Enhancing IoT security: Assessing instantaneous communication trust to detect man-in-the-middle attacks

Abstract

Communication trust is regarded as an effective tool to detect various dangerous cyber attacks, including Man-in-the-Middle (MITM) attacks and acts as a complement to zero trust. There exist some approaches in the literature to calculate inter-node communication trust in Wireless Sensor Networks (WSNs) and IoT networks and leverage it to detect attacks. In WSNs, since promiscuous communication mode is used in calculating inter-node communication trust, it is not suitable for IoT networks. For IoT, the packet forwarding behavior of edge nodes is used in calculating inter-node communication trust, which is limited to detect the MITM attacks effectively unless an edge node is compromised and acts as an MITM attacker. Additionally, these trust calculation mechanisms neither leverage communication channel characteristics nor the communication trust between sensor and edge nodes. Protecting IoT networks from various cyber attacks like MITM attacks requires the instantaneous trust calculation using communication channel characteristics. Since active MITM attacks incur delays, consideration of delay in trust calculation appears to be an effective means in identifying attacks. Neither end-to-end (E2E) delay nor delay due to attacks has been used in communication trust calculation in the existing literature. To bridge this research gap and detect active MITM attacks accurately and spontaneously, in this paper, a new conceptual model, named IPCTCM is introduced for instantaneous trust calculation of an IoT communication channel leveraging delay due to active MITM attacks. Two popular time-series data estimation tools, named Kalman filter and LSTM are used to estimate the expected E2E delay to identify delay due to attacks. Our proposed communication trust calculation model is validated using the data, generated by a testbed implementation in our IoT lab at Federation University Australia. Performance evaluation shows our proposed model achieves an attack detection accuracy of 98.9%, which outperforms an existing intrusion detection method with the improvement of 48.1% accuracy. Furthermore, our trust calculation method has broader applicability in other communication domains as well.