IP Library › Granted Patent US 12,218,968
Granted Patent B1
US 12,218,968 · App. 17/717,474 · Granted Feb 4, 2025

Methods and techniques for real-time detection of infected IoT devices

Inventors: Elias Bou Harb (San Antonio, TX); Morteza Safaei Pour (San Antonio, TX)
Assignee: Board of Regents, The University of Texas System
H04L63/145
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,218,968
App. No.
17/717,474
Granted
Feb 4, 2025
Kind
B1
Abstract

A method and system for detecting and analyzing internet traffic from Internet of Things (IoT) devices is presented. A network telescope is employed to collect unsolicited data packets. The data packets are analyzed to determine whether they arise from a misconfigured device or from a malicious device (darknet sanitization) or from some other source. Traffic from misconfigured devices is filtered out. The data packets from malicious devices are analyzed and a classification model is trained to classify the data packets into originating from an IoT or from a non-IoT device. The classifier is then validated on a separate set of data. The data packets originating from malicious IoT devices are further analyzed by such techniques a clustering (e.g. agglomerative hierarchical clustering), geo-location analysis, methods of attack, and coordination of attacks.

Claims (60)

1. A system comprising:

a network telescope for:

capturing a first set and a second set of unsolicited data packets sent by a first set of devices; and

probing the first set of devices for additional information;

a computer system for:

identifying a first subset of the first set of unsolicited data packets which originate from misconfigured devices of the first set of devices;

filtering out the first subset of the first set of unsolicited data packets from the first set of unsolicited data packets;

identifying a second subset of the first set of unsolicited data packets as originating from malicious devices of the first set of devices;

training a machine learning model to classify the malicious devices as Internet-of-Things (IoT) devices or non-IoT devices;

identifying a first subset of the second set of unsolicited data packets which originate from the misconfigured devices of the first set of devices;

filtering out the first subset of the second set of unsolicited data packets which originate from the misconfigured devices;

identifying a second subset of the second set of unsolicited data packets as originating from the malicious devices of the first set of devices;

applying the trained machine learning model to classify the malicious devices as IoT devices or non-IoT devices;

extracting features of the IoT devices to identify compromised IoT devices;

analyzing the compromised IoT devices and a method used to compromise the IoT devices, to generate analysis associated with the compromised IoT devices and the method used to compromise the IoT devices; and

communicating to a user the generated analysis.

2. The system of claim 1 , wherein the machine learning model comprises at least one of a random forest model, a convolutional neural network, or a multi-window convolutional neural network.

3. The system of claim 1 , wherein analyzing the compromised IoT devices comprises clustering of the IoT devices by at least one of k-means clustering, density based clustering, or agglomerative, hierarchical clustering.

4. The system of claim 1 , wherein probing for additional information comprises probing the first set of devices for at least one of an open port, an application banner, a banner response, a banner identification, a banner-based identification of a device, a scanning module, a probing rate, a location of an Internet Protocol (IP) address of a device, and an IP header field.

5. The system of claim 1 , wherein identifying a first subset of the first set of unsolicited data packets which originate from misconfigured devices and identifying a first subset of the second set of unsolicited data packets which originate from the misconfigured devices further comprises:

counting a number of unsolicited data packets which arrive from an Internet Protocol (IP) address within a predefined duration;

defining a device at the IP address as a malicious device, if the number of unsolicited data packets sent from the IP address within the predefined duration is greater than or equal to a predefined threshold; and

defining a device at the IP address as a misconfigured device, if the number of unsolicited data packets sent from the IP address within the predefined duration is less than the predefined threshold.

6. The system of claim 5 , wherein the predefined duration is 300 seconds and wherein the predefined threshold is 64.

7. The system of claim 5 , wherein identifying unsolicited data packets which originate from misconfigured devices further comprises:

calculating a probability that a misconfigured device will send the predefined threshold of unsolicited data packets to the network telescope within the predefined duration.

8. The system of claim 1 , wherein training the machine learning model further comprises accessing at least one of a database of IoT devices, a database of keywords related to IoT devices, a database of key characters related to IoT devices, a database of known compromised IoT devices and a database of known methods of compromising an IoT device.

9. The system of claim 1 , wherein analyzing the compromised IoT devices and a method used to compromise the IoT devices comprises analyzing at least one of a targeted port, a header, a banner field, an Internet Protocol (IP) address, an inter-packet arrival time, and a location.

10. The system of claim 1 , wherein analyzing the compromised IoT devices and a method used to compromise the IoT devices further comprises:

calculating, based on a set number of sequential data packets from a compromised IoT device, a probability density function of a frequency of appearance of a port of a compromised IoT device or of a port in the method used to compromise an IoT device; and

calculating an address repetition ratio based on a total number of data packets sent by a compromised IoT device or sent by the method used to compromise an IoT device divided by a number of unique destination Internet Protocol (IP) addresses.

