Skip to main content

2022 | OriginalPaper | Buchkapitel

Ensembling Sparse Autoencoders for Network Covert Channel Detection in IoT Ecosystems

verfasst von : Nunziato Cassavia, Luca Caviglione, Massimo Guarascio, Angelica Liguori, Marco Zuppelli

Erschienen in: Foundations of Intelligent Systems

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Network covert channels are becoming exploited by a wide-range of threats to avoid detection. Such offensive schemes are expected to be also used against IoT deployments, for instance to exfiltrate data or to covertly orchestrate botnets composed of simple devices. Therefore, we illustrate a solution based on Deep Learning for the detection of covert channels targeting the TTL field of IPv4 datagrams. To this aim, we take advantage of an Autoencoder ensemble to reveal anomalous traffic behaviors. An experimentation on realistic traffic traces demonstrates the effectiveness of our approach.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Fußnoten
1
In this work, we used the collection of IoT traffic made available in [14]. Heatmaps have been computed by using the 24-h slice of data captured from September 22, 2016 at 16:00 to September 23, 2016 at 16:00, whereas for the performance evaluation we used traces containing traffic collected from September 22, 2016 at 16:00 to September 29, 2016 at 16:00.
 
2
TensorFlow machine learning library. Available online at: https://​www.​tensorflow.​org/​ [Last Accessed: June 2022].
 
Literatur
1.
Zurück zum Zitat Ahmad, Z., Khan, A.S., Shiang, C.W., Abdullah, J., Ahmad, F.: Network intrusion detection system: a systematic study of machine learning and deep learning approaches. Trans. Emerg. Telecommun. Technol. 32(1), e4150 (2021) Ahmad, Z., Khan, A.S., Shiang, C.W., Abdullah, J., Ahmad, F.: Network intrusion detection system: a systematic study of machine learning and deep learning approaches. Trans. Emerg. Telecommun. Technol. 32(1), e4150 (2021)
2.
Zurück zum Zitat Alcaraz, C., Bernieri, G., Pascucci, F., Lopez, J., Setola, R.: Covert channels-based stealth attacks in industry 4.0. IEEE Syst. J. 13(4), 3980–3988 (2019)CrossRef Alcaraz, C., Bernieri, G., Pascucci, F., Lopez, J., Setola, R.: Covert channels-based stealth attacks in industry 4.0. IEEE Syst. J. 13(4), 3980–3988 (2019)CrossRef
3.
Zurück zum Zitat Antonakakis, M., et al.: Understanding the Mirai botnet. In: 26th USENIX Security Symposium, pp. 1093–1110 (2017) Antonakakis, M., et al.: Understanding the Mirai botnet. In: 26th USENIX Security Symposium, pp. 1093–1110 (2017)
4.
Zurück zum Zitat Bengio, Y., Pascal, L., Dan, P., Larochelle, H.: Greedy layer-wise training of deep networks. In: Advances in Neural Information Processing Systems (NeurIPS), vol. 19, pp. 153–160. MIT Press (2007) Bengio, Y., Pascal, L., Dan, P., Larochelle, H.: Greedy layer-wise training of deep networks. In: Advances in Neural Information Processing Systems (NeurIPS), vol. 19, pp. 153–160. MIT Press (2007)
5.
Zurück zum Zitat Darwish, O., Al-Fuqaha, A., Brahim, G.B., Jenhani, I., Vasilakos, A.: Using hierarchical statistical analysis and deep neural networks to detect covert timing channels. Appl. Soft Comput. 82, 105546 (2019)CrossRef Darwish, O., Al-Fuqaha, A., Brahim, G.B., Jenhani, I., Vasilakos, A.: Using hierarchical statistical analysis and deep neural networks to detect covert timing channels. Appl. Soft Comput. 82, 105546 (2019)CrossRef
6.
Zurück zum Zitat Elsadig, M.A., Gafar, A.: Covert channel detection: machine learning approaches. IEEE Access 10, 38391–38405 (2022)CrossRef Elsadig, M.A., Gafar, A.: Covert channel detection: machine learning approaches. IEEE Access 10, 38391–38405 (2022)CrossRef
7.
