Malicious Web traffic detection for Internet of Things environments

Abstract

The Internet of Things (IoT) is gradually becoming an infrastructure, providing a wide range of applications, from health monitoring to industrial control and many other social domains. Unfortunately, for open connectivity, it is always built on Hypertext Transfer Protocol (HTTP), which inherently brings in new challenging security threats. Parameter injection, as a common and powerful attack, is often exploited by attackers to break into the HTTP servers of IoT by injecting malicious codes into the parameters of the HTTP requests. In this work we present a Hidden Markov Model (HMM) based detection system, which is designed as a novel bidirectory scoring architecture utilizing both benign and malicious Web traffic, to defend against parameter injection attacks in IoT systems. We evaluate the proposed system in terms of Web traffic data in real IoT environments. Results show improvements over baselines.