Detecting Anomalous Microflows in IoT Volumetric Attacks via Dynamic Monitoring of MUD Activity. (arXiv:2304.04987v1 [cs.CR])

IoT networks are increasingly becoming target of sophisticated new
cyber-attacks. Anomaly-based detection methods are promising in finding new
attacks, but there are certain practical challenges like false-positive alarms,
hard to explain, and difficult to scale cost-effectively. The IETF recent
standard called Manufacturer Usage Description (MUD) seems promising to limit
the attack surface on IoT devices by formally specifying their intended network
behavior. In this paper, we use SDN to enforce and monitor the expected
behaviors of each IoT device, and …

alarms attack attacks attack surface called challenges class cost cyber detection device devices dynamic effectively hard iot iot device iot devices manufacturer monitor monitoring network networks scale sdn standard target train volumetric attacks