Department of Computer Science and Engineering, Seoul National University of Science and Technology (SeoulTech), Seoul 01811, Korea.
Sensors (Basel). 2022 Aug 16;22(16):6133. doi: 10.3390/s22166133.
Resource constraints in the Industrial Internet of Things (IIoT) result in brute-force attacks, transforming them into a botnet to launch Distributed Denial of Service Attacks. The delayed detection of botnet formation presents challenges in controlling the spread of malicious scripts in other devices and increases the probability of a high-volume cyberattack. In this paper, we propose a secure Blockchain-enabled Digital Framework for the early detection of Bot formation in a Smart Factory environment. A Digital Twin (DT) is designed for a group of devices on the edge layer to collect device data and inspect packet headers using Deep Learning for connections with external unique IP addresses with open connections. Data are synchronized between the DT and a Packet Auditor (PA) for detecting corrupt device data transmission. Smart Contracts authenticate the DT and PA, ensuring malicious nodes do not participate in data synchronization. Botnet spread is prevented using DT certificate revocation. A comparative analysis of the proposed framework with existing studies demonstrates that the synchronization of data between the DT and PA ensures data integrity for the Botnet detection model training. Data privacy is maintained by inspecting only Packet headers, thereby not requiring the decryption of encrypted data.
工业物联网 (IIoT) 中的资源限制导致暴力攻击，将其转化为僵尸网络以发起分布式拒绝服务攻击。僵尸网络形成的延迟检测给控制其他设备中恶意脚本的传播带来了挑战，并增加了大规模网络攻击的可能性。在本文中，我们提出了一个安全的区块链支持的数字框架，用于在智能工厂环境中早期检测 Bot 形成。为边缘层上的一组设备设计了一个数字孪生 (DT)，以使用深度学习收集设备数据并检查数据包头，以查找具有开放连接的外部唯一 IP 地址的连接。数据在 DT 和数据包审核器 (PA) 之间进行同步，以检测损坏的设备数据传输。智能合约对 DT 和 PA 进行身份验证，确保恶意节点不参与数据同步。使用 DT 证书吊销来防止僵尸网络的传播。通过与现有研究的比较分析，证明了 DT 和 PA 之间的数据同步确保了 Botnet 检测模型训练的数据完整性。通过仅检查数据包头来维护数据隐私，因此不需要对加密数据进行解密。
