Data-driven Intelligent Attack Detection in Multilateral, Large-Scale and Heterogeneous Internet of Things Environments

多边、大规模、异构物联网环境中数据驱动的智能攻击检测

• 批准号: RGPIN-2020-04707
• 负责人: AbdulWahab, Omar
• 金额: $ 1.75万
• 依托单位: École Polytechnique de Montréal
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2022
• 资助国家: 加拿大
• 起止时间: 2022-01-01 至 2023-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=757368
• 关键词: Data; driven; Intelligent; Attack; Detection

The main idea of the Internet of Things (IoT) is to enable devices (e.g., smart vehicles, home gadgets, etc.) to sense the environment, collect pertinent data, analyse these data and make some actions based on the extracted insights. Such devices often possess low processing capabilities and limited memory and storage capacity. Cloud computing has always been the main backbone that IoT devices rely on to accommodate their storage and analytical needs. However, the fact that cloud servers are often deployed in locations that are quite far from the IoT devices and the emergence of delay-critical IoT applications urged the need for extending the cloud architecture to support delay-critical services. In this context, the concept of fog computing has been proposed to provide data analytics and decision-making closer to the IoT devices. The above-described IoT multi-player architecture is likely to be faced with non-conventional security challenges due to the multi-lateral, heterogeneous and large-scale nature of this environment which consists of billions of IoT, fog and cloud devices of different types and sizes. Our long-term goal of this research program is to improve the efficiency of detecting advanced attack patterns in the IoT-fog-cloud environments. The novelty of this research program lies in studying the security of the IoT in a comprehensive multilateral environment wherein the IoT, fog and cloud layers coexist and interact, thus considering new non-conventional vulnerabilities and threats. The proposed research program spans over three main research tracks, which are: (1) big data analytics for attack recognition in which deep and ensemble learning approaches will be designed and implemented to recognize advanced attack patterns; (2) multi-sided trust establishment in which multi-sided (i.e., IoT-to-fog, fog-to-IoT, IoT-to-cloud, cloud-to-IoT, fog-to-cloud and cloud-to-fog) trust establishment solutions will be investigated to improve the security of the communication channels among these different coexisting parties; and (3) data-driven cyber-security decision-making in which data-driven mathematical models that capitalize on the insights extracted from the data analytics and trust tracks will be designed to help security administrators effectively counter attackers' wily strategies and efficiently deal with the resource and budget limitation problems. The proposed research program is anticipated to have positive impacts at the economic, social and academic levels through (a) protecting the massive investments that are being made by the public and private sectors in Canada in the IoT technology by offering advanced security solutions for the IoT assets, (b) protecting individuals' data as they flow through the different IoT layers (i.e., IoT, fog and cloud), and (c) offering high-quality training to students at the PhD, Master's and undergraduate levels in such a way to prepare them for the Canadian job market's needs and standards.

物联网 (IoT) 的主要思想是使设备（例如智能车辆、家用电器等）能够感知环境、收集相关数据、分析这些数据并根据提取的见解采取一些行动。此类设备通常具有低处理能力以及有限的存储器和存储容量。云计算一直是物联网设备满足其存储和分析需求的主要支柱。然而，云服务器通常部署在距离物联网设备较远的位置，以及延迟关键型物联网应用的出现，迫切需要扩展云架构以支持延迟关键型服务。在此背景下，雾计算的概念被提出，以提供更接近物联网设备的数据分析和决策。由于由数十亿不同类型的物联网、雾和云设备组成的环境的多边性、异构性和大规模性，上述物联网多人架构很可能面临非常规安全挑战和尺寸。我们该研究计划的长期目标是提高检测物联网-雾-云环境中高级攻击模式的效率。该研究项目的新颖性在于研究物联网、雾和云层共存和相互作用的综合多边环境中的物联网安全，从而考虑新的非常规漏洞和威胁。拟议的研究计划涵盖三个主要研究方向，它们是：（1）用于攻击识别的大数据分析，其中将设计和实施深度学习方法和集成学习方法来识别高级攻击模式； (2) 建立多边信任，其中多边（即物联网到雾、雾到物联网、物联网到云、云到物联网、雾到云和云到-雾）将研究信任建立解决方案，以提高这些不同共存方之间通信渠道的安全性； （3）数据驱动的网络安全决策，利用数据分析和信任轨迹中提取的见解，设计数据驱动的数学模型，帮助安全管理员有效反击攻击者的狡猾策略，并有效应对资源和预算限制问题。拟议的研究计划预计将通过以下方式在经济、社会和学术层面产生积极影响：(a) 通过为物联网提供先进的安全解决方案，保护加拿大公共和私营部门在物联网技术方面的大量投资资产，(b) 保护流经不同物联网层（即物联网、雾和云）的个人数据，以及 (c) 以这种方式为博士、硕士和本科生提供高质量的培训为他们满足加拿大就业市场的需求做好准备标准。