Design of Intrusion Detection Honeypot Using Social Leopard Algorithm to Detect IoT Ransomware Attacks

S Sibi Chakkaravarthy,Balasubramanian Raman,V Vaidehi,D Sangeetha,Meenalosini Vimal Cruz

doi:10.1109/access.2020.3023764

Abstract

In recent times, ransomware has become the most significant cyber-attack targeting individuals, enterprises, healthcare industries, and the Internet of Things (IoT). Existing security systems like Intrusion Detection and Prevention System (IDPS) and Anti-virus (AV) as a single monitoring agent is complicated and time-consuming, thus fails in ransomware detection. A robust Intrusion Detection Honeypot (IDH) is proposed to address the issues mentioned above. IDH consists of i) Honeyfolder, ii) Audit Watch, and iii) Complex Event Processing (CEP). Honeyfolder is a decoy folder modeled using Social Leopard Algorithm (SoLA), especially for getting attacked and acting as an early warning system to alert the user during the suspicious file activities. AuditWatch is an Entropy module that verifies the entropy of the files and folders. CEP engine is used to aggregate data from different security systems to confirm the ransomware behavior, attack pattern, and promptly respond to them. The proposed IDH is experimentally tested in a secured testbed using more than 20 variants of recent ransomware of all types. The experimental result confirms that the proposed IDH significantly improves the ransomware detection time, rate, and accuracy compared with the existing state of the art ransomware detection model.

Highlights

IoT is a system of built-in-sensors interconnected to collect and transfer the data automatically without any human interventions
The main objective of this paper is to propose a novel INTRUSION DETECTION HONEYPOT (IDH) using COMPLEX EVENT PROCESSING (CEP), which collects an enormous amount of data from various sources such as Honeyfolder, Software Defined Networking (SDN) network and hosts, Audit Watch, Firewall (IP Tables)
This paper proposes a robust IDH for ransomware detection and mitigation with the following contributions

Summary

Introduction

IoT is a system of built-in-sensors interconnected to collect and transfer the data automatically without any human interventions. The sensors in the IoT devices interact with the internal and external state of environments and makes a decision autonomously. The tremendous era of IoT is the dawn of the digital world, which has seen massive inventions almost in every facet of our lives. The performance of today’s IoT devices extends from managing the extreme amount of data to computing through synthetic intelligence. Any disruption or malfunction of any devices in an IoT infrastructure may incur devastating threats to the process and trustworthiness.

Objectives

Methods

Results

Conclusion