Search

Game Theoretic Approach Toward Detection of Input-Driven Evasive Malware in the IoT

Game Theoretic Security Analysis against Input-Driven Evasive Malware in the IoT

In the internet, a worm is usually propagated in a random multi-hop contact manner. However, the attacker will not likely select this random multi-hop propagation approach in a mobile sensor network. This is because multi-hop worm route paths to random vulnerable targets can be often breached due to node mobility, leading to failure of fast worm spread under this strategy. Therefore, an appropriate propagation strategy is needed for mobile sensor worms. To meet this need, we discuss a hop-by-hop worm propagation model in mobile sensor networks. In a hop-by-hop worm propagation model, benign nodes are infected by worm in neighbor-to-neighbor spread manner. Since worm infection occurs in hop-by-hop contact, it is not substantially affected by a route breach incurred by node mobility. We also propose the carryover epidemic model to deal with the worm infection quota deficiency that might occur when employing an epidemic model in a mobile sensor network. We analyze worm infection capability under the carryover epidemic model. Moreover, we simulate hop-by-hop worm propagation with carryover epidemic model by using an ns-2 simulator. The simulation results demonstrate that infection quota carryovers are seldom observed where a node’s maximum speed is no less than 20 m/s.

Due to the wide spread of android smartphones, different types of attacks have emerged against android systems and accordingly many researches have been accomplished in the android security. In particular, a variety of covert channels have been recently developed in android systems. They are usually built up by utilizing physical media and distinct characteristics of systems in the literature. To the best of our information, however, we do not find out any research work establishing covert channels in android systems on basis of the sequential analysis, which is a kind of statistical decision theory. This is mainly because the sequential analysis has been conventionally treated as defense technique in terms of security. In contrast to this common application of the sequential analysis, we discover a new covert channel based on the sequential analysis in android systems. The key idea of newly devised covert channel is to harness the sequential analysis in order to encode (resp. decode) private information bits to (resp. from) multiple sequences of randomly selected data. Through simulation, we demonstrate that our developed covert channel works efficiently and thus it could be substantial threat to android systems.

With the Internet of Things (IoT), the prevalence of wirelessly connected, low-resource devices could mean many poorly secured targets for attackers. Automated attacks, such as worms, may be particularly prevalent threats. An IoT worm may have trouble, however, with robust and stealthy propagation in such lossy wireless networks with lower resource nodes. To mitigate this problem, we propose a split-pipeline model, in which worm codes are broken into multiple fragments and propagated in a fragment-by-fragment manner, where the reassembled fragments can be used to infect benign nodes. Secret sharing is used for the split-reassemble process, since it both conceals the codes and allows for full recovery of the code even if some fragments are lost in transmission under lossy wireless networks. Furthermore, each fragment of the worm code is transmitted in a pipeline architecture for faster propagation.

Due to the unattended nature of wireless sensor networks, an adversary can physically capture and compromise sensor nodes and then mount a variety of attacks with the compromised nodes. To minimize the damage incurred by the compromised nodes, the system should detect and revoke them as soon as possible. To meet this need, researchers have recently proposed a variety of node compromise detection schemes in wireless ad hoc and sensor networks. For example, reputation-based trust management schemes identify malicious nodes but do not revoke them due to the risk of false positives. Similarly, software-attestation schemes detect the subverted software modules of compromised nodes. However, they require each sensor node to be attested periodically, thus incurring substantial overhead. To mitigate the limitations of the existing schemes, we propose a zone-based node compromise detection and revocation scheme in wireless sensor networks. The main idea behind our scheme is to use sequential hypothesis testing to detect suspect regions in which compromised nodes are likely placed. In these suspect regions, the network operator performs software attestation against sensor nodes, leading to the detection and revocation of the compromised nodes. Through quantitative analysis and simulation experiments, we show that the proposed scheme detects the compromised nodes with a small number of samples while reducing false positive and negative rates, even if a substantial fraction of the nodes in the zone are compromised. Additionally, we model the detection problem using a game theoretic analysis, derive the optimal strategies for the attacker and the defender, and show that the attacker's gain from node compromise is greatly limited by the defender when both the attacker and the defender follow their optimal strategies.

