MUD-based behavioral profiling security framework for software-defined IoT networks
Abstract
The rapid development and deployment of Internet of Things (IoT) devices in modern networks and Industry 4.0 have attracted substantial interest from cybersecurity researchers. In this study, we propose a software-defined framework that improves network intrusion detection systems by using manufacturer usage description (MUD) to enhance the behavioral monitoring in IoT networks. We aim to explore whether Industrial IoT (IIoT) devices typically serve a common role in cyber–physical systems, and their communications exhibit predictable patterns that can be defined in MUD profile(s) formally and succinctly. We design a framework that utilizes the concept of digital twins and software-defined networking to improve the security of IIoT environments. The MUD data are profiled, and the actions are evaluated on the network digital twin before they are used in the physical network. The behavioral profiling system is updated in real time, thereby improving the overall system security and compliance to policies in the IoT deployment. Evaluation results show that our solution outperforms existing approaches substantially in terms of attack detection accuracy, predicting security incidents, response time, and resource usage.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
This integration is particularly attractive in IoT/IIoT and SDN-enabled CPS environments, where gateways and controllers can dynamically enforce behavior-based policies derived from learned device profiles and traffic patterns.
“This integration is particularly attractive in IoT/IIoT and SDN-enabled CPS environments, where gateways and controllers can dynamically enforce behavior-based policies derived from learned device profiles and traffic patterns [60-62,64].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [61]
The surveyed frameworks enable automated blocking, rerouting, and rate-limiting of malicious flows at the network layer by coupling IDS outputs with SIEM correlation rules, MUD-derived whitelists, SDN/OpenFlow policies, and switch-level filtering.
“By coupling IDS outputs with SIEM correlation rules, MUD-derived whitelists, SDN/OpenFlow policies, and switch-level filtering, the surveyed frameworks enable automated blocking, rerouting, and rate-limiting of malicious flows at the network layer [60-64].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [61]
Krishnan et al. [61] proposed a MUD-based behavioral profiling security framework that learns device behavior profiles and automatically translates them into SDN OpenFlow rules.
“Using multiple network traffic datasets such as CICIDS2017 and Bot-IoT, Krishnan et al. [61] proposed a MUD-based behavioral profiling security framework that learns device behavior profiles and automatically translates them into SDN OpenFlow rules.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [61]
The framework by Krishnan et al. [61] employs a network digital twin to simulate the impact of MUD rules and SDN actions in advance, mitigating policy conflicts, and successfully detects various attack scenarios, including Mirai botnets.
“Moreover, the framework employs a network digital twin to simulate the impact of MUD rules and SDN actions in advance, mitigating policy conflicts, and successfully detects various attack scenarios, including Mirai botnets.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [61]
Cites
Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization
Sharafaldin, I., Habibi Lashkari, A., & Ghorbani, A. A. (2018) · Proceedings of the 4th International Conference on Information Systems Security and Privacy · doi:10.5220/0006639801080116 · Cited by 5,318 · cited 4× · see citing works
“In BotIoT [26] (5 attack classes, 8000 malign, and 60 000 benign) and CICIDS [25] (8 types of attacks, 5000 malign samples, and 60 000 benign).”
BackgroundMethodInfluentialDigital Twin in Industry: State-of-the-Art
Tao, F., Zhang, H., Liu, A., & Nee, A. Y. C. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2018.2873186 · Cited by 4,391 · see citing works
Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019) · Future Generation Computer Systems · doi:10.1016/j.future.2019.05.041 · Cited by 1,983 · see citing works
A Deep Learning Approach to Network Intrusion Detection
Shone, N., Ngọc, T. N., Phai, V. D., & Shi, Q. (2018) · IEEE Transactions on Emerging Topics in Computational Intelligence · doi:10.1109/tetci.2017.2772792 · Cited by 1,960 · see citing works
Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study
Ferrag, M. A., Maglaras, L. A., Moschoyiannis, S., & Janicke, H. (2019) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2019.102419 · Cited by 1,298 · see citing works
IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT
Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A., & Tarkoma, S. (2017) · IEEE International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2017.283 · Cited by 721 · see citing works
Meidan, Y., Bohadana, M., Shabtai, A., Guarnizo, J., Ochoa, M., Tippenhauer, N. O., & Elovici, Y. (2017) · ACM Symposium on Applied Computing · doi:10.1145/3019612.3019878 · Cited by 424 · see citing works
