Various Types of Attacks and Its Detection Algorithm

Proceedings of International Conference on Advances in Science, Management and Engineering (ICASME2017) on 10& 11 February 2017, Organized by International Organization of Scientific Research and Development (IOSRD), Chennai, India

Various Types of Attacks and Its Detection Algorithm in Internet of Things (IoT): Survey Vaishnavi S1, Dr.Sethukkarasi.R2* 2

Professor, R.M.K. College of Engineering and Technology, Tamilnadu-601206, India, E-mail: [email protected] 1 Assistant Professor R.M.K. College of Engineering and Technology, Tamilnadu-601206, India, , Email: [email protected] *Corresponding author Abstract IoT is a highly dynamic and radically distributed networked system, composed of a very large number of smart objects producing and consuming information. As the objects involved in IoT are heterogenic nature and these objects communicate through Internet they give rise to many challenging research areas. One such major research challenge in IoT is Security. Securing IoT from different types of attacks is a major challenge. Now IoT is widely applied to social life applications such as smart grid, intelligent transportation, Healthcare, smart security and smart home. IoT can make the usage of all these applications easier with its technology but if it does not ensure security it may lead to major problems like leakage of personal privacy information, etc. In this paper we present a survey of different types of attacks on IoT and discuss the algorithms used to detect these attacks. Specifically we present the most common attacks like DDos attack, Sybil attacks, SIP Flooding attack, sink-hole attack and Clone attacks. Finally, we discuss the challenging research issues and future directions for Securing IoT. Keywords WSN, Internet-of-Things, Security and attacks.

I. Introduction In the last few years, the number of Internet of Things (IoT) devices in the market has increased drastically. In the next five to ten years there usage may increase three to four fold. IoT devices are attached with an array of sensors whilst also offering the means to establish a network connection, enabling the transmission of the collected information to a remote node. IoT stands the network of physical devices, vehicles, buildings and other items-embedded with sensors, actuators, electronics, software and network connectivity that allow these objects to gather and interchange data. The word internet means a distributed network and Things in the IoT sense, can refer to a wide variety of devices such as heart monitoring implants, biochip transponder on farm animals, electric clams in coastal waters, automobiles with built-in sensors. The IoT offers a wide variety of smart devices-all of which face the difficulty of securing complete privacy. As the devices are all so diverse their heterogenic nature is often used as an excuse by manufactures and owners alike to skip sufficient security controls. [5] While the IoT will make life easier, there are significant security challenges in its use. Sluggish development and limited commercialization have led some industry spectators to jump to call it as “Internet of NoThings”. Then final the technological growths made it to overcome this name. Presently it’s facing lot of security issues it’s now called as “Internet of Insecure Things”. Your data might be handled by an attack without security measures in place. Attackers can do three different tasks such as task control, steal information and disrupt services as show in Fig-1. Take control is taking control of the smart devices in IoT. For example the attacker can take control over door locks in a smart car. Steal Information is nothing but stealing the information related to the smart devices in the IoT. For example information related to the car which location and how much is travelling; engine used for it can be steeled. Disrupt services means stopping the functionality of a smart device. For example hacked vehicle control system can be used by attacker to control the breaks of the car and leading to accident. This depicts what an attacker do to a device in IoT network. Even more big disaster can happen in IoT if it’s not equipped with proper security.[16] Cisco published a white paper for public information regarding the timeline of IoT threats from the year 2000 to 2015 as shown in Fig-2. This depicts the necessity of security in IoT networks. IoT without security may be a big threat to its users. The main concern in IoT even till now is security. Because IoT systems inherently control physical systems, public

Copyrights © www.iosrd.org | All Rights Reserved

147 | Page


safety is a natural concern. In the public sector, this applies to transportation systems, electric distribution, and water treatment, as well as distribution and storage.

Fig.1: Attacks in IoT

Fig.2: Time line of IoT threats [16] II.Review of Attacks and its Detection Algorithm In this section, we review various attacks in iot, how they are secured using existing technologies is analyzed in this paper. 2.1.

Distributed Denial of Service Attack(DDoS)

Denial of Service (DoS) attack tries to disrupt the services of the network or servers. Attack will be done from a single attacker machine (Ex: SYN-FLOOD). Distributed Denial of service attacks are like DoS Attack but these attacks will originate from different attacker’s machines to target the victim. In fig-3, Masters and agents/zombies are compromised computers that run the attacker’s code. All DoS attacks can be done like DDoS. DDoS attacks can be classified in two types vulnerability attacks and Flooding attack. In vulnerability attack the attacker sends some malformed packets to the victim to confuse a protocol or an application running on it. Flooding attack involves disrupting a legitimate user, this can be done in two ways as listed below.


