Iot-Home-Guard - A Tool For Malicious Quest Detection Inwards Iot Devices

IoT-Home-Guard is a projection to attention people discovery malware inwards smart habitation devices.

For users the projection tin forcefulness out attention to abide by compromised smart habitation devices. For safety researchers it is also useful inwards network analysis together with malicious hehaviors detection.

In July 2018 nosotros had completed the get-go version. We volition consummate the minute version yesteryear Oct 2018 amongst improvement of user sense together with increased expose of identifiable devices.

The get-go generation is a hardware device based on Raspberry Pi amongst wireless network interface controllers. We volition customize novel hardware inwards the minute generation. The organization tin forcefulness out hold out educate amongst software purpose inwards laptops subsequently essential environs configuration. Software purpose is available inwards software_tools/.

Proof of principle
Our approach is based on the detection of malicious network traffic. H5N1 device implanted malwares volition communicate amongst remote server, trigger a remote rhythm or post audios/videos to server.
The nautical chart below shows the network traffic of a device which implanted snooping malwares.
Red trouble : traffic betwixt devices together with a remote spy server.
Green trouble : normal traffic of devices.
Black trouble : Sum of TCP traffic.

Modules

1. AP module together with Data catamenia catcher: Catch network traffic.
2. Traffic analying engine: Extract characteristics from network traffic together with compare them amongst device fingerprint database.
3. Device fingerprint database: Normal network behaviors of each devices, based on whitelist. Call APIs of 360 threat intelligence database (https://ti.360.net/).
4. Web server: There may hold out a spider web server inwards the minute generation.

Procedure

                                           ___________________       ___________________                                           |                   |     |                   |                                           | data_flow_catcher |<----| devices connected |                                           |___________________|     |___________________|                                                ¦                                                ¦  ____________________________              ____↓________________   |                            |            |                     | | device_fingerprint_databse |<---------> | flow_analyze_engine | |____________________________|       ¦    |_____________________|                                      ¦         ↑                                      ¦         ¦  __________________________________  ¦     ____↓_______              _________________ |                                  | ¦    |            |            |                 | | 360 threat tidings database |<-    | web_server |<-----------| user interfaces | |__________________________________|      |____________|            |_________________|

The tool works equally an Access Point, connected manually yesteryear devices nether test, sends network traffic to traffic analyzing engine for feature extraction. Traffic analyzing engine compares characteristics amongst entries inwards device fingerprint database to recognize device type together with suspicious network connection. Device fingerprint database is a collect of normal behaviors of each device based on whitelist. Additionally, characteristics volition hold out searched on threat tidings database of Qihoo 360 to position malicious behaviors. H5N1 spider web server is educate equally user interfaces.

Effectiveness
In our research, nosotros convey succcessfully implanted Trojans inwards viii devices including smart speakers, cameras, driving recorders together with mobile translators amongst IoT-Implant-Toolkit.
H5N1 demo video below:

We collected characteristics of those devices together with ran IoT-Home-Guard. All devices implanted Trojans convey been detected. We believe that malicious behaviors of to a greater extent than devices tin forcefulness out hold out identified amongst high accuracy subsequently supplement of fingerprint database.

Download IoT-Home-Guard