ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks
This addresses the challenge of detecting novel and context-based attacks in IoT systems, which is critical for security in smart homes and other domains, representing a novel method rather than an incremental improvement.
The paper tackles the problem of detecting stealthy contextual attacks in IoT environments, where attackers misuse control plane actions in unintended contexts, and proposes ARGUS, a self-learning intrusion detection system using an unsupervised DNN to model device behavior, achieving at least 99.64% F1-score and at most 0.03% false positive rate in real-world smart-home evaluations.
IoT application domains, device diversity and connectivity are rapidly growing. IoT devices control various functions in smart homes and buildings, smart cities, and smart factories, making these devices an attractive target for attackers. On the other hand, the large variability of different application scenarios and inherent heterogeneity of devices make it very challenging to reliably detect abnormal IoT device behaviors and distinguish these from benign behaviors. Existing approaches for detecting attacks are mostly limited to attacks directly compromising individual IoT devices, or, require predefined detection policies. They cannot detect attacks that utilize the control plane of the IoT system to trigger actions in an unintended/malicious context, e.g., opening a smart lock while the smart home residents are absent. In this paper, we tackle this problem and propose ARGUS, the first self-learning intrusion detection system for detecting contextual attacks on IoT environments, in which the attacker maliciously invokes IoT device actions to reach its goals. ARGUS monitors the contextual setting based on the state and actions of IoT devices in the environment. An unsupervised Deep Neural Network (DNN) is used for modeling the typical contextual device behavior and detecting actions taking place in abnormal contextual settings. This unsupervised approach ensures that ARGUS is not restricted to detecting previously known attacks but is also able to detect new attacks. We evaluated ARGUS on heterogeneous real-world smart-home settings and achieve at least an F1-Score of 99.64% for each setup, with a false positive rate (FPR) of at most 0.03%.