title: IoT Security: From Context-based Authentication to Secure Federated Learning Anomaly Detection
Creators: name: Nguyen, Duc Thien
Publisher: name: UNSPECIFIED
Year: 2024

description: We are witnessing a rapid deployment of Internet of Things (IoT) devices in our daily lives, e.g., in smart homes, offices, factories, and infrastructure. According to Statista, the number of IoT devices is expected to increase from 8.6 billion in 2019 to 29.4 billion in 2030, resulting in an annual growth rate of 12% [1]. This emphasizes the increasing demand for a new class of applications requiring smart connectivity and intelligent features, such as robotics, home automation, autonomous transportation, and intelligent manufacturing. Unfortunately, many IoT devices are vulnerable due to insecure design, implementation, and configuration, leading to a surge in cyberattacks on IoT applications. Statista reports that the number of cyberattacks on IoT surged by 36% annually, from 32 million in 2018 to 112 million in 2022, thus, multiplying the increasing number of IoT [2]. Existing attacks often exploit insecure authentication mechanisms or employ sophisticated IoT malware at a large scale. The first line of attacks aims to intercept device communication, allowing adversaries to manipulate device communication or access sensitive IoT data. However, implementing secure authentication for IoT device pairing faces significant challenges due to the heterogeneity of IoT devices, the variety of application scenarios, and the often cumbersome requirements for user involvement. This poses the need for new pairing schemes that are IoT vendor-agnostic and do not require human intervention. However, secure pairing is not enough to protect IoT devices against large-scale attacks caused by sophisticated IoT malware. For example, infamous IoT malware like Mirai and its variants have taken control of hundreds of thousands of IoT devices in a short time and used them as bots to run the largest Distributed Denial of Service (DDoS) attack at that time, resulting in the large-scale disruption of online services, e.g., from Amazon, Netflix, and GitHub [3]. Unfortunately, existing protection methods are ineffective in capturing such novel attacks. Thus, this introduces a new line of research focused on advanced technologies such as Machine Learning (ML) which can detect sophisticated and dynamic attacks in heterogeneous IoT settings. However, ML algorithms are also susceptible to severe security and privacy attacks, including model manipulation and training data leakage. Therefore, when employing ML for security applications, it is crucial to ensure the security of the ML algorithms used. In this dissertation, we present four comprehensive solutions to secure IoT devices and Federated Learning (FL). We focus on FL because it is an emerging distributed learning paradigm used to build our IoT intrusion detection system. Firstly, we introduce a novel longitudinal context-based pairing scheme to establish secure communication between IoT devices. Further, we propose an innovative anomaly detection system that utilizes FL to identify attacks caused by IoT malware. Since FL is vulnerable to inference and backdoor attacks, we present a secure and backdoor-resilient framework for FL-based applications. Unfortunately, the world faced the severe COVID-19 Pandemic during my studies. In response, we applied our context-based authentication research to Digital Contact Tracing (DCT), aiming to break infection chains. We propose a new DCT system designed to effectively identify potential encounters with SARS-CoV-2 infected users while being resilient against large-scale security and privacy attacks. In the following, we summarize these four solutions. ConXPair2- a context-based pairing scheme. We introduce ConX Pair2, a context-based zero-interaction approach for pairing IoT devices. Our approach continuously tracks changes in context modalities, such as ambient light and noise, to evolve secure pairing keys over time. Unlike existing methods, ConXPair2 does not require tight time synchronization and offers enhanced security against Man-In-The-Middle (MITM), context guessing, and replay attacks. We also develop an advanced fingerprinting extraction technique that generates high entropy fingerprints, addressing the low entropy issue in longitudinal, passive context fingerprinting. Moreover, we conduct a systematic security analysis of context-based pairing systems, emphasizing their practical application through an empirical evaluation framework that measures security using min-entropy. This comprehensive analysis aids in understanding the robustness of context-based authentication systems in typical IoT environments. TraceCorona- a digital contact tracing system in response to the COVID-19 pandemic. Digital contact tracing plays an important role in identifying infection chains. We propose TraceCorona, a novel privacy-preserving contact tracing system based on the Diffie-Hellman key exchange, offering enhanced security and privacy compared to existing methods. The beta version of TraceCorona has been successfully used by over 2,000 users, demonstrating the effectiveness of our approach. Further, we systematically review the advantages and drawbacks of prominent DCT systems, focusing on their effectiveness, security, privacy, and ethical aspects. We identify significant security and privacy gaps in widely used systems like the Google and Apple Exposure Notification APIs. DÏoT- a federated learning-based intrusion detection system for IoT. Addressing the surge in attacks on IoT devices caused by malware, we propose DÏoT, an anomaly detection system based on our advanced network modeling approach and FL. In particular, DÏoT employs natural language processing techniques and advanced neural network algorithms to learn normal traffic patterns of IoT devices and detect deviated patterns as abnormal traffic generated by malware. Moreover, DÏoT builds a specific detection model for each device type, reducing false alarms and increasing detection accuracy. DÏoT’s effectiveness is further enhanced by utilizing FL, allowing collaborative model training of many participants without compromising participant data privacy. FLAME- a secure and backdoor-resilient federated learning framework. Tackling backdoor and inference attacks in FL, we design a backdoor-resilient FL framework that employs our adaptive noising technique to neutralize poisoned model updates. Moreover, we propose two supplemented components, dynamic clustering, and adaptive clipping, to boost poisoned update elimination while preserving model performance by reducing the required noise added to the models. Furthermore, we propose DeepSight to improve the accuracy of the FLAME clustering component in non-iid data settings by analyzing models’ internal structures to identify and remove potential poisoned updates. In addition, we develop private FLAME to prevent inference attacks by secure model updates from a semi-honest model aggregator that seeks to learn information about data training through model update inspections.

[1] https://www.statista.com/statistics/1183457/iot-connected-devices-worldwide/
[2] https://www.statista.com/statistics/1377569/worldwide-annual-internet-of-things attacks/
[3] https://en.wikipedia.org/wiki/Mirai_(malware)