148 | Page


(i) Disrupt connectivity by consuming bandwidth, router processing capacity or network resources; these are essentially network/transport-level flooding attacks; (ii) Disrupt user’s services by wearing the server resources (e.g., sockets, CPU, memory, disk/database bandwidth, and I/O bandwidth); these essentially include application-level flooding attacks.

Fig.3: DDos Attack [19] Modern DDoS attacks are generated by a network which is remotely controlled by a application program commonly known as Zombies or Botnet. Zombies or Botnet computers continuously send a large amount of traffic and/or service requests to the target system. The target system either responds so slowly as to be unusable or crashes completely [2],[4]. Zombies or computers that are part of a botnet are usually recruited through the use of worms, Trojan horses or backdoors [5]–[7],[19]. They further recruit other computers and use the resources of recruited computers to perform DDoS attacks allows attackers to launch a much larger and more disruptive attack. Furthermore, it becomes more complicated for the defense mechanisms to recognize the original attacker because of the use of counterfeit (i.e., spoofed) IP addresses by zombies under the control of the attacker [8]. Proposed a framework to detect DDoS attacks, the framework uses Multivariate Correlation Analysis [1]. The detection scheme is anomaly based detection. Multivariate means multiple parameters and correlation means relationship among these parameters. The algorithm used detect is Normal profile generation algorithm which is based on Triangle Area Map (TAM) and Mahalanobis distance (MD). TAM stores all the extracted correlations in KDD cup99. MD is used to measure the dissimilarity between traffic records. The detection system contains three major steps such as basic features generation, Multivariate correlation analysis and Decision Making. Network traffic is given as input to the framework; in first step basic feature generated for individual records from networks traffic, MCA is done with TAM. For TAM raw features and normalized features are given as input. In the last step detection is done which involves two steps training and testing phases.

Fig.4: Attack detection [6]


149 | Page


The dissimilarity between a new incoming traffic record and the respective normal profile is measures by the detector. If the dissimilarity is greater than a predetermined threshold, the traffic record is detected as an attack. Otherwise, it is considered as a legitimate traffic record as shown in Fig-4. 2.2.

SIP Flooding Attack

Session Initiation Protocol (SIP) is utilized for monitoring multimedia communication sessions above the Internet Protocol (IP). It is among the most severe attacks it is easy to launch and capable of quickly draining the resources of both networks and nodes. The attack disrupts perceived quality of service (QoS) and subsequently leads to denial of service (DoS). In fig-5, SIP is configured to operate in authenticated mode. SIP is vulnerable to flooding attacks. A typical attack would be an INVITE flood. SIP with authentication is more vulnerable to flooding attacks.

Fig.5: SIP Protocol

A novel SIP attack detection method by using a three-dimensional sketch design and Hellinger distance (HD) is presented [2]. The basic idea is to control the sketch distribution of normal traffic with a sketch distribution key (SD-key). The sketch can set a target sketch distribution, which is independent of the hash function and kept as confidential secrets to the SIP server. When a normal user applies for the SIP service, an SD-key will be calculated to bond the hash output together with the confidential sketch distribution. Later when a normal user makes a SIP call, it needs to offer its SD-key to the server based on which its sketch entry is calculated. In the online operation the SD-key design can always shape the normal traffic into the target sketch distribution and effectively detect the flooding under the all-space attack.

Fig.6: Estimation Freeze Mechanism [2]


150 | Page


Estimated Freeze algorithm is used to freeze the threshold. An attack is declared when the HD obtained from a certain element hash-row exceeds the threshold, as shown in Fig-6. A low HD value implies that there is no significant deviation in the current traffic observations and a high HD is a strong indication that anomalies have happened. 2.3.

Sybil Attack

In the Sybil attack, a malicious node performs as if it were a more number of nodes, for example by imitating other nodes or simply by demanding false identities as shown in fig-7. The Sybil node uses different identities A, B, C and D, imitates as other nodes.

