Comprehending the IoT cyber threat landscape: A data dimensionality reduction technique to infer and characterize Internet-scale IoT probing campaigns

摘要: Abstract The resource-constrained and heterogeneous nature of Internet-of-Things (IoT) devices coupled with the placement such in publicly accessible venues complicate efforts to secure these networks they are connected to. Internet-wide deployment IoT also makes it challenging operate security solutions at strategic locations within network or identify orchestrated activities from seemingly independent malicious events devices. Therefore, this paper, we initially seek determine magnitude exploitations by examining more than 1 TB passive measurement data collected a/8 telescope correlating 400 GB information Shodan service. In second phase study, conduct in-depth discussions Internet Service Providers (ISPs) backbone operators, as well leverage geolocation databases not only attribute their hosting environment (ISPs, countries, etc.) but classify inferred based on sector type (financial, education, manufacturing, most abused manufacturers. third phase, automate task alerting realms that determined be exploited Additionally, address problem inferring campaigns solely observing targeting telescope, further introduce a theoretically sound technique L1-norm PCA, validate utility proposed dimensionality reduction against conventional L2-norm PCA. Specifically, “in wild” coordinated probing generic ports specifically searching for open resolvers (for amplification purposes). results reveal 120,000 Internet-scale devices, some which operating critical infrastructure sectors health manufacturing. We infer 140 large-scale IoT-centric campaigns; sample includes worldwide distributed campaign where close 40% its population video surveillance cameras single manufacturer, another very large consisting 50,000 reported findings highlight insecurity paradigm thus demonstrate importance understanding evolving threat landscape.