Anomaly detection for IoT environments

The dramatic increase in globally deployed insecure IoT devices has exposed the internet to various cyberattacks. Botnets such as Mirai exploit vulnerable IoT devices for distributed denial-of-service (DDoS) attacks on critical infrastructure. Network operators seek to limit the impact of these attacks by using anomaly detection solutions. However, these anomaly detection solutions are not tailored for IoT environment characteristics (i.e., diverse IoT behaviours), thus leading to an increase in false alarms. In this Thesis, we address the urgent need to develop effective methods for detecting malicious IoT traffic. Through systematic exploration, we have demonstrated that accurate and robust device identification is fundamental to enhancing anomaly detection in IoT environments. We explore three key objectives. First, we comprehensively evaluate existing machine learning approaches for IoT device identification, highlighting their limitations and areas for improvement. Second, we develop a model that combines three identification models: device behavioural profiles, fingerprints, and functional blocklists. This combination enhances robustness and reduces false alarm rates in traffic analysis. Third, we design an unsupervised model using Symbolic Aggregate Approximation (SAX) and compression-based dissimilarity to enable real-time detection of malicious IoT traffic, ensuring the identification of evolving threats at the network’s edge. Through these objectives, this Thesis advances IoT security by enhancing device identification accuracy and enables more reliable detection of anomalous and malicious activity.