IoT Network Attack Detection Using One-Class Flow Classifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network operators lack the tools to detect whether IoT devices connected to their network are behaving normally or have been compromised, as they do not know what constitutes normal behavior due to the variety of IoT devices with different functionalities and manufacturers, making them vulnerable to attacks like DoS, DDoS, and volumetric attacks.
Innovation Solution
A network attack detection process that receives and processes network traffic data to generate features for each IoT device, applies one-class flow classifiers trained on normal traffic behavior to assess if the device is under attack, and uses Manufacturer Usage Description (MUD) profiles to generate flow rules and detect anomalies, employing machine learning techniques to identify abnormal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network operators monitor all IoT devices to detect attacks, then security detection capability is improved, but system complexity increases due to the variety of devices with different functionalities and manufacturers
Solution Approach 1:
The patent segments the attack detection problem by creating device-specific one-class classifiers for each IoT device type. Each classifier is trained independently on normal traffic patterns of that specific device, allowing the system to handle device variety without requiring a single complex universal model. This segmentation approach improves detection reliability while managing system complexity through modular, device-specific analysis.
Solution Approach 2:
The patent transforms the complex problem of detecting attacks across diverse IoT devices into a standardized parameter-based approach. By extracting specific traffic flow parameters (packet counts, byte counts, flow durations, port information) and applying one-class classification on these standardized parameters, the system achieves consistent detection capability across different device types without requiring device-specific complex logic.
2Measurement precision
If traditional intrusion detection systems are used, then general security monitoring is provided, but they fail to detect attacks on specific IoT devices due to lack of device-specific normal behavior knowledge
Solution Approach 1:
The patent applies preliminary action by training one-class classifiers on normal traffic behavior data before deployment. During the training phase, the system learns what constitutes normal behavior for each IoT device type using only legitimate traffic samples. This preliminary learning enables the system to accurately detect deviations (attacks) without requiring labeled attack data, achieving high detection precision while adapting to specific device characteristics.
Solution Approach 2:
The patent segments the detection approach by creating separate one-class classifiers for different IoT device types rather than using a single generic detector. Each classifier is trained on device-specific normal traffic patterns, enabling precise detection tailored to each device's unique behavior characteristics. This segmentation improves both measurement precision and adaptability to device-specific patterns.
3Reliability
If one-class classifiers are trained on normal traffic behavior only, then false positives are reduced, but training data requirements increase
Solution Approach 1:
The patent extracts only the essential features needed for attack detection from the training data, focusing on key traffic flow parameters such as packet counts, byte counts, flow durations, and port information. By extracting and analyzing only these critical features rather than processing complete raw traffic data, the system reduces the effective training data volume requirements while maintaining high detection reliability and low false positive rates.
Data Source
AI summary
Some embodiments include a network attack detection process, including, for each of a plurality of IoT devices of a communications network: receiving corresponding network traffic data representing network traffic characteristics of a plurality of network traffic flows of the device; processing the network traffic data to generate a plurality of corresponding features for each of the network traffic flows; and applying a corresponding set of one-class flow classifiers to the generated features to classify network traffic flows of the device and assess whether the network traffic characteristics of the network traffic flows are indicative of the device being under attack or having been compromised; wherein the flow classifiers are trained with training data representing normal network traffic behaviour of the device in an uncompromised state.