Skip to main content

Ayyoob Hamza

The University of New South Wales, Electrical Engineering and Telecommunications, Graduate Student

University of Colombo, Sri Lanka, University of Colombo School of Computing, Alumnus

Followers

38

Following

8

Co-authors

3

Public Views

Ayyoob Hamza received his Bachelors' degree in Computer Science from the University of Colombo, Sri Lanka and is currently a Ph.D. Candidate at the University of New South Wales in Sydney, Australia.Prior to his research career, he worked at WSO2 Inc. as a Senior Software Engineer. His research interests include Internet of Things, Network Security, Distributed Systems and Software-Defined Networking.

less

Kansas State University

Erik M Champion

University of South Australia

Roshan Chitrakar

Nepal College of Information Technology

Richard Jochelson

University of Manitoba

Graduate Center of the City University of New York

Rossitza Goleva

New Bulgarian University

Viacheslav Kuleshov

Stockholm University

Dr. Shadab Alam

Jazan University

Marianna Charitonidou

Princeton University

The University of Sydney

InterestsView All (6)

Uploads

Papers by Ayyoob Hamza

Verifying and Monitoring IoTs Network Behavior using MUD Profiles

arXiv (Cornell University), Feb 7, 2019

IoT devices are increasingly being implicated in cyber-attacks, raising community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track devices network behavior based on their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes on their network.

Clear as MUD: Generating, Validating and Applying IoT Behaviorial Profiles (Technical Report)

arXiv (Cornell University), Apr 12, 2018

IoT devices are increasingly being implicated in cyber-attacks, driving community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, driving community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates a MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing.

Detecting Anomalous Microflows in IoT Volumetric Attacks via Dynamic Monitoring of MUD Activity

arXiv (Cornell University), Apr 11, 2023

Smart homes, enterprises, and cities equipped with IoT devices are increasingly becoming target o... more Smart homes, enterprises, and cities equipped with IoT devices are increasingly becoming target of an escalating number of sophisticated new cyber-attacks. Anomaly-based detection methods are promising in finding new attacks, but there are certain practical challenges like false-positive alarms, hard to explain, and difficult to scale cost-effectively. The IETF recent standard called Manufacturer Usage Description (MUD) seems promising to limit the attack surface on IoT devices by formally specifying their intended network behavior (whitelisting). In this paper, we use SDN to enforce and monitor the expected behaviors (compliant with MUD profile) of each IoT device, and train one-class classifier models to detect volumetric attacks such as DoS, reflective TCP/UDP/ICMP flooding, and ARP spoofing on IoT devices. Our first contribution develops a multi-level inferencing model to dynamically detect anomalous patterns in network activity of MUDcompliant traffic flows via SDN telemetry, followed by packet inspection of anomalous flows. This provides enhanced fine-grained visibility into distributed and direct attacks, allowing us to precisely isolate volumetric attacks with microflow (5-tuple) resolution. For our second contribution, we collect traffic traces (benign and a variety of volumetric attacks) from network behavior of IoT devices in our lab, generate labeled datasets, and make them available to the public. Our third contribution prototypes a full working system (modules are released as open-source), demonstrates its efficacy in detecting volumetric attacks on several consumer IoT devices with high accuracy while maintaining low false positives, and provides insights into cost and performance of our system. Our last contribution demonstrates how our models scale in environments with a large number of connected IoTs (with datasets collected from a network of IP cameras in our university campus) by considering various training strategies (per device unit versus per device type), and balancing the accuracy of prediction against the cost of models in terms of size and training time.

Programmable Active Scans Controlled by Passive Traffic Inference for IoT Asset Characterization

NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium

PicP-MUD: Profiling Information Content of Payloads in MUD Flows for IoT Devices

2022 IEEE 23rd International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM)

Combining Device Behavioral Models and Building Schema for Cyber-Security of Large-Scale IoT Infrastructure

IEEE Internet of Things Journal

Securing IoT Networks using Formal Behavioral Modeling and Dynamic Flow Management

Verifying and Monitoring IoTs Network Behavior Using MUD Profiles

IEEE Transactions on Dependable and Secure Computing, 2020

IoT devices are increasingly being implicated in cyberattacks, raising community concern about th... more IoT devices are increasingly being implicated in cyberattacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track device network behavior using their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes in their network.

