About Me Name: Yaokai Feng, from Kyushu University Research background/interests: Database (Ph.D. ) Pattern Recognition Network security My current focus 2017/3/19 WS@IITD 2017.03

WP6: Cloud Security for IoT Members in KU: (Leader) Koichi Sakurai (Prof.) Yaokai Feng (Assist. Prof. ) Danilo Vasconcellos Vargas (Assist. Prof. ) Jiawei Su (PhD candidate) Members in IITD Sanjiva Prasad (Prof.) Members in UMBC Anupam Joshi (Prof.) 2017/3/19 WS@IITD 2017.03

(WP6: Cloud Security for IoT) Today’s talk Part I: Cloud System in IoT Era Part II: What we are doing now Part III: Our future work 2017/3/19 WS@IITD 2017.03

Part I. Cloud System in IoT Era (WP6: Cloud Security for IoT) Part I. Cloud System in IoT Era 2017/3/19 WS@IITD 2017.03

1. Security in IoT era: more critically important The Internet has extended to the physical world information security service security physical world security life safety In many cases, security problems must be solved in real time 2017/3/19 WS@IITD 2017.03

2. “Smart” in IoT era: multi-layered (An example: from smart buildings to smart cities) smart region/organization smart building smart services smart city 2017/3/19 WS@IITD 2017.03

3. Centralized cloud system service models: Software as a service Platform as a Service Infrastructure as a service … … service contents: storage, computation, … … Not true in IoT era Based on two assumptions: 1) The users can wait for the processing result 2) The internet is always available when necessary users

(con’t) Many applications are time-critical tele-medicine, tele-patient-care, collision prevention of vehicles … … Many environments have poor internet connectivity IoT will be everywhere Problems on privacy and security may occur having every device connected to the centralized cloud and sending raw data They can’t afford the roundtrip to the cloud server more dangerous especially for sensitive data 2017/3/19 WS@IITD 2017.03

4. Cloud System in IoT Era: multi-layered Fog IoT devices A large number of service centers WP6’s task Their security must be guaranteed at the edge local ingestion of data quick turnaround of results 2017/3/19 WS@IITD 2017.03

Part II. What we are doing now (WP6: Cloud Security for IoT) Part II. What we are doing now 2017/3/19 WS@IITD 2017.03

SDN: often used in data centers 1. Proposing an approach to detect DDoS attacks in SDN environments Our approach can decrease the burden of the controller Its rough idea has been presented at: SDN: often used in data centers Xiang You, Yaokai Feng, Koichi Sakurai, “Packet-In message based DDoS attack detection in SDN network”, Hinokuni Symposium, Japan, Mar 2017 Technical slides are also prepared for this workshop We can discuss offline 2017/3/19 WS@IITD 2017.03

2. Investigating possible ways to simulate the IoT environment Simulation can enable threat-evaluations, defense strategies 3. Investigating for IOT malware analysis 2017/3/19 WS@IITD 2017.03

3. Investigation for IOT malware analysis Mostly Linux based malware Light-weight, single function Can be distributed by telnet connection (many IOT devices using easy password which allow free access), … … 2017/3/19 WS@IITD 2017.03

Part III. Our future work (WP6: Cloud Security for IoT) Part III. Our future work 2017/3/19 WS@IITD 2017.03

2. our investigation on simulation of IoT environment 1. the study on attack detection in SDN environments not only DDoS attack but also other attacks or anomalies 2. our investigation on simulation of IoT environment 3. Our Investigation and analysis of IoT malwares Investigating and analyzing characteristics of IOT malwares IOT malware classification 4. Implement novel ideas of active cyber defense for IoT 2017/3/19 WS@IITD 2017.03

Thank you 2017/3/19 WS@IITD 2017.03

Packet In message based DDoS attack detection in SDN network Xiang You, Yaokai Feng, Koichi Sakurai 　Kyushu University　 2017/3/19 WS@IITD 2017.03

Related work Packet check based All the packets are checked regardless of whether or not attacks have occurred. Flow-entry check based The flow table is checked once in every time slot Packet-in check based (2016) [1] When the frequency of packet-in exceeds the threshold (a trigger), all the flow-entries are collected and processed by the controller WS@IITD 2017.03 2017/3/19

The latest related work [1] Trigger Feature Extractor Classifier Attack Alert Flow Collector Frequency of packet-in all the flow-entries are collected and processed by the controller Switch Open-flow 2017/3/19 WS@IITD 2017.03

Our approach Statistics are made in advance Packet In Packet In N packet-in N packet-in OpenFlow controller Node Node frequency of Packet In entropy of source IPs entropy of destination IPs entropy of destination ports … … Packet In OpenFlow switch Statistics are made in advance New features are introduced user user 2017/3/19 WS@IITD 2017.03