다크넷 트래픽 기반의 알려지지 않은 IoT 봇넷 선제탐지 방안
A Preemptive Detection Method for Unknown IoT Botnet Based on Darknet Traffic
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 컴퓨팅 및 통신 기술의 발달로 인해 IoT 디바이스가 급격히 확산‧보급되고 있다. 특히 IoT 디바이스는 가정에서부터 공장에 이르기까지 그 목적에 따라 연산을 수행하거나 주변 환경을 센싱하는 등의 기능을 보유하고 있어 실생활에서의 활용이 폭넓게 증가하고 있다. 하지만, 제한된 수준의 하드웨어 자원을 보유한 IoT 디바이스는 사이버공격에 노출되는 위험도가 높으며, 이로 인해 IoT 봇넷은 악성행위의 경유지로 악용되거나 연결된 네트워크로 감염을 빠르게 확산함으로써 단순한 정보 유출뿐만 아니라 범국가적 위기를 초래할 가능성이 존재한다. 본 논문에서는 폭넓게 활용되고 있는 IoT 네트워크에서 알려지지 않은 보안위협에 선제적으로 대응하기 위해 IoT 봇넷의 네트워크 행위특징을 활용한 선제탐지 방법을 제안한다. IoT 봇넷이 접근하는 다크넷 트래픽을 분석하여 4가지 행위특징을 정의하고 이를 통해 감염의심 IP를 빠르게 선별한다. 분류된 IP는 사이버 위협 인텔리전스(CTI)를 활용하여 알려지지 않은 의심 호스트 여부를 확인한 후, 디바이스 핑거프린팅을 통해 IoT 봇넷에의 소속 여부를 최종 결정한다. 제안된 선제탐지 방법의 유효성 검증을 위해 실제 운용 중인 보안관제 환경의 다크넷 대역에 방법론 적용 및 확인 결과, 선제탐지 한 약 1,000개의 호스트가 실제 악성 IoT 봇넷임을 10개월간 추적관찰로 검증하여 그 유효성을 확인하였다.
Abstract
With development of computing and communications technologies, IoT environments based on high-speed networks have been extending rapidly. Especially, from home to an office or a factory, applications of IoT devices with sensing environment and performing computations are increasing. Unfortunately, IoT devices which have limited hardware resources can be vulnerable to cyber attacks. Hence, there is a concern that an IoT botnet can give rise to information leakage as a national cyber security crisis arising from abuse as a malicious waypoint or propagation through connected networks. In order to response in advance from unknown cyber threats in IoT networks, in this paper, We firstly define four types of We firstly define four types of characteristics by analyzing darknet traffic accessed from an IoT botnet. Using the characteristic, a suspicious IP address is filtered quickly. Secondly, the filtered address is identified by Cyber Threat Intelligence (CTI) or Open Source INTelligence (OSINT) in terms of an unknown suspicious host. The identified IP address is finally fingerprinted to determine whether the IP is a malicious host or not. To verify a validation of the proposed method, we apply to a Darknet on real-world SOC. As a result, about 1,000 hosts who are detected and blocked preemptively by the proposed method are confirmed as real IoT botnets.