Cyber‐Securing IoT Infrastructure by Modeling Network Traffic

Security and Privacy in the Internet of Things, 2021

IoT Network Security: Requirements, Threats, and Countermeasures

ArXiv, 2020

IoT devices are increasingly utilized in critical infrastructure, enterprises, and households. Th... more IoT devices are increasingly utilized in critical infrastructure, enterprises, and households. There are several sophisticated cyber-attacks that have been reported and many networks have proven vulnerable to both active and passive attacks by leaking private information, allowing unauthorized access, and being open to denial of service attacks. This paper aims firstly, to assist network operators to understand the need for an IoT network security solution, and then secondly, to survey IoT network attack vectors, cyber threats, and countermeasures with a focus on improving the robustness of existing security solutions. Our first contribution highlights viewpoints on IoT security from the perspective of stakeholders such as manufacturers, service providers, consumers, and authorities. We discuss the differences between IoT and IT systems, the need for IoT security solutions, and we highlight the key components required for IoT network security system architecture. For our second cont...

Proceedings of the 2018 Workshop on IoT Security and Privacy, 2018

IoT devices are increasingly being implicated in cyber-attacks, raising community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. CCS CONCEPTS • Security and privacy → Formal methods and theory of security;

Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity

Proceedings of the 2019 ACM Symposium on SDN Research, 2019

Smart environments equipped with IoT devices are increasingly under threat from an escalating num... more Smart environments equipped with IoT devices are increasingly under threat from an escalating number of sophisticated cyber-attacks. Current security approaches are inaccurate, expensive, or unscalable, as they require static signatures of known attacks, specialized hardware, or full packet inspection. The IETF Manufacturer Usage Description (MUD) framework aims to reduce the attack surface on an IoT device by formally defining its expected network behavior. In this paper, we use SDN to monitor compliance with the MUD behavioral profile, and develop machine learning methods to detect volumetric attacks such as DoS, reflective TCP/UDP/ICMP flooding, and ARP spoofing to IoT devices. Our first contribution develops a machine for detecting anomalous patterns of MUD-compliant network activity via coarse-grained (device-level) and fine-grained (flow-level) SDN telemetry for each IoT device, thereby giving visibility into flows that contribute to a volumetric attack. For our second contribution we measure network behavior of IoT devices by collecting benign and volumetric attacks traffic traces in our lab, label our dataset, and make it available to the public. Our last contribution prototypes a full working system (built with an OpenFlow switch, Faucet SDN controller, and a MUD policy engine), demonstrates its application in detecting volumetric attacks on several consumer IoT devices with high accuracy, and provides insights into cost and performance of our system. Our data and solution modules are released as open source to the community.

Combining MUD Policies with SDN for IoT Intrusion Detection

Proceedings of the 2018 Workshop on IoT Security and Privacy, 2018

The IETF's push towards standardizing the Manufacturer Usage Description (MUD) grammar and mechan... more The IETF's push towards standardizing the Manufacturer Usage Description (MUD) grammar and mechanism for specifying IoT device behavior is gaining increasing interest from industry. The ability to control inappropriate communication between devices in the form of access control lists (ACLs) is expected to limit the attack surface on IoT devices; however, little is known about how MUD policies will get enforced in operational networks, and how they will interact with current and future intrusion detection systems (IDS). We believe this paper is the first attempt to translate MUD policies into flow rules that can be enforced using SDN, and in relating exception behavior to attacks that can be detected via off-the-shelf IDS. Our first contribution develops and implements a system that translates MUD policies to flow rules that are proactively configured into network switches, as well as reactively inserted based on run-time bindings of DNS. We use traces of 28 consumer IoT devices taken over several months to evaluate the performance of our system in terms of switch flow-table size and fraction of exception traffic that needs software inspection. Our second contribution identifies the limitations of flow-rules derived from MUD in protecting IoT devices from internal and external network attacks, and we show how our system is able to detect such volumetric attacks (including port scanning, TCP/UDP/ICMP flooding, ARP spoofing, and TCP/SSDP/SNMP reflection) by sending only a very small fraction of exception packets to off-the-shelf IDS.

