Yacine Ghamri-Doudane

Abdelaziz Amara korba, Aleddine Diaf, Yacine Ghamri-Doudane

In the rapidly evolving landscape of cyber threats targeting the Internet of Things (IoT) ecosystem, and in light of the surge in botnet-driven Distributed Denial of Service (DDoS) and brute force attacks, this study focuses on the early detection of IoT bots. It specifically addresses the detection of stealth bot communication that precedes and orchestrates attacks. This study proposes a comprehensive methodology for analyzing IoT network traffic, including considerations for both unidirectional and bidirectional flow, as well as packet formats. It explores a wide spectrum of network features critical for representing network traffic and characterizing benign IoT traffic patterns effectively. Moreover, it delves into the modeling of traffic using various semi-supervised learning techniques. Through extensive experimentation with the IoT-23 dataset - a comprehensive collection featuring diverse botnet types and traffic scenarios - we have demonstrated the feasibility of detecting botnet traffic corresponding to different operations and types of bots, specifically focusing on stealth command and control (C2) communications. The results obtained have demonstrated the feasibility of identifying C2 communication with a 100% success rate through packet-based methods and 94% via flow based approaches, with a false positive rate of 1.53%.

Sylvain Cherrier, Yacine M. Ghamri-Doudane, Stéphane Lohier et al.

In this work, we present a complete architecture for designing Internet of Things applications. While a main issue in this domain is the heterogeneity of Objects hardware, networks and protocols, we propose D-LITe, a solution to hide this wide range of low layer technologies. By abstracting the hardware, we focus on object's features and not on its real characteristics. D-LITe aims to give a universal access to object's internal processing and computational power. A small virtual machine embedded in each object gives a universal view of its functionalities. Each object's features are discovered and programmed through the network, without any physical access. D-LITe comes with the SALT language that describes the logical behaviour needed to include user's Objects into an IoT application. This communication is based on REST architecture. Gathering all these logical units into a global composition is our way to build a services Choreography, in which each Object has its own task to achieve. This paper presents also an analysis of the gain obtained when a Choreography is used instead of the most common services.