Tracking intruders in IoT networks by means of DNS traffic analysis

The Internet of Things is increasingly gaining use in our society as can be seen by the significant growth in the number of devices connected to the most diverse Internet applications. But, most IoT devices include embedded software that cannot be updated and there is evidence that these devices present vulnerabilities exploitable even by the most simple forms of attacks, as for instance login attempts using simple combinations of known, or easy to guess, user identifications and passwords. These attacks would result in successful access by unauthorized entities to these devices. Considering these vulnerabilities, the concern for device protection mechanisms is raised. This paper proposes an IoT router that verifies the DNS traffic originated from IoT devices and performs the detection of IoT devices that are consulting unauthorized DNS servers. Our design is validated by means of a developed prototype that is submitted to functional tests in a real IoT network implemented in a controlled laboratory environment.