Proceedings of the 2021 Workshop on Descriptive Approaches to IoT Security, Network, and Application Configuration, 2021

Networked cameras continue to be an attractive target of cyber-attacks and therefore present huge... more Networked cameras continue to be an attractive target of cyber-attacks and therefore present huge risks to organizations. The use of vulnerable credentials (manufacturers default or publicly known) by these devices remains a primary concern for network and cybersecurity teams. This paper aims to assist enterprise network operators to systematically and passively assess the risk of using default credentials or vulnerable authentication schemes for directly accessing connected cameras. Our contributions are two-fold: (1) We analyze HTTP traffic traces of enterprise-grade network cameras (sourced from popular manufacturers including Cisco, Axis, and Pelco), identify the signature of their authentication techniques, including Basic, regular Digest, and Web Service Security (WSS), extracted from request packets, and develop a system with an algorithm (PARVP) for automatic and passive assessment of authentication risks; and (2) We apply PARVP to traffic traces of about 1.4 million HTTP authentication sessions selectively collected from network traffic of more than 1000 cameras (in our university campus network) during three weeks, and draw insights into risks, including cameras that accept default passwords (though hashed) and camera controllers that reveal passwords (though obsolete) by insecure authentication.

Network-Level Security for the Internet of Things: Opportunities and Challenges

Computer, 2019

Towards a sensor system to tame the human elephant conflict

2015 IEEE Sensors Applications Symposium (SAS), 2015

The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. ... more The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. Frequent clashes between wild elephants and villagers have resulted in severe damage to property, as well as loss of lives for both humans and elephants. Competition for space is the primary reason for conflict between humans and elephants. Elephants that escape from the wildlife national parks venture into villages creating destruction in their wake. To prevent such mishaps, a proper system is required to contain and monitor elephants in national parks. In this paper, we describe different approaches to detect elephants and possible ways of monitoring the national wildlife parks. We also elaborate on the advantages and limitations of each approach, and determine what sort of system is needed to tame the human elephant conflict.

A Quadcopter Controller to Maintain Radio Link Quality

Proceedings of the First Workshop on Micro Aerial Vehicle Networks, Systems, and Applications for Civilian Use - DroNet '15, 2015

The excellent maneuverability and the availability of a large number of sensors including good qu... more The excellent maneuverability and the availability of a large number of sensors including good quality video cameras make quadcopters attractive for surveillance systems. Most video surveillance systems need a real-time high quality video stream from the cameras on the quadcopter to the base station which requires a stable and reliable radio link. Moreover, to ensure a controlled flight, it is essential to maintain a good quality radio link from the base station to the quadcopter. The quality of this link depends on the distance between base station and quadcopter as well as the ambient noise. Towards this end, we present a controller to hover a quadcopter at the maximum distance from the base station while maintaining the link quality at a given value indicated by the Signal to Noise Ratio (SNR). There are existing solutions in the field of robotics that incorporate the concept of link aware mobility. However, to the best of our knowledge, this is the first link-quality aware mobility implementation on a quadcopter.

Towards a sensor system to tame the human elephant conflict

by ERANDA TENNAKOON, Charitha Elvitigala, and Ayyoob Hamza

2015 IEEE Sensors Applications Symposium (SAS), 2015

The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. ... more The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. Frequent clashes between wild elephants and villagers have resulted in severe damage to property, as well as loss of lives for both humans and elephants. Competition for space is the primary reason for conflict between humans and elephants. Elephants that escape from the wildlife national parks venture into villages creating destruction in their wake. To prevent such mishaps, a proper system is required to contain and monitor elephants in national parks. In this paper, we describe different approaches to detect elephants and possible ways of monitoring the national wildlife parks. We also elaborate on the advantages and limitations of each approach, and determine what sort of system is needed to tame the human elephant conflict.

