Grant: Discovery Launch Supplement

The number of Internet of Things (IoT) devices is expected to reach twenty-nine billion connected devices by 2030, across different industrial sectors. These devices are increasingly diverse, and thus disrupting traditional security measures. Indeed, as it has been shown with the MIRAI attack, simple vulnerabilities (e.g., usage of default or weak passwords in IoT devices) were exploited to perpetrate a severe Distributed Denial of Service (DDoS) attack. Mobile Network Operators (MNOs) have limited control over customers' IoT devices, as the latter are usually deployed on the customer premises or scattered over wide areas. Therefore, MNOs need to deploy effective security measures at their end to protect their assets. When abnormal network traffic is detected, two solutions can be adopted: blocking the traffic, or sending it for deeper analysis. The first solution may disconnect legitimate IoT devices, as certain behaviour deviations are quite normal, such as the bandwidth fluctuations. The second solution attempts to learn more about the connected IoT devices' behaviours, generate typical models of them, and refine them continuously. This real-time and continuous learning process adapts the learned models to a changing environment, including new IoT devices, network conditions, and system events. IoT device profiling consists in detecting the profiles of the IoT devices that are connected to the network, merely by analysing the traffic they generate. By profiles, I refer to all the information that can be extracted from the traffic to identify the IoT devices uniquely and precisely. Such profiles can be used to differentiate between legitimate, faulty, and malicious IoT devices. Some IoT device profiling solutions are hardware-centric, as they focus on identifying the device hardware type. Other approaches focus on detecting the drivers that are installed on the IoT device. None of these approaches provides accurate profiles, as the same hardware or driver may be integrated into different IoT device types. There are approaches that are too specific, such as using the lock skew feature to identify the network interface type. However, these features cannot be used solely to identify malicious IoT devices but should be combined with traffic features to do so. Existing IoT device profiling solutions are designed for devices that generate substantial amounts of traffic or discontinuous traffic. However, IoT device traffic may be small and/or continuous too. Therefore, an effective IoT device profiling solution for anomaly detection should encompass all network traffic types, to draw the profile of each device and classify it as legitimate or malicious. The proposed research program aims at designing and developing novel and optimized solutions to the problem of IoT device profiling, which help detecting network anomalies. The expected results from this project will help Canadian MNOs to deploy effective IoT security solutions on their ends.