Method and apparatus for compromised IoT device detection
A method and apparatus for determining one or more first devices that are Internet devices meeting all of the following conditions: residing at a given location; equipped with one or more ambience sensing capable sensors; and operation mode being such that their ambience sensing capable sensors should not cause transmission of data. One or more second devices are determined that are Internet devices at the given location and equipped with one or more elements capable of causing an ambient stimulation detectable by the sensors of one or more first devices. Data transmissions of the first devices are monitored. Issuing of the ambient stimulation is caused by a subset of the one or more second devices. It is determined whether the issuing of the ambient stimulation caused a significant change in the monitored data transmissions of the first devices.
1. An apparatus comprising at least one processor; and at least one memory including computer program code for one or more programs, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:
determine one or more first devices that are Internet devices meeting the following conditions: residing at a given location; equipped with one or more ambience sensing capable sensors; and operation mode being such that their ambience sensing capable sensors should not cause transmission of data;
determine one or more second devices that are Internet devices at the given location and equipped with one or more elements capable of causing an ambient stimulation detectable by the sensors of one or more first devices;
monitor data transmissions of the first devices;
cause issuing of the ambient stimulation by a subset of the one or more second devices; and
determine whether the issuing of the ambient stimulation caused a change in the monitored data transmissions of the first devices.
2. The apparatus of claim 1 , wherein the apparatus is further caused to perform:
maintain capability and status information of one or more of the first Internet devices, the status information comprising location and current operation mode; and
perform the determining of the one or more first devices based on the capability and status information.
3. The apparatus of claim 1 , wherein the apparatus is further caused to perform:
maintain capability and status information of one or more of the second Internet devices, the status information comprising location and current operation mode; and
perform the determining of the one or more second devices based on the capability and status information.
4. The apparatus of claim 1 , wherein the monitoring of the data transmissions of the first devices is performed continually.
5. The apparatus of claim 1 , wherein the monitoring of the data transmission of the first devices is performed at given periods of time.
6. The apparatus of claim 1 , wherein the ambient stimulation comprises an audio signal.
7. The apparatus of claim 6 , wherein the audio signal comprises a portion with a frequency in a non-audible frequency.
8. The apparatus of claim 1 , wherein the ambient stimulation comprises a light signal.
9. The apparatus of claim 8 , wherein the light signal comprises a portion with a frequency in a non-visible frequency.
10. The apparatus of claim 1 , wherein the ambient stimulation comprises a vibration signal.
11. The apparatus of claim 1 , wherein the ambient stimulation comprises movement of an object detectable by movement detection.
12. The apparatus of claim 1 , wherein the ambient stimulation comprises an electromagnetic signal.
13. The apparatus of claim 1 , wherein the ambient stimulation comprises a series of changes in the ambient properties.
14. The apparatus of claim 1 , wherein the determining of the one or more first devices is based on past activity of the Internet devices.
15. A method comprising:
determining one or more first devices that are Internet devices meeting all of the following conditions: residing at a given location; equipped with one or more ambience sensing capable sensors; and operation mode being such that their ambience sensing capable sensors should not cause transmission of data;
determining one or more second devices that are Internet devices at the given location and equipped with one or more elements capable of causing an ambient stimulation detectable by the sensors of one or more first devices;
monitoring data transmissions of the first devices using the communication interface;
causing issuing of the ambient stimulation by a subset of the one or more second devices, using the communication interface; and
determining whether the issuing of the ambient stimulation caused a significant change in the monitored data transmissions of the first devices.
16. The method of claim 15 , further comprising:
maintaining capability and status information of one or more of the first Internet devices, the status information comprising location and current operation mode; and
performing the determining of the one or more first devices based on the capability and status information.
17. The method of claim 15 , further comprising:
maintaining capability and status information of one or more of the second Internet devices, the status information comprising location and current operation mode; and
performing the determining of the one or more second devices based on the capability and status information.
18. The method of claim 15 , wherein the monitoring of the data transmissions of the first devices is performed continually.
19. The method of claim 15 , wherein the monitoring of the data transmission of the first devices is performed at given periods of time.
20. The method of claim 15 , wherein the ambient stimulation comprises an audio signal.