A Quadcopter Controller to Maintain Radio Link Quality

The excellent maneuverability and the availability of a large number of sensors including good qu... more The excellent maneuverability and the availability of a large number of sensors including good quality video cameras make quadcopters attractive for surveillance systems. Most video surveillance systems need a real-time high quality video stream from the cameras on the quadcopter to the base station which requires a stable and reliable radio link. Moreover, to ensure a controlled flight, it is essential to maintain a good quality radio link from the base station to the quad- copter. The quality of this link depends on the distance between base station and quadcopter as well as the ambient noise. Towards this end, we present a controller to hover a quadcopter at the maximum distance from the base station while maintaining the link quality at a given value indicated by the Signal to Noise Ratio (SNR). There are existing solutions in the field of robotics that incorporate the concept of link aware mobility. However, to the best of our knowledge, this is the first link-quality aware mobility implementation on a quadcopter.

Person Identification Through Multiple Data Streams

Verifying and Monitoring IoTs Network Behavior using MUD Profiles

arXiv (Cornell University), Feb 7, 2019

IoT devices are increasingly being implicated in cyber-attacks, raising community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track devices network behavior based on their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes on their network.

Clear as MUD: Generating, Validating and Applying IoT Behaviorial Profiles (Technical Report)

arXiv (Cornell University), Apr 12, 2018

IoT devices are increasingly being implicated in cyber-attacks, driving community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, driving community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates a MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing.

Detecting Anomalous Microflows in IoT Volumetric Attacks via Dynamic Monitoring of MUD Activity

arXiv (Cornell University), Apr 11, 2023

Smart homes, enterprises, and cities equipped with IoT devices are increasingly becoming target o... more Smart homes, enterprises, and cities equipped with IoT devices are increasingly becoming target of an escalating number of sophisticated new cyber-attacks. Anomaly-based detection methods are promising in finding new attacks, but there are certain practical challenges like false-positive alarms, hard to explain, and difficult to scale cost-effectively. The IETF recent standard called Manufacturer Usage Description (MUD) seems promising to limit the attack surface on IoT devices by formally specifying their intended network behavior (whitelisting). In this paper, we use SDN to enforce and monitor the expected behaviors (compliant with MUD profile) of each IoT device, and train one-class classifier models to detect volumetric attacks such as DoS, reflective TCP/UDP/ICMP flooding, and ARP spoofing on IoT devices. Our first contribution develops a multi-level inferencing model to dynamically detect anomalous patterns in network activity of MUDcompliant traffic flows via SDN telemetry, followed by packet inspection of anomalous flows. This provides enhanced fine-grained visibility into distributed and direct attacks, allowing us to precisely isolate volumetric attacks with microflow (5-tuple) resolution. For our second contribution, we collect traffic traces (benign and a variety of volumetric attacks) from network behavior of IoT devices in our lab, generate labeled datasets, and make them available to the public. Our third contribution prototypes a full working system (modules are released as open-source), demonstrates its efficacy in detecting volumetric attacks on several consumer IoT devices with high accuracy while maintaining low false positives, and provides insights into cost and performance of our system. Our last contribution demonstrates how our models scale in environments with a large number of connected IoTs (with datasets collected from a network of IP cameras in our university campus) by considering various training strategies (per device unit versus per device type), and balancing the accuracy of prediction against the cost of models in terms of size and training time.