11. A method using a network telescope and a computer system comprising the steps of:

capturing, at the network telescope, a first set and a second set of unsolicited data packets sent by a first set of devices;

probing, at the network telescope, the first set of devices for additional information;

identifying, at the computer system, a first subset of the first set of unsolicited data packets which originate from misconfigured devices of the first set of devices;

filtering out, at the computer system, the first subset of the first set of unsolicited data packets from the first set of unsolicited data packets;

identifying, at the computer system, a second subset of the first set of unsolicited data packets as originating from malicious devices of the first set of devices;

training, at the computer system, a machine learning model to classify the malicious devices as Internet-of-Things (IoT) devices or non-IoT devices;

identifying, at the computer system, a first subset of the second set of unsolicited data packets which originate from the misconfigured devices of the first set of devices;

filtering out, at the computer system, the first subset of the second set of unsolicited data packets which originate from the misconfigured devices;

identifying, at the computer system, a second subset of the second set of unsolicited data packets as originating from the malicious devices of the first set of devices;

applying, at the computer system, the trained machine learning model to classify the malicious devices as IoT devices or non-IoT devices;

extracting, at the computer system, features of the IoT devices to identify compromised IoT devices;

analyzing, at the computer system, the compromised IoT devices and a method used to compromise the IoT devices, to generate analysis associated with the compromised IoT devices and the method used to compromise the IoT devices; and

communicating, at the computer system, to a user the generated analysis.

12. The method of claim 11 , wherein the machine learning model comprises at least one of a random forest model, a convolutional neural network, or a multi-window convolutional neural network.

13. The method of claim 11 , wherein analyzing the compromised IoT devices comprises clustering of the IoT devices by at least one of k-means clustering, density based clustering, or agglomerative, hierarchical clustering.

14. The method of claim 11 , wherein probing for additional information comprises probing the first set of devices for at least one of an open port, an application banner, a banner response, a banner identification, a banner-based identification of a device, a scanning module, a probing rate, a location of an Internet Protocol (IP) address of a device, and an IP header field.

15. The method of claim 11 , identifying a first subset of the first set of unsolicited data packets which originate from misconfigured devices and identifying a first subset of the second set of unsolicited data packets which originate from the misconfigured devices further comprises:

counting a number of unsolicited data packets which arrive from an Internet Protocol (IP) address within a predefined duration;

defining a device at the IP address as a malicious device, if the number of unsolicited data packets sent from the IP address within the predefined duration is greater than or equal to a predefined threshold; and

defining a device at the IP address as a misconfigured device, if the number of unsolicited data packets sent from the IP address within the predefined duration is less than the predefined threshold.

16. The method of claim 15 , wherein the predefined duration is 300 seconds and wherein the predefined threshold is 64.

17. The method of claim 15 , wherein identifying unsolicited data packets which originate from misconfigured devices further comprises:

calculating the probability that a misconfigured device will send the predefined threshold of unsolicited data packets to the network telescope within the predefined duration.

18. The method of claim 11 , wherein training the machine learning model further comprises accessing at least one of a database of IoT devices, a database of keywords related to IoT devices, a database of key characters related to IoT devices, a database of known compromised IoT devices and a database of known methods of compromising an IoT device.

19. The method of claim 11 , wherein analyzing the compromised IoT devices and a method used to compromise the IoT devices comprises analyzing at least one of a targeted port, a header, a banner field, an Internet Protocol (IP) address, an inter-packet arrival time, and a location.

20. The method of claim 11 , wherein analyzing the compromised IoT devices and a method used to compromise the IoT devices further comprises:

calculating, based on a set number of sequential data packets from a compromised IoT device, a probability density function of a frequency of appearance of a port of a compromised IoT device or of a port in the method used to compromise an IoT device; and