Zurück zum Zitat Folino, G., Guarascio, M., Papuzzo, G.: Exploiting fractal dimension and a distributed evolutionary approach to classify data streams with concept drifts. Appl. Soft Comput. 75, 284–297 (2019)CrossRef Folino, G., Guarascio, M., Papuzzo, G.: Exploiting fractal dimension and a distributed evolutionary approach to classify data streams with concept drifts. Appl. Soft Comput. 75, 284–297 (2019)CrossRef
8.
Zurück zum Zitat Hinton, G., Salakhutdinov, R.: Reducing the dimensionality of data with neural networks. Science 313(5786), 504–507 (2006)MathSciNetCrossRef Hinton, G., Salakhutdinov, R.: Reducing the dimensionality of data with neural networks. Science 313(5786), 504–507 (2006)MathSciNetCrossRef
9.
Zurück zum Zitat Mazurczyk, W., Caviglione, L.: Information hiding as a challenge for malware detection. IEEE Secur. Priv. 13(2), 89–93 (2015)CrossRef Mazurczyk, W., Caviglione, L.: Information hiding as a challenge for malware detection. IEEE Secur. Priv. 13(2), 89–93 (2015)CrossRef
10.
Zurück zum Zitat McLaren, P., Russell, G., Buchanan, B.: Mining malware command and control traces. In: 2017 Computing Conference, pp. 788–794 (2017) McLaren, P., Russell, G., Buchanan, B.: Mining malware command and control traces. In: 2017 Computing Conference, pp. 788–794 (2017)
11.
Zurück zum Zitat Neshenko, N., Bou-Harb, E., Crichigno, J., Kaddoum, G., Ghani, N.: Demystifying IoT security: an exhaustive survey on IoT vulnerabilities and a first empirical look on Internet-scale IoT exploitations. IEEE Commun. Surv. Tutorials 21(3), 2702–2733 (2019)CrossRef Neshenko, N., Bou-Harb, E., Crichigno, J., Kaddoum, G., Ghani, N.: Demystifying IoT security: an exhaustive survey on IoT vulnerabilities and a first empirical look on Internet-scale IoT exploitations. IEEE Commun. Surv. Tutorials 21(3), 2702–2733 (2019)CrossRef
12.
Zurück zum Zitat Parisi, G.I., Kemker, R., Part, J.L., Kanan, C., Wermter, S.: Continual lifelong learning with neural networks: a review. Neural Networks 113, 54–71 (2019)CrossRef Parisi, G.I., Kemker, R., Part, J.L., Kanan, C., Wermter, S.: Continual lifelong learning with neural networks: a review. Neural Networks 113, 54–71 (2019)CrossRef
13.
Zurück zum Zitat Repetto, M., Caviglione, L., Zuppelli, M.: bccstego: a framework for investigating network covert channels. In: The 16th International Conference on Availability, Reliability and Security, pp. 1–7 (2021) Repetto, M., Caviglione, L., Zuppelli, M.: bccstego: a framework for investigating network covert channels. In: The 16th International Conference on Availability, Reliability and Security, pp. 1–7 (2021)
14.
Zurück zum Zitat Sivanathan, A., et al.: Classifying IoT devices in smart environments using network traffic characteristics. IEEE Trans. Mob. Comput. 18(8), 1745–1759 (2018)CrossRef Sivanathan, A., et al.: Classifying IoT devices in smart environments using network traffic characteristics. IEEE Trans. Mob. Comput. 18(8), 1745–1759 (2018)CrossRef
16.
Zurück zum Zitat Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermeasures in computer network protocols. IEEE Commun. Surv. Tutorials 9(3), 44–57 (2007)CrossRef Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermeasures in computer network protocols. IEEE Commun. Surv. Tutorials 9(3), 44–57 (2007)CrossRef
17.
Zurück zum Zitat Zuppelli, M., Caviglione, L.: pcapstego: a tool for generating traffic traces for experimenting with network covert channels. In: The 16th International Conference on Availability, Reliability and Security, pp. 1–8 (2021) Zuppelli, M., Caviglione, L.: pcapstego: a tool for generating traffic traces for experimenting with network covert channels. In: The 16th International Conference on Availability, Reliability and Security, pp. 1–8 (2021)
Metadaten
Titel
Ensembling Sparse Autoencoders for Network Covert Channel Detection in IoT Ecosystems
verfasst von
Nunziato Cassavia
Luca Caviglione
Massimo Guarascio
Angelica Liguori
Marco Zuppelli
Copyright-Jahr
2022
DOI
https://doi.org/10.1007/978-3-031-16564-1_20

Premium Partner