DÏoT: A Federated Self-learning Anomaly Detection System for IoT

May combine two claims. The quote only partly states this claim.

Federated learning with 5, 9, or 15 clients causes small TPR decrease, FPR constant at 0.00%.

“Tab.VI shows a small decrease in TPR as we increase the number of clients”

May combine two claims.

Average processing time per packet was 0.081 ms on desktop GPU and 0.592 ms on laptop CPU.

“Average processing time per symbol (packet) for prediction was 0.081(±0.001)ms for the desktop utilizing its GPU and 0.592(±0.001)ms when executed on the laptop with CPU.”

May combine two claims. The quote only partly states this claim.

Single model yields FPR 0.67% and TPR 97.21%, worse FPR than device-type-specific.

“FPR increases from 0% to 0.67% while TPR increases from 95.6% to 97.21%.”

May combine two claims.

Malicious packets get very low probability estimates (<10^-4), distinguishing them clearly from benign packets.

“Malicious packets (represented by symbol '#0') get very low probability estimates (<10 -4 ), distinguishing them clearly from benign packets.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The monitored devices included 33 typical consumer IoT devices mapped to 23 unique device types.

“The monitored devices included 33 typical consumer IoT devices like IP cameras, smart power plugs and light bulbs, sensors, etc.The devices were mapped by our device-type-identification method to 23 unique device types.”

May combine two claims.

Probability estimates are on average higher for packets belonging to benign traffic patterns and lower for packets generated by malware on an infected device.

“From Fig. 3b we can see that these probability estimates are on average higher for packets belonging to benign traffic patterns, and lower for packets generated by malware on an infected device and can therefore be flagged as anomalous.”

May combine two claims.

Federated models with more clients achieve better FPR, while TPR deteriorates only slightly.

“the federated models with more participating clients achieve better FPR, while TPR deteriorates only slightly.”

May combine two claims. The quote only partly states this claim.

DoS attacks have lower detection rate but all are eventually detected; 88.96% TPR.

“Considering the 88.96% TPR we achieve on DoS attacks, four windows out of five are detected as anomalous and trigger an alarm.”

May combine two claims.

DÏoT builds on device-type-specific communication profiles without human intervention nor labeled data to detect anomalous deviations in devices' communication behavior potentially caused by malicious adversaries.

“D ÏOT builds effectively on device-type-specific communication profiles without human intervention nor labeled data that are subsequently used to detect anomalous deviations in devices' communication behavior, potentially caused by malicious adversaries.”

Classified as probably not a substantial claim.

Anomaly detection works by profiling the normal behavior of devices and detecting attacks as deviations from this normal behavior profile.

“To detect previously unknown attacks anomaly detection needs to be used which works by profiling the normal behavior of devices and detecting attacks as deviations from this normal behavior profile [7]- [9].”

• cites [7]- [9]Not checked yet

  Not checked in the free run.

May combine two claims.

DÏoT uses a novel device-type-specific anomaly detection approach to achieve accurate detection of attacks while generating almost no false alarms.

“It uses a novel device-type-specific anomaly detection approach to achieve accurate detection of attacks while generating almost no false alarms.”

May combine two claims.

IoT devices typically do not generate a lot of network traffic, making it challenging to train comprehensive models that accurately cover the full behavior of IoT devices.

“Second, IoT devices do typically not (notwithstanding a few exceptions) generate a lot of network traffic, as their communications are limited to, e.g., status updates about sensor readings or (relatively) infrequent interactions related to user commands.This scarcity of communications makes it challenging to train comprehensive models that can accurately cover the full behavior of IoT devices.”

May combine two claims.

Device-type-specific models are less prone to trigger false alarms because each model covers only behavior of a specific device type, and IoT devices are single-use appliances with relatively static and limited behavior patterns.

“Consequently, each model needs to cover only the behavior of a specific device type.As IoT devices are typically single-use appliances with only a few different functions, their behavior patterns are relatively static and limited, allowing the model to accurately capture all possible legitimate behaviors of a device type.Thus, the model is less prone to trigger false alarms (details in Sect.VI-D),”

May combine two claims.

An all-encompassing behavior model is tedious to learn and update, and too broad to be effective at detecting subtle anomalies without generating many false alarms.

“The ever-increasing number of literally thousands of types of IoT devices (ranging from temperature sensors and smart light bulbs to big appliances like washing machines) and the typical scarcity of their communications, makes an all-encompassing behavior model 1) tedious to learn and update, and 2) too broad to be effective at detecting subtle anomalies without generating many false alarms.”

May combine two claims.

Using AuDI, DÏoT can reliably map devices to a corresponding device type and be trained and operated autonomously without human intervention.