Programmable Active Scans Controlled by Passive Traffic Inference for IoT Asset Characterization

NOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium

PicP-MUD: Profiling Information Content of Payloads in MUD Flows for IoT Devices

2022 IEEE 23rd International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM)

Combining Device Behavioral Models and Building Schema for Cyber-Security of Large-Scale IoT Infrastructure

IEEE Internet of Things Journal

Securing IoT Networks using Formal Behavioral Modeling and Dynamic Flow Management

Verifying and Monitoring IoTs Network Behavior Using MUD Profiles

IEEE Transactions on Dependable and Secure Computing, 2020

IoT devices are increasingly being implicated in cyberattacks, raising community concern about th... more IoT devices are increasingly being implicated in cyberattacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies and track device network behavior using their MUD profile. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. We apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. Finally, we show how operators can dynamically identify IoT devices using known MUD profiles and monitor their behavioral changes in their network.

Cyber‐Securing IoT Infrastructure by Modeling Network Traffic

Security and Privacy in the Internet of Things, 2021

IoT Network Security: Requirements, Threats, and Countermeasures

ArXiv, 2020

IoT devices are increasingly utilized in critical infrastructure, enterprises, and households. Th... more IoT devices are increasingly utilized in critical infrastructure, enterprises, and households. There are several sophisticated cyber-attacks that have been reported and many networks have proven vulnerable to both active and passive attacks by leaking private information, allowing unauthorized access, and being open to denial of service attacks. This paper aims firstly, to assist network operators to understand the need for an IoT network security solution, and then secondly, to survey IoT network attack vectors, cyber threats, and countermeasures with a focus on improving the robustness of existing security solutions. Our first contribution highlights viewpoints on IoT security from the perspective of stakeholders such as manufacturers, service providers, consumers, and authorities. We discuss the differences between IoT and IT systems, the need for IoT security solutions, and we highlight the key components required for IoT network security system architecture. For our second cont...

Proceedings of the 2018 Workshop on IoT Security and Privacy, 2018

IoT devices are increasingly being implicated in cyber-attacks, raising community concern about t... more IoT devices are increasingly being implicated in cyber-attacks, raising community concern about the risks they pose to critical infrastructure, corporations, and citizens. In order to reduce this risk, the IETF is pushing IoT vendors to develop formal specifications of the intended purpose of their IoT devices, in the form of a Manufacturer Usage Description (MUD), so that their network behavior in any operating environment can be locked down and verified rigorously. This paper aims to assist IoT manufacturers in developing and verifying MUD profiles, while also helping adopters of these devices to ensure they are compatible with their organizational policies. Our first contribution is to develop a tool that takes the traffic trace of an arbitrary IoT device as input and automatically generates the MUD profile for it. We contribute our tool as open source, apply it to 28 consumer IoT devices, and highlight insights and challenges encountered in the process. Our second contribution is to apply a formal semantic framework that not only validates a given MUD profile for consistency, but also checks its compatibility with a given organizational policy. Finally, we apply our framework to representative organizations and selected devices, to demonstrate how MUD can reduce the effort needed for IoT acceptance testing. CCS CONCEPTS • Security and privacy → Formal methods and theory of security;

Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity

Proceedings of the 2019 ACM Symposium on SDN Research, 2019

Smart environments equipped with IoT devices are increasingly under threat from an escalating num... more Smart environments equipped with IoT devices are increasingly under threat from an escalating number of sophisticated cyber-attacks. Current security approaches are inaccurate, expensive, or unscalable, as they require static signatures of known attacks, specialized hardware, or full packet inspection. The IETF Manufacturer Usage Description (MUD) framework aims to reduce the attack surface on an IoT device by formally defining its expected network behavior. In this paper, we use SDN to monitor compliance with the MUD behavioral profile, and develop machine learning methods to detect volumetric attacks such as DoS, reflective TCP/UDP/ICMP flooding, and ARP spoofing to IoT devices. Our first contribution develops a machine for detecting anomalous patterns of MUD-compliant network activity via coarse-grained (device-level) and fine-grained (flow-level) SDN telemetry for each IoT device, thereby giving visibility into flows that contribute to a volumetric attack. For our second contribution we measure network behavior of IoT devices by collecting benign and volumetric attacks traffic traces in our lab, label our dataset, and make it available to the public. Our last contribution prototypes a full working system (built with an OpenFlow switch, Faucet SDN controller, and a MUD policy engine), demonstrates its application in detecting volumetric attacks on several consumer IoT devices with high accuracy, and provides insights into cost and performance of our system. Our data and solution modules are released as open source to the community.

