Detecting Anomalies in IoT Device Communication Based on MUD Profiles With Zeek and Python

Abstract

The threat of Internet of Things (IoT) vulnerabilities remains highly persistent today, with IoT devices responsible for a third of all infections in mobile networks by the end of 2020. Consumers are now more worried about their personal data being compromised or collected by unauthorized personnel. Run by Dr. Vyas Sekar, the IoT@CyLab Initiative at Carnegie Mellon University’s CyLab focuses on creating technologies that address different IoT issues by creating a network that can independently protect devices from potential threats and miscommunications. In this research, we analyze device communications with the use of Python to generate a Zeek script that uses device protocol and IP address information from the device MUD profile. Via string manipulation, the Python script grabs the allowed destination IP addresses from the MUD profile. This list is passed into the Zeek script, which checks the addresses in the list against destination addresses in a PCAP file that contains the device communications. PCAP files, MUD Files, and other test data are from open-source resources from the University of New South Wales (UNSW). We use the device connection CSV file they offer to find the host address of the device being analyzed. Once that host and destination IPS are inserted into the Zeek Script, logs of suspicious connections are generated. Results of this experiment have led to successful log creations. However, further testing needs to be done to check the validity and accuracy of the logs. Once this is proven, next steps include improving the efficiency of the string manipulation algorithm and a revision of the algorithm to allow assessment of real-time data flow.