Fig.7: Sybil Attack [18] Three types of Sybil attacks can take place in IoT: SA-1, SA-2, and SA-3. SA-1 is considered to have a limited number of connections with normal users in the social graph, whereas SA-2 is considered to build many such social connections. Therefore, SA-2 is difficult to be distinguished by using social graph partition. SA-3 is considered in mobile networks, where the social graph information is not available, and cannot be easily detected. To cover a broad range of the existing Sybil attacks three types of Sybil defense schemes exist: 1) Social graph based Sybil detection (SGSD) 2) Behavior classification-based Sybil defense and 3) Mobile Sybil defense (MSD). In SGSD the honest node H will label any other node as either as “Sybil” S or “honest H,” or detect SA-1 according to community detection. Consequently, there are mainly two types of SGSD: social network-based Sybil detection (SNSD) and social community-based detection (SCSD), respectively. SNSD is a Sybil defense based on “social network,” which is a social structure linking social relationships among nodes. SybilGuard is a famous SNSD scheme used to detect Sybil attacks which is based on random walk. Sybilguard is a robust protocol, which reduces the impact of Sybil attacks in social networks by using the following principles. Principle-1: Sybilguard considers the P2P or node-to-node structure in social networks to overcome these attacks. Principle-2: In social networks, each user is considered as a node and we assume that all the nodes (honest and Sybil) together form the social graph. Principle-3: In social networks, an edge is said to be formed if a relationship exists between two nodes. If a relationship is formed between an honest node and a Sybil node, the edge is called as an Attack edge. SybilDefender is a typical SCSD scheme, which relies on performing a limited number of random walks for Sybil identification and community detection. The algorithm uses two steps (i) To find a Sybil node, and (ii) To find the region surrounding the Sybil node which is assumed to be the Sybil community. The assumption is built on the fact that the numbers of attack edges are limited, i.e. the number of Sybil identities are negligible when compared to honest identities, and also the honest region is fast mixing, i.e. nodes in the honest region converge very fast when compared to Sybil region.


151 | Page


2.4.

Sinkhole Attack

In order to use the more frequently route, attacker misdirects the route between base station and its neighbors. Sinkhole attack is a malicious node which reason severe threat to Wireless sensor network. Attacker captivates other nodes which are near to sinkhole than to the base station which a route with the less hope distance is presented to mislead its neighbors that forward all the traffic.

Fig.8: Sinkhole Attack [10] The sink hole attack detection mechanism contains two steps [20] (i) Estimating the Attacked Area and (ii) Identifying the Intruder. (i) In many sensor network applications, nodes are responsible for collecting local data and sending them to the BS. The most common kind of violations in a sinkhole attack is selective forwarding. By observing consistent data missing from an area, the BS may suspect there is attack with selective forwarding. After identifying a list of the suspected nodes, the BS can estimate where the sinkhole locates. Specifically, it can circle a potential attacked area, which contains all the suspected nodes. (ii) Since the attacked area may contain many nodes, and the sinkhole is not necessarily the center of the area, it is better to further locate the exact intruder and isolate it from the network. This can be achieved through analyzing the routing pattern in the affected area. 2.5.

Clone Attack

In the attack an attackers detention a node and abstract its cryptographic secrets and create duplicates of this node in the complete networks due to this an attacker can simply misguide the packets. These clone node attacks very hazardous to the process of sensor networks. By capturing single node, the challenger can generate as many replicas nodes organized by the adversary. [11] These nodes look like certified participants in the network so it is very hard to detect a clone attack. In fig-9 node ‘a’ has be capture by attacker and created replicas node of it “a I ”. Then result of two paths passed to different locations.

Fig.9: Clone Attack [11]


152 | Page


RED (Randomized, Efficient, and Distributed) algorithm is used to detect the clone attack [12].Generates a unique ID to each node in a group of sensor nodes which makes that as original node. Cluster head is designated in each cluster. ID broadcasted to all neighbor nodes with a private key which is verified at the destination end. It is checked by cluster head in base station to detect clone attack. 2.6.

Other Attacks

 Wormhole Attack Wormhole can attract and avoid a huge amount of network traffic and achieve manipulation. An attacker creates tunnel between two distant nodes in the network by an in/out-of-band channel which is designed by a pair of attackers. This tunnel provides two distant locations a misinterpretation that they are near to each other. 