Characterizing and classifying IoT traffic in smart cities and campuses
Sivanathan, A., Sherratt, D., Gharakheili, H. H., et al. (2017) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infcomw.2017.8116438 · Cited by 383 · see citing works
Ho, G., Leung, D., Mishra, P., et al. (2016) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/2897845.2897886 · Cited by 238 · see citing works
IoT-KEEPER: Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the Edge
Hafeez, I., Antikainen, M., Ding, A. Y., & Tarkoma, S. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.2966951 · Cited by 201 · see citing works
Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity
Hamza, A., Gharakheili, H. H., Benson, T., & Sivaraman, V. (2019) · Symposium on SDN Research · doi:10.1145/3314148.3314352 · Cited by 194 · see citing works
Dynamic attack detection and mitigation in IoT using SDN
Bhunia, S. S., & Gurusamy, M. (2017) · International Telecommunication Networks and Applications Conference (ITNAC) · doi:10.1109/atnac.2017.8215418 · Cited by 174 · see citing works
Chalapathi, G., Chamola, V., Vaish, A., & Buyya, R. (2021) · Advances in information security · doi:10.1007/978-3-030-57328-7_12 · Cited by 136 · see citing works
Self-citationSystematically Evaluating Security and Privacy for Consumer IoT Devices
Loi, F., Sivanathan, A., Gharakheili, H. H., et al. (2017) · doi:10.1145/3139937.3139938 · Cited by 123 · see citing works
Security Management Architecture for NFV/SDN-Aware IoT Systems
Molina Zarca, A., Bernabe, J. B., Trapero, R., Rivera, D., Villalobos, J., Skarmeta, A., Bianchi, S., Zafeiropoulos, A., & Gouvas, P. (2019) · IEEE Internet of Things Journal · doi:10.1109/jiot.2019.2904123 · Cited by 114 · see citing works
Clear as MUD: Generating, Validating and Applying IoT Behavioral Profiles
Hamza, A., Ranathunga, D., Gharakheili, H. H., Roughan, M., & Sivaraman, V. (2018) · Proceedings of the 2018 Workshop on IoT Security and Privacy · doi:10.1145/3229565.3229566 · Cited by 103 · see citing works
Dessouky, G., Zeitouni, S., Nyman, T., et al. (2017) · Proceedings - ACM IEEE Design Automation Conference · doi:10.1145/3061639.3062276 · Cited by 101 · see citing works
Siby, S., Maiti, R. R., & Tippenhauer, N. O. (2017) · doi:10.1145/3055245.3055253 · Cited by 91 · see citing works
Hallman, R. A., Bryan, J. A., Palavicini, G., et al. (2017) · International Conference on Internet of Things, Big Data and Security (IoTBDS) · doi:10.5220/0006246600470058 · Cited by 86 · see citing works
Software-Defined Security-by-Contract for Blockchain-Enabled MUD-Aware Industrial IoT Edge Networks
Krishnan, P., Jain, K., Achuthan, K., & Buyya, R. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3084341 · Cited by 53 · see citing works
Self-citationSDN Framework for Securing IoT Networks
Krishnan, P., Najeem, J. S., & Achuthan, K. (2017) · Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering · doi:10.1007/978-3-319-73423-1_11 · Cited by 52 · see citing works
Self-citationBehavioral fingerprinting of Internet‐of‐Things devices
Bezawada, B., Ray, I., Ray, I., et al. (2019) · Wiley Interdisciplinary Reviews Data Mining and Knowledge Discovery · doi:10.1002/widm.1337 · Cited by 28 · see citing works
Enforcing Behavioral Profiles through Software-Defined Networks in the Industrial Internet of Things
García, S. N. M., Zarca, A. M., Hernández-Ramos, J. L., Bernabé, J. B., & Gomez, A. F. S. (2019) · Applied Sciences · doi:10.3390/app9214576 · Cited by 27 · see citing works
Clearer than Mud: Extending Manufacturer Usage Description (MUD) for Securing IoT Systems
Singh, S., Atrey, A., Sichitiu, M. L., et al. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-23357-0_4 · Cited by 10 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Krishnan, P., Jain, K., Buyya, R., Vijayakumar, P., Nayyar, A., Bilal, M., & Song, H.
- Affiliations
- Amrita Vishwa Vidyapeetham (IN)
- The University of Melbourne (AU)
- Department of Computer Science and Engineering, University College of Engineering Tindivanam, Tindivanam, India
- Duy Tan University (VN)
- Hankuk University of Foreign Studies (KR)
- Embry-Riddle Aeronautical University Daytona Beach Florida Campus (US)
- ORCID
- Venue
- IEEE Internet of Things Journal
- Published
- 2022-05-01
- Volume
- 9
- Issue
- 9
- Pages
- 6611-6622
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W3201640968
- Cited by
- 71
- References
- 24
- Citations by year
- 2026: 13 · 2025: 14 · 2024: 19 · 2023: 16 · 2022: 9
- FWCI
- 4.94
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- Lancaster EPrints (Lancaster University) (submittedVersion)
- Scholarly Commons (Embry–Riddle Aeronautical University) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Computer Networks and Communications › Software-Defined Networks and 5G
- Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
- Keywords
- Manufacturer Usage Description, behavioral profiling, software-defined networking, Internet of Things security, Industrial Internet of Things, network intrusion detection, digital twin, cyber-physical systems, attack detection, security policy compliance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
