Hello everyone, welcome to my presentation. I'm
Saeed and today I am going to present
our work on detecting consumer IoT devices
through the lens of an ISP. Consumer IoT devices
have grown extremely popular recently and it has
been projected that the number of deployed
IoT devices will surpass 17 billion by 2023.
These devices provide a wide range of services
from smart speakers to smart appliances, TVs and
surveillance cameras. However, it has
been shown that these devices can be exploited
and one notable example is the Mirai attack
where millions of exploited devices participated
in launching one of the largest scale DDoS
attacks at critical parts of the internet and
service providers. Moreover, these devices
can be exploited to exfiltrate private user
information without users' knowledge or consent.
These problems brings us to the question for us
as network operators, can we identify and
locate IoT devices that are connected to our
networks? These problems can be studied in
different networks from small office to campus
networks, even to large service providers.
We collaborated with an ISP of 15 million
customers and we wanted to study this problem
at the scale of an ISP. However, detecting IoT
devices at the provider level is not an
easy task. The reason is that traffic patterns
across IoT devices are diverse. There has
been some recent work that suggested that we can
deploy some agent inside the premise
of a customer, however, it's not scalable and it
is privacy intrusive as well and active
measurement approaches that won't work if the
devices are located behind the net. Moreover,
if we want to do deep packet inspection, we will
face serious privacy concerns among the
customers of an ISP. One of the readily available
data sources are flow capture utilities such
as NetFlow and IPfix. These data sources are
already collected by service providers for
their other operational purposes. These data sets
are sampled and they don't contain any
payload which means that they contain only
headers of the packets like source IP,
destination
IP and so on. This brings us to the question of
whether we can detect IoT devices using
this limited passive and sparsely sampled flow
data in the wild and if yes, at what
granularities can we detect them and how fast can
we detect them and how are IoT devices
deployed today as observed in flow data. The key
insight of our work is that devices that
we've studied have shown repeating patterns of
communication that appeared even in sparsely
sampled data. We generated detection rules using
extremely limited packet fields and
we were able to detect devices or generate rules
for detection of devices from 77% of
the study manufacturers and we detected devices
in a data set from an ISP from within minutes
to hours. We leverage the fact that IoT devices
in order to provide their services, they have
to communicate with certain backend infrastructures
and if we focus on the destinations contacted
by these devices, can we find out which of the
subscribers of this ISP have which type
of IoT device. Our methodology has five steps.
First, we generated a round-trip IoT traffic.
Second, we checked whether we can see traffic
from a single device from a single vantage
point at ISP, the data sets from an ISP. And
third, we identified which domains, IPs and
port numbers can be used to generate detection
rules for different devices. And then, of
course, we cross-checked our detection rules and
finally, we applied our methodology on
a data set from a large European ISP. Next, we
generate ground-truth IoT traffic. How
we do it? We set up two testbeds containing 56
unique IoT products from 40 vendors in
these six different categories. We trigger
devices to generate IoT traffic and next,
we connect our testbeds to a home vantage point
inside the premise of ISP and push back
the IoT traffic to the internet and capture the
IoT traffic at these different locations
as shown in the figure. We observe IoT activity
from more than 64% of devices in our testbed
in the ISP data set. The next step is to
basically identify which domains, IP addresses
and port
numbers that we have generated in the ground-truth
traffic can be used to generate detection
rules for finding IoT devices. As it's an
involved process, I'm not going into the details,
but as an overview, we have generated detection
rules for three different levels of granularity.
The finest one is the product level where we can
say what type of product it is. For
example, if it's an Amazon Echo or not. And the
next level of granularity is the manufacturer
level where we could only say it's a Samsung
device. We could only say what's manufactured.
And the worst one is the platform level where we
could only say it's an IoT device, but
we couldn't say what product or which
manufacturer it is. The generated rules account
for 77%
of the manufacturers in our testbeds. Next, we
apply our methodology on a data set from
a large unit DNIS. This ISP has more than 15
million customers. In this figure, we see
the duration of the data set that we have
observed. And in the y-axis, we see the number
of unique subscribers per hour that had the inferred
IoT device. What we see here, we
were able to detect more than 1 million
subscribers with Alexa-enabled devices. Alexa-enabled
device is a name device that responds to Amazon
Alexa voice service commands. We also observed
some journal patterns for Alexa and Samsung IoT
devices. The next question is that, what
happens if we increase our observation period?
Here, we see the same plot as previous plot,
but with a 24-hour observation period. We see
here that increasing observation period
helped detecting even more IoT devices. Next
takeaway is that we see that the number of
detected devices are stable. And there is not a
lot of fluctuations in the number of
devices. In general, we detected IoT activity for
20% of the subscribers of the ISP. Now,
if we zoom in on this 32 IoT device type, we will
have this plot. Here, in the left
part, in the y-axis, we see each individual
device. In the x-axis, again, number of devices
per day, 24 hours. And they are also categorized
according to their ranking in the Amazon ranking
in the country of ISP. For the ones that we didn't
find a ranking, they are put into other
category. What we see here is that device
popularity in the Amazon and ISP look correlated.
Our methodology has its own limitations. First,
generating rules requires studying a range
of manufacturers' products. And if the domains
and IP addresses that devices are using change,
then we have to also update the rules. And if the
devices do not show or do not have
enough activity, it will be challenging to
observe them in the sample flow data sets.
In conclusion, we have shown a methodology to
detect IoT devices based on limited sample
flow data. We detected devices from more than 77%
of studied IoT manufacturers in a large
ISP by considering minutes to hours of data, and
both popular and not so popular. In future,
we want to identify non-essential traffic
generated by IoT devices at the scale of an
ISP. If you are interested in the domains and
signatures that we have generated to detect
these devices, you can either scan this QR code
or visit the following URL. Thank you
for your attention.