. (2020). Critical vulnerability could have allowed hackers to disrupt traffic lights. SecurityWeek. Available online [link].
Lakshmanan, R. (2022). Mantis botnet behind the largest https ddos attack targeting cloudflare customers. Available online [link].
Manocchio, L. D., Layeghy, S., and Portmann, M. (2022). Network intrusion detection system in a light bulb. In 2022 32nd International Telecommunication Networks and Applications Conference (ITNAC), pages 1-8. DOI: 10.1109/ITNAC55475.2022.9998371.
McLennan, M. (2021). The global risks report 2021 16th edition. Available online [link].
McMillen, D. (2021). Internet of threats: Iot botnets drive surge in network attacks. Available online [link].
Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018). Kitsune: an ensemble of autoencoders for online network intrusion detection. Network and Distributed Systems Security (NDSS) Symposium. DOI: 10.48550/arXiv.1802.09089.
Monici, P., Fernandes, G., Guibo, C., Bertoli, G., Santos, A., and Jr., L. P. (2022). T800: ferramenta de firewall e benchmark para iot. In Anais Estendidos do XL Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos, pages 33-40, Porto Alegre, RS, Brasil. SBC. DOI: 10.5753/sbrc_estendido.2022.222753.
Mudgerikar, A., Sharma, P., and Bertino, E. (2019). E-spion: A system-level intrusion detection system for iot devices. In Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security, Asia CCS '19, page 493–500, New York, NY, USA. Association for Computing Machinery. DOI: 10.1145/3321705.3329857.
Murshed, M. G. S., Murphy, C., Hou, D., Khan, N., Ananthanarayanan, G., and Hussain, F. (2019). Machine learning at the network edge: A survey. ACM Computing Surveys (CSUR), 54:1-37. DOI: 10.1145/3469029.
Niedermaier, M., Striegel, M., Sauer, F., Merli, D., and Sigl, G. (2019). Efficient intrusion detection on low-performance industrial iot edge node devices.
Qin, T., Wang, B., Chen, R., Qin, Z., and Wang, L. (2019). Imlads: Intelligent maintenance and lightweight anomaly detection system for internet of things. Sensors, 19(4). DOI: 10.3390/s19040958.
Ren, H., Anicic, D., and Runkler, T. A. (2021). Tinyol: Tinyml with online-learning on microcontrollers. In 2021 International Joint Conference on Neural Networks (IJCNN), pages 1-8. DOI: 10.1109/IJCNN52387.2021.9533927.
Roesch, M. (1999). Snort - lightweight intrusion detection for networks. In Proceedings of the 13th USENIX Conference on System Administration, LISA '99, page 229–238, USA. USENIX Association. Available online [link].
Saha, S. S., Sandha, S. S., and Srivastava, M. (2022). Machine learning for microcontroller-class hardware: A review. IEEE Sensors Journal, 22(22):21362-21390. DOI: 10.1109/JSEN.2022.3210773.
Schizas, N., Karras, A., Karras, C., and Sioutas, S. (2022). Tinyml for ultra-low power ai and large scale iot deployments: A systematic review. Future Internet, 14(12). DOI: 10.3390/fi14120363.
Smith, S. (2022). Out of gas: A deep dive into the colonial pipeline cyberattack.
Soe, Y. N., Feng, Y., Santosa, P. I., Hartanto, R., and Sakurai, K. (2020). Implementing lightweight iot-ids on raspberry pi using correlation-based feature selection and its performance evaluation. In Barolli, L., Takizawa, M., Xhafa, F., and Enokido, T., editors, Advanced Information Networking and Applications, pages 458-469, Cham. Springer Intl. Publish.. DOI: 10.1007/978-3-030-15032-7_39.
Utomo, D. and Hsiung, P.-A. (2019). Anomaly detection at the iot edge using deep learning. In 2019 IEEE International Conference on Consumer Electronics - Taiwan (ICCE-TW), pages 1-2. DOI: 10.1109/ICCE-TW46550.2019.8991929.
Viegas, E., Santin, A. O., and Abreu Jr, V. (2021). Machine learning intrusion detection in big data era: A multi-objective approach for longer model lifespans. IEEE Transactions on Network Science and Engineering, 8(1):366-376. DOI: 10.1109/TNSE.2020.3038618.
Yadav, T. and Rao, A. M. (2015). Technical aspects of cyber kill chain. In Abawajy, J. H., Mukherjea, S., Thampi, S. M., and Ruiz-Martínez, A., editors, Security in Computing and Communications, pages 438-452, Cham. Springer International Publishing. DOI: 10.1007/978-3-319-22915-7_40.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2024 Journal of Internet Services and Applications
This work is licensed under a Creative Commons Attribution 4.0 International License.