Combining MUD Policies with SDN for IoT Intrusion Detection

Proceedings of the 2018 Workshop on IoT Security and Privacy, 2018

The IETF's push towards standardizing the Manufacturer Usage Description (MUD) grammar and mechan... more The IETF's push towards standardizing the Manufacturer Usage Description (MUD) grammar and mechanism for specifying IoT device behavior is gaining increasing interest from industry. The ability to control inappropriate communication between devices in the form of access control lists (ACLs) is expected to limit the attack surface on IoT devices; however, little is known about how MUD policies will get enforced in operational networks, and how they will interact with current and future intrusion detection systems (IDS). We believe this paper is the first attempt to translate MUD policies into flow rules that can be enforced using SDN, and in relating exception behavior to attacks that can be detected via off-the-shelf IDS. Our first contribution develops and implements a system that translates MUD policies to flow rules that are proactively configured into network switches, as well as reactively inserted based on run-time bindings of DNS. We use traces of 28 consumer IoT devices taken over several months to evaluate the performance of our system in terms of switch flow-table size and fraction of exception traffic that needs software inspection. Our second contribution identifies the limitations of flow-rules derived from MUD in protecting IoT devices from internal and external network attacks, and we show how our system is able to detect such volumetric attacks (including port scanning, TCP/UDP/ICMP flooding, ARP spoofing, and TCP/SSDP/SNMP reflection) by sending only a very small fraction of exception packets to off-the-shelf IDS.

Proceedings of the 2021 Workshop on Descriptive Approaches to IoT Security, Network, and Application Configuration, 2021

Networked cameras continue to be an attractive target of cyber-attacks and therefore present huge... more Networked cameras continue to be an attractive target of cyber-attacks and therefore present huge risks to organizations. The use of vulnerable credentials (manufacturers default or publicly known) by these devices remains a primary concern for network and cybersecurity teams. This paper aims to assist enterprise network operators to systematically and passively assess the risk of using default credentials or vulnerable authentication schemes for directly accessing connected cameras. Our contributions are two-fold: (1) We analyze HTTP traffic traces of enterprise-grade network cameras (sourced from popular manufacturers including Cisco, Axis, and Pelco), identify the signature of their authentication techniques, including Basic, regular Digest, and Web Service Security (WSS), extracted from request packets, and develop a system with an algorithm (PARVP) for automatic and passive assessment of authentication risks; and (2) We apply PARVP to traffic traces of about 1.4 million HTTP authentication sessions selectively collected from network traffic of more than 1000 cameras (in our university campus network) during three weeks, and draw insights into risks, including cameras that accept default passwords (though hashed) and camera controllers that reveal passwords (though obsolete) by insecure authentication.

Network-Level Security for the Internet of Things: Opportunities and Challenges

Computer, 2019

Towards a sensor system to tame the human elephant conflict

2015 IEEE Sensors Applications Symposium (SAS), 2015

The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. ... more The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. Frequent clashes between wild elephants and villagers have resulted in severe damage to property, as well as loss of lives for both humans and elephants. Competition for space is the primary reason for conflict between humans and elephants. Elephants that escape from the wildlife national parks venture into villages creating destruction in their wake. To prevent such mishaps, a proper system is required to contain and monitor elephants in national parks. In this paper, we describe different approaches to detect elephants and possible ways of monitoring the national wildlife parks. We also elaborate on the advantages and limitations of each approach, and determine what sort of system is needed to tame the human elephant conflict.