In wireless sensor networks, sensor nodes are usually fixed to their locations after deployment. However, an attacker who compromises a subset of the nodes does not need to abide by the same limitation. If the attacker moves his compromised nodes to multiple locations in the network, such as by employing simple robotic platforms or moving the nodes by hand, he can evade schemes that attempt to use location to find the source of attacks. In performing DDoS and false data injection attacks, he takes advantage of diversifying the attack paths with mobile malicious nodes to prevent network-level defenses. For attacks that disrupt or undermine network protocols like routing and clustering, moving the misbehaving nodes prevents them from being easily identified and blocked. Thus, mobile malicious node attacks are very dangerous and need to be detected as soon as possible to minimize the damage they can cause. In this paper, we are the first to identify the problem of mobile malicious node attacks, and we describe the limitations of various naive measures that might be used to stop them. To overcome these limitations, we propose a scheme for distributed detection of mobile malicious node attacks in static sensor networks. The key idea of this scheme is to apply sequential hypothesis testing to discover nodes that are silent for unusually many time periods-such nodes are likely to be moving-and block them from communicating. By performing all detection and blocking locally, we keep energy consumption overhead to a minimum and keep the cost of false positives low. Through analysis and simulation, we show that our proposed scheme achieves fast, effective, and robust mobile malicious node detection capability with reasonable overhead.

By exploiting the unattended nature of the wireless sensor networks, an attacker can physically capture and compromise sensor nodes and then launch a variety of attacks. He can additionally create many replicas of a few compromised nodes and spread these replicas over the network, thus launching further attacks with their help. In order to minimize the damage incurred by compromised and replicated nodes, it is very important to detect such malicious nodes as quickly as possible. In this review article, we synthesize our previous works on node compromise detection in sensor networks while providing the extended analysis in terms of performance comparison to the related work. More specifically, we use the methodology of the sequential analysis to detect static and mobile compromised nodes, as well as mobile replicated nodes in sensor networks. With the help of analytical and simulation results, we also demonstrate that our schemes provide robust and efficient node compromise detection capability.

Due to the unattended nature of wireless sensor networks, an adversary can capture and compromise sensor nodes, make replicas of them, and then mount a variety of attacks with these replicas. These replica node attacks are dangerous because they allow the attacker to leverage the compromise of a few nodes to exert control over much of the network. Several replica node detection schemes have been proposed in the literature to defend against such attacks in static sensor networks. However, these schemes rely on fixed sensor locations and hence do not work in mobile sensor networks, where sensors are expected to move. In this work, we propose a fast and effective mobile replica node detection scheme using the Sequential Probability Ratio Test. To the best of our knowledge, this is the first work to tackle the problem of replica node attacks in mobile sensor networks. We show analytically and through simulation experiments that our scheme detects mobile replicas in an efficient and robust manner at the cost of reasonable overheads.

Several protocols have been proposed to mitigate the threat against wireless sensor networks due to an attacker finding vulnerable nodes, compromising them, and using these nodes to eavesdrop or undermine the operation of the network. A more dangerous threat that has received less attention, however, is that of replica node attacks, in which the attacker compromises a node, extracts its keying materials, and produces a large number of replicas to be spread throughout the network. Such attack enables the attacker to leverage the compromise of a single node to create widespread effects on the network. To defend against these attacks, we propose distributed detection schemes to identify and revoke replicas. Our schemes are based on the assumption that nodes are deployed in groups, which is realistic for many deployment scenarios. By taking advantage of group deployment knowledge, the proposed schemes perform replica detection in a distributed, efficient, and secure manner. Through analysis and simulation experiments, we show that our schemes achieve effective and robust replica detection capability with substantially lower communication, computational, and storage overheads than prior work in the literature.

Wireless sensor networks are vulnerable to sensor worm attacks in which the attacker compromises a few nodes and makes these compromised nodes initiate worm spread over the network, targeting the worm infection of the whole nodes in the network. Several defense mechanisms have been proposed to prevent worm propagation in wireless sensor networks. Although these proposed schemes use software diversity technique for worm propagation prevention under the belief that different software versions do not have common vulnerability, they have fundamental drawback in which it is difficult to realize the aforementioned belief in sensor motes. To resolve this problem, we propose on-demand software-attestation based scheme to defend against worm propagation in sensor network. The main idea of our proposed scheme is to perform software attestations against sensor nodes in on-demand manner and detect the infected nodes by worm, resulting in worm propagation block in the network. Through analysis, we show that our proposed scheme defends against worm propagation in efficient and robust manner. Through simulation, we demonstrate that our proposed scheme stops worm propagation at the reasonable overhead while preventing a majority of sensor nodes from being infected by worm.