Black hole Attack

Black hole attack is a malicious node can attract total packets by misleadingly requesting a fresh route to the destination. Then engage them without promoting them to the destination. Supportive Black hole means the malicious nodes deed in a network. It occurs when intruder arrests and block the packet that they don’t to destination node which re-program some nodes in the network. Black hole, Misdirection, Wormhole and sinkhole attacks are detected using Hybrid Anomaly detection Kmeans clustering algorithm. [7] The proposed scheme contains two phases such as offline and online phases. Offline phases contains of trained data after pre-processing which remove the outliers data points from traffic data using outliers detection and removal algorithm. Online phase will test dataset from network traffic after pre-processing. The testing dataset is fed into K-means clustering system which is used for clustering traffic parameters. Its output feds into Hybrid Anomaly Detection and post mining algorithm based on cluster nodes (CH). Each CH in a cluster detects whether a member in that cluster is a Blackhole node or Misdirection node or Collaboration of Misdirection node.  Selective Forward Attack In this attack an attacker encompass itself in a data stream lane and can selectively drop only distinct packets. In sensor networks it is supposed that nodes faithfully forward received messages but some neighbour node might decline to forward packets, over neighbours may start by another route. Fig10,in the network packets are passed in selective but one node which drops the packets and delay to forward it to neighbour node. Selective Forwarding Detection (SFD) Algorithms [14] is used to detect Selection Forward Attack which consists of multi-layer detection framework of three layers by a different algorithm.  Hello Flood Attack In the network, each new node sends “Hello messages” to discovery its neighbor nodes. Also, it broadcast its route to the base station. Other nodes may choose to route data through this new node if the path is smaller. Adapting detection algorithm [15] is used to detect hello flood attack. III. Issues This is section discussed about various performance issues of detection algorithms as shown in Table-1. From the table its evident that there is no complete framework to detect the different types of attacks. By using one framework for one attack and another framework for other attacks, the overall performance of the networks reduces as the each framework takes time for its initialization and operation. An Integrated framework is needed which detects the different types of attacks. Presently there is no complete framework to handle various types of attacks in IoT. All existing algorithm handles one or two type of attacks. The detection rate decreases as the traffic increases or number of attacks increases or type of attacks increases. In general the performance of any attack detection algorithm is measured using four basic metrics namely Detection rate (DR), False-Positive Rate (FPR), True-Negative rate (TNR) and Accuracy rate (AR). The detection rate corresponds to the ability of the system to detect an attack and the higher the value of DR, the better the detection system is. A false positive error, or in short false positive, commonly called a "false alarm", is a measure of how often a detected attack is in fact not an attack. True positive rate, measures the proportion of positives that are correctly identified as attacks. Accuracy rate is the portion of overall samples which are classified correctly.


153 | Page


Table 1: Performance analysis of attack Detection Algorithms IV. Conclusion Internet of Things (IoT) is vulnerable due to many types of attacks and IoT cannot be used in our day to day life without security. IoT without security makes our life miserable, but IoT with security makes our life much easier and simpler. In this paper we highlighted the security needs of IoT and made a survey on different types of attacks and detection methods. Presently there is no complete framework to handle various types of attacks in IoT. The detection rate decreases as the traffic increases or number of attacks increases or type of attacks increases. This survey leads to the necessity of a complete framework to make IoT secure from different types of attacks. We hope that this survey will open new research ideas to secure IoT from different types of attacks. References [1] Zhiyuan Tan, Aruna Jamdagni, Xiangjian He, Priyadarsi Nanda, "A System for Denial-of-Service Attack Detection Based on Multivariate Correlation Analysis", IEEE Transactions On Parallel And Distributed Systems, Vol. 25, No. 2, February 2014. [2] Jin Tang, Yong Hao and Wei Song, "SIP Flooding Attack Detection with a Multi-Dimensional Sketch Design", IEEE Transactions on Dependable and Secure Computing, 2013. [3] Wu, Zhigang Zhao, Feng Bao, and Robert H. Deng, "Software Puzzle: A Countermeasure to ResourceInated Denial-of-Service Attacks", IEEE Transactions On Information Forensics And Security, Vol. 10, No. 1, January 2015. [4] Nadav Schweitzer, Ariel Stulman, Asaf Shabtai, and Roy David Margalit, "Mitigating Denial of Service Attacks in OLSR Protocol Using Fictitious Nodes", IEEE Transactions On Mobile Computing, Vol. 15, No. 1, January 2016. [5] Qi Jing,Athanasios V. Vasilakos,Jiafu Wan, Jingwei Lu,Dechao Qiu, "Security of the Internet of Things: perspectives and challenges", Springer 2014. [6] Daniele Miorandi,Sabrina Sicari, Francesco De Pellegrini, Imrich Chlamtac, "Internet of things: Vision, applications and research challenges", Adhoc Networks, Elsevier 2012 [7] Mohammad Wazid, Ashok Kumar Das, "An Efficient Hybrid Anomaly Detection Using K-Means Clustering for Wireless Sensor Networks", Springer 2016 [8] Mikhail Zolotukhin, Timo Hämäläinen, Tero Kokkonen,Antti Niemeland Jarmo Siltanen, "Data Mining Approach for Detection of DDoS Attacks Utilizing SSL/TLS Protocol", Springer 2015 [9] B. M. Aslahi-Shahri,R. Rahmani,M. Chizari,A. Maralani,M. Eslami, M. J. Golkar,A. Ebrahimi, "A hybrid method consisting of GA and SVM for intrusion detection system", Springer 2015 [10] Alampallam Ramaswamy Vasudevan, Subramanian Selvakumar, "Local outlier factor and stronger one class classifier based hierarchical model for detection of attacks in network intrusion detection dataset", Springer 2016. [11] Jun-WonHo, Donggang Lin ,Matthew Wright, Sajai K.Das, ”Distributed detection of replicas with deployment knowledge in wireless sensor networks”, Preprint submitted to Elsevier,March,2009.