A Quadcopter Controller to Maintain Radio Link Quality

Proceedings of the First Workshop on Micro Aerial Vehicle Networks, Systems, and Applications for Civilian Use - DroNet '15, 2015

The excellent maneuverability and the availability of a large number of sensors including good qu... more The excellent maneuverability and the availability of a large number of sensors including good quality video cameras make quadcopters attractive for surveillance systems. Most video surveillance systems need a real-time high quality video stream from the cameras on the quadcopter to the base station which requires a stable and reliable radio link. Moreover, to ensure a controlled flight, it is essential to maintain a good quality radio link from the base station to the quadcopter. The quality of this link depends on the distance between base station and quadcopter as well as the ambient noise. Towards this end, we present a controller to hover a quadcopter at the maximum distance from the base station while maintaining the link quality at a given value indicated by the Signal to Noise Ratio (SNR). There are existing solutions in the field of robotics that incorporate the concept of link aware mobility. However, to the best of our knowledge, this is the first link-quality aware mobility implementation on a quadcopter.

Towards a sensor system to tame the human elephant conflict

by ERANDA TENNAKOON, Charitha Elvitigala, and Ayyoob Hamza

2015 IEEE Sensors Applications Symposium (SAS), 2015

The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. ... more The human elephant conflict in Sri Lanka has been a cause of major concern over the past decade. Frequent clashes between wild elephants and villagers have resulted in severe damage to property, as well as loss of lives for both humans and elephants. Competition for space is the primary reason for conflict between humans and elephants. Elephants that escape from the wildlife national parks venture into villages creating destruction in their wake. To prevent such mishaps, a proper system is required to contain and monitor elephants in national parks. In this paper, we describe different approaches to detect elephants and possible ways of monitoring the national wildlife parks. We also elaborate on the advantages and limitations of each approach, and determine what sort of system is needed to tame the human elephant conflict.

A Quadcopter Controller to Maintain Radio Link Quality

The excellent maneuverability and the availability of a large number of sensors including good qu... more The excellent maneuverability and the availability of a large number of sensors including good quality video cameras make quadcopters attractive for surveillance systems. Most video surveillance systems need a real-time high quality video stream from the cameras on the quadcopter to the base station which requires a stable and reliable radio link. Moreover, to ensure a controlled flight, it is essential to maintain a good quality radio link from the base station to the quad- copter. The quality of this link depends on the distance between base station and quadcopter as well as the ambient noise. Towards this end, we present a controller to hover a quadcopter at the maximum distance from the base station while maintaining the link quality at a given value indicated by the Signal to Noise Ratio (SNR). There are existing solutions in the field of robotics that incorporate the concept of link aware mobility. However, to the best of our knowledge, this is the first link-quality aware mobility implementation on a quadcopter.

Person Identification Through Multiple Data Streams

A Quadcopter Controller to Maintain Radio Link Quality - Thesis

The excellent maneuverability and the availability of large number of sensors including good qual... more The excellent maneuverability and the availability of large number of sensors including good quality video cameras make quadcopters an attractive device for deployment in surveillance systems. Most video surveillance systems require a real-time high quality video to stream from the cameras on the quadcopter to the base-station. This requires a good quality radio link between the quadcopter and the base-station. Furthermore a good link quality is also needed to be maintained to make sure that either control signal or the result from o ine processing gets back to the quadcopter without any loss. The link quality depends on the distance of the quadcopter from the base-station; the signal strength decreases with distance. The link quality also depends on the noise of the environment. This study consider the problem of hovering a quadcopter at the maximum distance from the base-station while maintaining a link quality at a given value indicated by the Signal to Noise Ratio (SNR). This solves the problem on having an empirical measurement for the distance on a wireless device. Wherein having a pre-set value for distance does not fully utilize the maximum range it could fly or it would break the communication link if the pre-set value for distance is greater than the communication range. There are existing solution on the field of robotics that incorporates the concept of link aware mobility. However, this is the first time a practical implementation and experiments is considered on the quadcopters. A novel approach is proposed on link aware mobility -An autonomous controller that uses a cognitive based model to learn the SNR change and provide necessary feedback. SNR is a metric that depends on many factors. Therefore a suitable in depth analysis is done on how to use the SNR as a signal metric.