iDAM: A Distributed MUD Framework for Mitigation of Volumetric Attacks in IoT Networks

Abstract

The rapid popularity of IoT devices has led to an escalating number of sophisticated cybersecurity attacks. Prior security mechanisms are inaccurate and incur high computational costs for resource-constrained IoT devices, hindering their scalability to large networks. Manufacturer Usage Description (MUD) has been introduced to overcome IoT security challenges. However, it cannot mitigate volumetric attacks in IoT networks. This paper proposes iDAM: a distributed self-learning, autonomous system to detect and mitigate volumetric attacks in IoT networks. iDAM monitors and authenticates the behavioral profiles of MUD compliant IoT devices and builds specific-device-type OC-SVM models aggregated using federated learning. The solution can cope with the occurrence of volumetric attacks at several levels of the IoT infrastructure and the compromise of the internal components of the proposed solution. We have extensively evaluated our solution with the IoT network intrusion dataset, which shows that iDAM can efficiently mitigate several volumetric attacks by detecting anomalous packet flows in the network with an AUC of 0.9597. Testing iDAM against a real-time SYN flood attack in an experimental setup and its ability to quickly mitigate the attack solidifies the conclusion that it can be deployed in a real-time environment to detect and mitigate volumetric attacks effectively.