참고문헌 (33)
- D. C. Nguyen, "6G Internet of Things : A Comprehensive Survey", IEEE Internet of Things Journal, 9(1), pp.359~383 (2021)
- D. Minoli, "IoT considerations, requirements, and architectures for smart buildings—Energy optimization and next-generation building management systems", IEEE Internet of Things Journal, 4(1), pp.269~283 (2017)
- K. Ogawa, "IoT device virtualization for efficient resource utilization in smart city IoT platform", 2019 IEEE International Conference on Pervasive Computing and Communications Workshops, pp.419~422 (2019)
- N. Y. Philip, "Internet of Things for In-Home Health Monitoring Systems : Current Advances, Challenges, and Future Directions", IEEE Journal on Selected Areas in Communications, 39(2), pp.300~310 (2021)
- A. H. Anwar, "Honeypot Allocation for Cyber Deception in Internet of Battlefield Things Systems", 2021 IEEE Military Communications Conference, pp.1005~1010 (2021)
- A. Shamayleh, "IoT based predictive maintenance management of medical equipment", Journal of Medical Systems, 44(4), pp.1~12 (2020)
- C. Shao, "Next-generation RF-powered networks for Internet of Things : Architecture and research perspectives", Journal of Network and Computer Applications, 128(1), pp.23~31 (2018)
- F. Chen, "IoT cloud security review : A case study approach using emerging consumer-oriented applications", ACM Computing Surveys, 54(4), pp.1~36 (2022)
- J. Kim, "Feasibility Study of 60 GHz Millimeter-Wave Technologies for Hyperconnected Fog Computing Applications", IEEE Internet of Things Journal, 4(5), pp.1165~1173 (2017)
- A. Augustin, "A study of LoRa : Long range & low power networks for the internet of things", Sensors, 16(9), pp.1~18 (2016)
- C. Shao, "Toward Ubiquitous Connectivity via LoRaWAN : An Overview of Signal Collision Resolving Solutions", IEEE Internet of Things Magazine, 4(4), pp.114~119 (2021)
- R. K. Jha, "Layer based security in narrow band Internet of Things(NB-IoT)", Computer Networks, 185 (2021)
- I. Choi, "An Easy-to-use Framework to Build and Operate AI-based Intrusion Detection for In-situ Monitoring", 2021 16th Asia Joint Conference on Information Security, pp.1~8 (2021)
- Y. Lee, "Trends on cyber threats and their countermeasure technologies in COVID-19", Review of KIISC, 31(5), pp.5~12 (2021)
- M. Antonakakis, "Understanding the mirai botnet", 26th USENIX Security Symposium, pp.1093~1110 (2017)
- B. Vignau, "10 years of IoT malware : A feature-based taxonomy", 2019 IEEE 19th International Conference on Software Quality, Reliability and Security Companion, pp.458~565 (2019)
- J. Sahota, "Mozi IoT Malware and Its Botnets : From Theory To Real-World Observations", 2021 International Conference on Computational Science and Computational Intelligence, pp.698~703 (2021)
- B. Stephens, "Detecting Internet of Things Bots : A Comparative Study", IEEE Access, 9, pp.160391~160401 (2021)
- Y. M. P. Pa, "IoTPOT: A novel honeypot for revealing current IoT threats", Journal of Information Processing, 24(3) (2016)
- J. D. Guarnizo, "Siphon : Towards scalable high-interaction physical honeypots", 3rd ACM Workshop on Cyber-Physical System Security, pp.57~68 (2017)
- Meidan, Yair, "N-baiot—network-based detection of iot botnet attacks using deep autoencoders", IEEE Pervasive Computing, 17(3), pp.12~22 (2018)
- Nishijima, Katsuya, "Verification of the Effectiveness to Monitor Darknet across Multiple Organizations", 2021 Ninth International Symposium on Computing and Networking Workshops, pp.346~351 (2021)
- 박진학, "다크넷 트래픽의 목적지 포트를 활용한 블랙 IP 탐지에 관한 연구", 정보보호학회논문지, 27(4), pp.821~830 (2017), 한국정보보호학회[DOI]
- 김규일, "효율적인 보안관제 수행을 위한 다크넷 트래픽 기반 악성 URL 수집 및 분석방법 연구", 정보보호학회논문지, 24(6), pp.1185~1195 (2014), 한국정보보호학회[DOI]
- S. Torabi, "Inferring, characterizing, and investigating internet-scale malicious IoT device activities : A network telescope perspective", 2018 48th Annual IEEE, 2018, 562~573
- F. Shaikh, "Internet of Malicious Things : Correlating active and passive measurements for inferring and characterizing internet-scale unsolicited IoT devices", IEEE Communications Magazine, 56(9), pp.170~177 (2018)
- M. S. Pour, "Sanitizing the iot cyber security posture : An operational cti feed backed up by internet measurements", 2021 51st Annual IEEE, 2021, 497~506
- F. Meneghello, "IoT : Internet of Threats? A Survey of Practical Security Vulnerabilities in Real IoT Devices", IEEE Internet of Things Journal, 6(5), pp.8182~8201 (2019)
- B. D. Davis, "Vulnerability Studies and Security Postures of IoT Devices : A Smart Home Case Study", IEEE Internet of Things Journal, 7(10), pp.10102~10110 (2020)
- Y. N. Soe, "Towards a lightweight detection system for cyber attacks in the IoT environment using corresponding features", Electronics, 9(1), pp.1~19 (2020)
- L. G. Greenwald, "Toward undetected operating system fingerprinting", 1st USENIX Workshop on Offensive Technologies, pp.1~10 (2007)
- "Malware and URL Scanner"[URL]
- "Open Threat Exchange"[URL]