calculating an address repetition ratio based on a total number of data packets sent by a compromised IoT device or sent by the method used to compromise an IoT device divided by a number of unique destination Internet Protocol (IP) addresses.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 11, 2022
From: HARB, ELIAS BOU; POUR, MORTEZA SAFAEI
To: BOARD OF REGENTS, THE UNIVERSITY OF TEXAS SYSTEM
Reel/Frame 059560/0322 →
Continuity (1)
Provisional Application 63173928 · Apr 12, 2021
References Cited (31)
US 10742674B1 · McLinden · 2020 [cited by examiner]
US 20050050353A1 · Thiele · 2005 [cited by examiner]
US 20080313734A1 · Rozenberg · 2008 [cited by examiner]
US 20140059678A1 · Parker · 2014 [cited by examiner]
US 20200322368A1 · Cohen · 2020 [cited by examiner]
US 20210258791A1 · Jochem Sanz · 2021 [cited by examiner]
US 20220191221A1 · Devaraj · 2022 [cited by examiner]
US 20220272110A1 · Agrawal · 2022 [cited by examiner]
Shaikh et al., A Machine Learning Model for Classifying Unsolicited IoT Devices by Observing Network Telescopes, Aug. 30, 2018, IEEE, 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC)… [cited by examiner]
E. Bou-Harb et al.; “Multidimensional investigation of source port 0 probing”; Digital Investigation, 11:S114-S123, 2014. [cited by applicant]
M. Pour et al.; “Stochastic modeling, analysis and investigation of iot-generated internet scanning activities”; IEEE Networking Letters, 2(3):159-163, 2020. [cited by applicant]
M. Pour et al.; “On data-driven curation, learning, and analysis for inferring evolving internet-of-things (iot) botnets in the wild”; Computers & Security, 91:101707, 2020. [cited by applicant]
M. Pour et al.; “Data-driven curation, learning and analysis for inferring evolving iot botnets in the wild”; In Proceedings of the 14th International Conference on Availability, Reliability and Security, pp. 1-10, 2019. [cited by applicant]
A. Mangino et al.; “Internet-scale insecurity of consumer internet of things: An empirical measurements perspective”; ACM Transactions on Management Information Systems (TMIS), 11(4):1-24, 2020. [cited by applicant]
M. Pour et al.; “Theoretic derivations of scan detection operating on darknet traffic”; Computer Communications, 147:111-121, 2019. [cited by applicant]
M. Safaei Pour et al.; “Implications of theoretic derivations on empirical passive measurements for effective cyber threat intelligence generation”; 2018 IEEE International Conference on Communications (ICC), pp. 1-7. I… [cited by applicant]
E. Bou-Harb et al.; “A systematic approach for detecting and clustering distributed cyber scanning”; Computer Networks 57 (18) (2013) 3826-3839. [cited by applicant]
E. Bou-Harb et al.; “Behavioral analytics for inferring large-scale orchestrated probing events”; 2014 IEEE Conference on Computer Communications Workshops (Infocom Wkshps), 2014, pp. 506-511. doi:10.1109/INFCOMW.2014.6… [cited by applicant]
M. S. Pour et al.; “Comprehending the iot cyber threat landscape: A data dimensionality reduction technique to infer and characterize internet-scale iot probing campaigns”; Digital Investigation 28 (2019) S40-S49. [cited by applicant]
S. Torabi et al.; “Inferring, characterizing, and investigating internet-scale malicious iot device activities: A network telescope perspective”; 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems… [cited by applicant]
F. Shaikh et al.; “Internet of malicious things: Correlating active and passive measurements for inferring and characterizing internet-scale unsolicited iot devices”; IEEE Communications Magazine 56 (9) (2018) 170-177. [cited by applicant]
E. Bou-Harb et al.; “A novel cyber security capability: Inferring internet-scale infections by correlating malware and probing activities”; Computer Networks 94 (2016) 327-343. [cited by applicant]
A. Dainotti et al.; “Analysis of a /0 stealth scan from a botnet”; IEEE/ACM Transactions on Networking (TON) 23 (2) (2015) 341-354. [cited by applicant]
T. D. Nguyen et al.; “Diot: A crowdsourced self-learning approach for detecting compromised iot devices”; arXiv preprint arXiv:1804.07474. [cited by applicant]
V. Thangavelu et al.; “Deft: A distributed iot fingerprinting technique”; IEEE Internet of Things Journal. [cited by applicant]
A. J. Pinheiro et al.; “Identifying iot devices and events based on packet length from encrypted traffic”; Computer Communications 144 (2019) 8-17. [cited by applicant]
S. Siby et al.; “Iotscanner: Detecting privacy threats in iot neighborhoods”; Proceedings of the 3rd ACM International Workshop on IoT Privacy, Trust, and Security, IoTPTS '17, ACM, New York, NY, USA, 2017, pp. 23-30. d… [cited by applicant]
G. Acar et al.; “Web-based attacks to discover and control local iot devices”; Proceedings of the 2018 Workshop on IoT Security and Privacy, ACM, 2018, pp. 29-35. [cited by applicant]
S. Araki et al.; “Subspace clustering for interpretable botnet traffic analysis”; ICC 2019-2019 IEEE International Conference on Communications (ICC), IEEE, 2019, pp. 1-6. [cited by applicant]
S. Ozawa et al.; “A study of iot malware activities using association rule learning for darknet sensor data”; International Journal of Information Security (2019) 1-10. [cited by applicant]
R. Agrawal et al.; “Mining association rules between sets of items in large databases”; ACM Sigmod Record, vol. 22, ACM, 1993, pp. 207-216. [cited by applicant]
Cited By (4)
US 12,381,909 US 12,549,595 US 12,615,274 US 12,719,890