Cybersecurity Research Lab, Toronto Metropolitan University, Toronto, ON M5B 2K3, Canada.
School of IT Administration and Security, Seneca College, Toronto, ON M2J 2X5, Canada.
Sensors (Basel). 2023 Jun 2;23(11):5298. doi: 10.3390/s23115298.
IoT devices have grown in popularity in recent years. Statistics show that the number of online IoT devices exceeded 35 billion in 2022. This rapid growth in adoption made these devices an obvious target for malicious actors. Attacks such as botnets and malware injection usually start with a phase of reconnaissance to gather information about the target IoT device before exploitation. In this paper, we introduce a machine-learning-based detection system for reconnaissance attacks based on an explainable ensemble model. Our proposed system aims to detect scanning and reconnaissance activity of IoT devices and counter these attacks at an early stage of the attack campaign. The proposed system is designed to be efficient and lightweight to operate in severely resource-constrained environments. When tested, the implementation of the proposed system delivered an accuracy of 99%. Furthermore, the proposed system showed low false positive and false negative rates at 0.6% and 0.05%, respectively, while maintaining high efficiency and low resource consumption.
近年来，物联网设备越来越受欢迎。统计数据显示，2022 年在线物联网设备的数量超过 350 亿。这种快速普及的采用使得这些设备成为恶意行为者的明显目标。僵尸网络和恶意软件注入等攻击通常始于侦察阶段，在利用之前收集有关目标物联网设备的信息。在本文中，我们引入了一种基于可解释集成模型的基于机器学习的侦察攻击检测系统。我们提出的系统旨在检测物联网设备的扫描和侦察活动，并在攻击活动的早期阶段对这些攻击进行反击。所提出的系统旨在在资源严重受限的环境中高效且轻量级地运行。在测试时，所提出系统的实现准确率达到 99%。此外，所提出的系统的假阳性和假阴性率分别为 0.6%和 0.05%，同时保持高效率和低资源消耗。