154 | Page


[12] Mauro Conti, Roberto Di Pietro, Luigi Vincenzo Mancini and Alessandro Mei, Distributed Detection of Clone Attacks in Wireless Sensor Networks, IEEE transactions on dependable and secure computing, vol. 8, no. 5, september/october 2011. [13] Udaya Suriya Raj Kumar Dhamodharan and Rajamani Vayanaperumal, Detecting and Preventing Sybil Attacks in Wireless Sensor Networks Using Message Authentication and Passing Method, Scientific World Journal Volume 2015, Article ID 841267. [14] Naser Alajmi and Khaled Elleithy, Multi-Layer Approach for the Detection of Selective Forwarding Attacks, sensors 2015, ISSN 1424-8220. [15] H. Khosravi, R. Azmi, and M. Sharghi, Adaptive Detection of Hello Flood Attack in Wireless Sensor Networks, International Journal of Future Computer and Communication, Vol. 5, No. 2, April 2016. [16] D. Evans, “The internet of things - how the next evolution of the internet is chaging everything,” White Paper. Cisco Internet Business Solutions Group (IBSG), 2011. [17] J. Mirkovic and P. Reiher, A taxonomy of DDoS attack and DDoS defense mechanisms, ACM SIGCOMM Computer Communications Review, vol. 34, no. 2, pp. 39-53, April 2004. [18] Kuan Zhang,Xiaohui Liang,and Xuemin Shen, "Sybil Attacks and Their Defenses in the Internet of Things", Ieee Internet of things journal, vol. 1, no. 5, october 2014 [19] Saman Taghavi Zargar,James Joshi and David Tipper,"Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks", IEEE Communications surveys & tutorials, vol. 15, no. 4, fourth quarter 2013. [20] Edith C. H. Ngai, Jiangchuan Liu,and Michael R. Lyu, "On the Intruder Detection for Sinkhole Attack in Wireless Sensor Networks ",2006 IEEE International Conference Prceedings


155 | Page

Various Types of Attacks and Its Detection Algorithm

Various Types of Attacks and Its Detection Algorithm

Suggest Documents

various types of slabs

Review of Botnet Attacks and its Detection Mechanism - IJIRCCE

Review of Botnet Attacks and its Detection Mechanism - IJIRCCE

Detection of hepatocellular carcinoma and its metastases with various

ALGORITHM AND TECHNIQUE ON VARIOUS EDGE DETECTION: A ...

algorithm and technique on various edge detection - Aircc Digital Library

Various Security Attacks and Trust Based Security

Internet Epidemics: Attacks, Detection and

Types of Fraud Attacks - Port Clinton PD

Detection, Correlation, and Visualization of Attacks ... - CiteSeerX

Detection, Correlation, and Visualization of Attacks ... - CiteSeerX

detection and classification of ddos attacks

Detection, Correlation, and Visualization of Attacks ... - CiteSeerX

Online Detection and Prevention of Phishing Attacks

Detection, Correlation, and Visualization of Attacks ... - CiteSeerX

Economy - Its Meaning and Types

Unorganized Malicious Attacks Detection

EFFECTS OF VARIOUS FLOW TYPES ON MATERNAL ...

Some features distinguishing various types of ...

FLOWS WITH VARIOUS TYPES OF SHADOWING

ions by various types of chitosan beads

Closed-Line Integral Optimization Edge Detection Algorithm and Its

Summarization of Various Security Aspects and Attacks in Distributed ...

Summarization of Various Security Aspects and Attacks in Distributed ...