“Using this approach we can reliably map devices to a corresponding device type for which D ÏOT can build a devicetype-specific model of normal behavior that can be used to effectively detect anomalous deviations.This allows D ÏOT to be trained and operated autonomously, without the need for human intervention at any stage.”

May combine two claims.

AuDI autonomously identifies the type of individual IoT devices in a local network, accurate and fast (30 minutes to identify device type at 98.2% accuracy).

“For D ÏOT, we selected an existing approach -AuDI [14] that autonomously identifies the type of individual IoT devices in a local network.This approach is accurate and fast (requiring only 30 minutes to identify device type at the accuracy of 98.2 %).”

• cites [14]Not checked yet

  Not checked in the free run.

May combine two claims.

Federated learning aggregation maximizes usage of limited information from scarce communications at each gateway and improves accuracy by utilizing all available data for learning.

“This aggregation maximizes the usage of limited information obtained from scarce communications at each gateway (challenge C4) and helps to improve the accuracy of anomaly detection models by utilizing all available data for learning.”

Probably not a substantial claim: may not pass S4 (based).

Existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different types of devices and manufacturers involved.

“However, existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different types of devices and manufacturers involved.”

May combine two claims.

Federated learning is suitable for scenarios where data are massively distributed and contributions from clients are imbalanced.

“Federated learning is chosen because it is suitable [21] for scenarios where: • data are massively distributed, so that there is a large number of clients each having a small amount of data.”

• Also stated in: § B. Detection Process · plain

  “• contributions from clients are imbalanced.In our system, the training data available at each Security Gateway depends on the duration that an IoT device has been in the network and the amount of interaction it has had, which varies largely between clients.”

• cites [21]Not checked yet

  Not checked in the free run.

May combine two claims.

GRU provides similar accuracy as other RNN approaches but is computationally less expensive.

“GRUs provide similar accuracy as other RNN approaches but are computationally less expensive [17], [18].”

• cites [17], [18]Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

Federated learning is a communication-efficient and privacy-preserving learning approach suited for distributed optimization of Deep Neural Networks.

“Federated learning is a communication-efficient and privacy-preserving learning approach suited for distributed optimization of Deep Neural Networks (DNN) [19], [20].”

• cites [19], [20]Not checked yet

  Not checked in the free run.

May combine two claims.

Mirai is a highly relevant baseline for IoT malware behavior because its source code is publicly available, variants use the same code base, and it realizes similar attack stages as state-of-the-art IoT malware.

“We selected Mirai for this purpose, since its source code is publicly available and several infamous malware variants like Hajime [2] or Persirai [27] have been implemented using the same code base.Mirai also realizes similar attack stages (detailed in Sect.V-A3 below) as stateof-the-art IoT malware [3], [28].This makes Mirai a highly relevant baseline for IoT malware behavior.”

• cites [2] sourceNot checked yet

  Not checked in the free run.

• cites [27]Not checked yet

  Not checked in the free run.

• cites [3]Not checked yet

  Not checked in the free run.

May combine two claims. The quote only partly states this claim.

The deployment dataset involved 14 different smart home IoT devices in several domestic deployment scenarios with real users for one week.

“we installed a number of (n = 14) different smart home IoT devicesfoot_0 in several different domestic deployment scenarios.This deployment involved real users and collected communication traces of these devices under realistic usage conditions.”

• Also stated in: § 1) Activity dataset: · plain

  “Packet traces were collected continuously during one week.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

IoT devices typically generate little traffic, so only little data can be provided by each client alone.

“IoT devices typically generate little traffic, which means only little data can be provided by each client alone.”

May combine two claims. The quote only partly states this claim.

Model needs less than 25 hours of data for FPR=0; with 10 clients each needs 2.5 hours.

“the model needs less than 25 hours of data to achieve FPR = 0.”

May combine two claims.

DÏoT starts operating with no anomaly detection model and learns and improves these models as Security Gateways aggregate more data.

“It is worth noting that D ÏOT starts operating with no anomaly detection model.It learns and improves these models as Security Gateways aggregate more data.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The number of devices was limited because the WiFi interface driver allowed at most 16 devices to connect simultaneously.

“The number of devices was limited, as the driver of the used WiFi interface allowed at most 16 devices to reliably connect to it simultaneously.”

May combine two claims.

DÏOT does not require any human intervention or labeled data to operate.

“D ÏOT does not require any human intervention or labeled data to operate.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Testing for false positives used four-fold cross-validation for device types in Activity and Deployment datasets.

“Testing for false positives was performed by four-fold crossvalidation for device types in the Activity and Deployment datasets.”