Wireless sensor networks are known to be vulnerable to various attacks that could impair normal operations. This is mainly due to the fact that sensor nodes are often deployed in an unattended manner, and thus an adversary is able to physically capture and compromise them, launching a variety of attacks with the help of compromised nodes. To reduce the damages, it is imperative to root out the compromised nodes. To this need, this chapter deals with a framework for robust detection and revocation of node compromise in wireless sensor networks. In the framework, we consider the limited and wide-spread node compromise attacks. In the limited attack, an attacker physically captures a few nodes and compromises them. He can also move the compromised nodes to multiple locations to escape the detection. To combat against the limited node compromise attacks, we propose static and mobile node compromise detection schemes in static sensor networks. More specifically, we perform trust management per region and quickly detect the suspected regions. We then perform software attestations against the nodes in the suspected regions, leading to the detection and revocation of the compromised nodes. However, if an adversary moves the compromised nodes to multiple locations in the network, he can make the compromised nodes evade the region-based detection scheme. To mitigate this limitation, we detect mobile malicious nodes by leveraging the intuition that such nodes are silent for unusually many time periods when they freely roam throughout the network. In the wide-spread attack, on the other hand, an attacker can generate wide-spread impact by producing many replica nodes of a few compromised nodes and widely disseminate them over the network, thereby saving the time and effort incurred by physically capturing and compromising many benign nodes. To fight against the wide-spread attacks, we propose replica detection schemes in both static and mobile sensor networks. In particular, we detect static replica nodes by exploiting the fact that static replica nodes are placed in more than one location. We also quickly detect mobile replicas because they are in two or more locations at once and thus appear to move much faster than benign nodes, leading them to exceed the predefined maximum speed with most likelihood.We evaluate each of the proposed schemes that achieve high node compromise detection capability with little or moderate overhead while rarely misidentifying benign nodes as the compromised nodes.

Wireless sensor networks are vulnerable to node capture attacks because sensor nodes are usually deployed in unattended manner. Once attacker captures sensor nodes, he can compromise them and launch various types of attacks with those compromised nodes. Therefore, node capture attacks are hazardous and should be detected as soon as possible to reduce the harm incurred by them. To meet this need, we propose a node capture detection scheme in wireless sensor networks. Our scheme detects the captured sensor nodes by using the sequential analysis. We analytically show that our scheme detects node capture attacks in robust and efficient manner.

Due to the unattended nature of wireless sensor networks, an adversary can physically capture and compromise sensor nodes and then mount a variety of attacks with these compromised nodes. To minimize the damage incurred by compromised nodes, the system should detect and revoke them as soon as possible. To meet this need, we propose a zone-based node compromise detection and revocation scheme in sensor networks. The main idea of the proposed scheme is to use the sequential hypothesis testing to detect suspect regions in which compromised nodes are likely placed. In these suspect regions, the network operator performs software attestation against sensor nodes, leading to the detection and revocation of the compromised nodes. Through analysis and simulation, we show that the proposed scheme provides effective and robust node compromise detection and revocation capability with little overhead.

Due to the unattended nature of wireless sensor networks, an adversary can capture and compromise sensor nodes, generate their replicas, and thus mount a variety of attacks with these replicas. Such attacks are dangerous because they allow the attacker to leverage the compromise of a few nodes to exert control over much of the network. Several replica node detection schemes have been proposed in the literature to defend against such attacks in static sensor networks. However, these schemes rely on fixed sensor locations and hence do not work in mobile sensor networks, where sensors are expected to move. In this work, we propose a fast and effective mobile replica node detection scheme using the Sequential Probability Ratio Test. To the best of our knowledge, this is the first work to tackle the problem of replica node attacks in mobile sensor networks. We show analytically and through simulation experiments that our scheme provides effective and robust replica detection capability with reasonable overheads.