1. About Me Name: Yaokai Feng, from Kyushu University
Research background/interests:
Database (Ph.D. )
Pattern Recognition
Network security
My current focus
2017/3/19

2. WP6: Cloud Security for IoT
Members in KU:
(Leader) Koichi Sakurai (Prof.)
Yaokai Feng (Assist. Prof. )
Danilo Vasconcellos Vargas (Assist. Prof. )
Jiawei Su (PhD candidate)
Members in IITD Sanjiva Prasad (Prof.)
Members in UMBC Anupam Joshi (Prof.)
2017/3/19

3. (WP6: Cloud Security for IoT)
Today’s talk
Part I: Cloud System in IoT Era Part II: What we are doing now Part III: Our future work
2017/3/19

4. Part I. Cloud System in IoT Era
(WP6: Cloud Security for IoT)
Part I. Cloud System in IoT Era
2017/3/19

5. 1. Security in IoT era: more critically important
The Internet has extended to the physical world
information security
service security
physical world security
life safety
In many cases, security problems must be solved in real time
2017/3/19

6. 2. “Smart” in IoT era: multi-layered
(An example: from smart buildings to smart cities)
smart region/organization
smart building
smart
services
smart city
2017/3/19

7. 3. Centralized cloud system
service models:
Software as a service
Platform as a Service
Infrastructure as a service
… …
service contents:
storage,
computation,
… …
Not true
in IoT era
Based on two assumptions:
1) The users can wait for the processing result
2) The internet is always available when necessary
users

8. (con’t)
Many applications are time-critical tele-medicine, tele-patient-care, collision prevention of vehicles … …
Many environments have poor internet connectivity
IoT will be everywhere
Problems on privacy and security may occur having every device connected to the centralized cloud and sending raw data
They can’t afford
the roundtrip to the cloud server
more dangerous
especially for sensitive data
2017/3/19

9. 4. Cloud System in IoT Era: multi-layered
Fog
IoT devices
A large number of service centers
WP6’s task
Their security must be guaranteed
at the edge
local ingestion of data
quick turnaround of results
2017/3/19

10. Part II. What we are doing now
(WP6: Cloud Security for IoT)
Part II. What we are doing now
2017/3/19

11. SDN: often used in data centers
1. Proposing an approach to detect DDoS attacks in SDN environments
Our approach can decrease the burden of the controller
Its rough idea has been presented at:
SDN: often used in data centers
Xiang You, Yaokai Feng, Koichi Sakurai, “Packet-In message based DDoS attack detection in SDN network”,
Hinokuni Symposium, Japan, Mar 2017
Technical slides are also prepared for this workshop
We can discuss offline
2017/3/19

12. 2. Investigating possible ways to simulate the IoT environment
Simulation can enable threat-evaluations, defense strategies
3. Investigating for IOT malware analysis
2017/3/19

13. 3. Investigation for IOT malware analysis Mostly Linux based malware
Light-weight, single function
Can be distributed by telnet connection (many IOT devices using easy password which allow free access),
… …
2017/3/19

14. Part III. Our future work
(WP6: Cloud Security for IoT)
Part III. Our future work
2017/3/19

15. 2. our investigation on simulation of IoT environment
1. the study on attack detection in SDN environments
not only DDoS attack but also other attacks or anomalies
2. our investigation on simulation of IoT environment
3. Our Investigation and analysis of IoT malwares
Investigating and analyzing characteristics of IOT malwares
IOT malware classification
4. Implement novel ideas of active cyber defense for IoT
2017/3/19

16. Thank you
2017/3/19

17. Packet In message based DDoS attack detection in SDN network
Xiang You, Yaokai Feng, Koichi Sakurai
　Kyushu University　
2017/3/19

18. Related work
Packet check based All the packets are checked regardless of whether or not attacks have occurred.
Flow-entry check based The flow table is checked once in every time slot
Packet-in check based (2016) [1] When the frequency of packet-in exceeds the threshold (a trigger), all the flow-entries are collected and processed by the controller
2017/3/19

19. The latest related work [1]
Trigger
Feature
Extractor
Classifier
Attack
Alert
Flow
Collector
Frequency of
packet-in
all the flow-entries are collected and processed by the controller
Switch
Open-flow
2017/3/19

20. Our approach Statistics are made in advance
Packet In
Packet In
N packet-in
N packet-in
OpenFlow
controller
Node
Node
frequency of Packet In
entropy of source IPs
entropy of destination IPs
entropy of destination ports
… …
Packet In
OpenFlow switch
Statistics are made in advance
New features are introduced
user
user
2017/3/19