Pulse: An Adaptive Intrusion Detection System for the Internet of Things (IoT) Good morning every one , I will give you a brief overview of the work my colleague(Eirini) and I working on that is developing an adaptive intrusion detection system for internet of things devices. Unfortunately she could not be present here due to health issue and I will try my best to present on her behalf. Eirini Anthi, Amir Javed, lowri Williams, pete burnap, & george theodorakopoulos

The Internet of Things (IoT) Interconnected every day objects with network connectivity, allowing them to send and receive data. IoT have access to sensitive personal information such as banking information, usernames, passwords, etc. Variety of IoT designed for different applications (fitness, smart home, etc.) Just say in 5 seconds what IoT devices are.

The Internet of Things (IoT) Say that the amount of IoT is increasing exponentioally Image 1: The amount of IoT devices is increasing exponentially

The Internet of “Evil” Things Devices are insecure. HP IoT study showed that popular IoT devices have on average 25 security vulnerabilities. These range from Heartbleed, to Denial of Service (DDoS), to weak passwords, to cross-site scripting, etc. Studies, have exposed vulnerabilities on baby monitors, smart TVs, and home automation systems. Highlight the issues of these devices. PERCEPTION | REALITY

The Internet of “Evil” Things Smart TVs have been spying on their owners. Hackers have been able to intercept content of smart cameras and baby monitors. October 16’: Mirai Botnet caused one of the largest DDoS attacks in history, bringing down Twitter, Netflix, and Spotify. April 17’: Brickerbot malware completely destroyed thousands of IoT devices. And here the Mirai bot net and Brickerbot malware. PERCEPTION | REALITY

The Internet of “Evil” Things IoT devices become more ubiquitous and transparent! Concern about the threat of unauthorized personal mobile devices, wearable tech, etc., on the network So: Can we predict malicious behavior based on network traffic? How can we detect malicious IoT devices on a network? The 2 main quetsions we have PERCEPTION | REALITY

Pulse Tool A novel predictive model that can identify malicious IoT nodes in a network based on their network activity. The model consists of two components: a) The first component is based on a Machine Learning (ML) approach (learns the networking behavior of the IoT-based network). b) The second component is a rule based approach, which is established from a security policy configured by the network administrator. The combination of these components creates an adaptive and flexible model, which accurately detects malicious IoT devices in the network More details see the poster The log file at present that we have created to conduct initial experiment contained ( time , source IP , destination IP , protocol , length , class ) which was created by carrying out attacks scan attacks (quick scan , ping scan , regular scan and intense scan) PERCEPTION | REALITY

Thank you!