Quantification of IoT attack detectability

IoT devices are trending as “easy targets” for numerous and various cyberattacks, including DDoS, ransomware, data exfiltration and cryptocurrency mining. Network intrusion detection systems (NIDSs) are a common means to detect such attacks, typically based on network traffic analysis. However, in some cases even for a modern NIDS it is hard to tell whether IoT devices are compromised, so they might remain connected to networks and pose a threat.

As part of H2020’s #CONCORDIA project, researchers from the IoT Security Research Lab at Ben-Gurion University (Israel) have begun exploring the possibility to quantify the detectability of IoT attacks. That is, given an attack scenario as well as the characteristics of an IoT device, their research objective is to estimate the ease of detecting the attack based on network traffic analysis, e.g., by a NIDS.

The first phase of this research takes an expert-based approach. It will be launched soon, and leverage the large body of cybersecurity knowledge gathered under #CONCORDIA. Stay tuned for some interesting results and insights.

(by Yair Meidan, IoT Security Research)