一种基于无线路由器的IoT设备轻量级防御框架

doi:10.7523/j.issn.2095-6134.2017.06.013

中国科学院大学学报 ›› 2017, Vol. 34 ›› Issue (6): 759-770.DOI: 10.7523/j.issn.2095-6134.2017.06.013

• 计算机科学 • 上一篇

一种基于无线路由器的IoT设备轻量级防御框架

严志涛^1,2, 方滨兴^3,4, 刘奇旭^1,2, 崔翔^1,2,3

1. 中国科学院大学网络空间安全学院, 北京 100049;
2. 中国科学院信息工程研究所, 北京 100093;
3. 北京邮电大学, 北京 100876;
4. 东莞电子科技大学电子信息工程研究院, 广东东莞 523808

收稿日期:2016-11-29 修回日期:2017-02-22 发布日期:2017-11-15
通讯作者: 刘奇旭
基金资助:
国家重点研发计划（2016YFB0801604）、国家自然科学基金（61303239）和广东省产学研合作项目（2016B090921001）资助

A wireless router-based lightweight defense framework for IoT devices

YAN Zhitao^1,2, FANG Binxing^3,4, LIU Qixu^1,2, CUI Xiang^1,2,3

1. School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China;
2. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;
3. Beijing University of Posts and Telecommunications, Beijing 100876, China;
4. Institute of Electronic and Information Engineering, Dongguan University of Electronic Science and Technology, Dongguan 523808, Guangdong, China

Received:2016-11-29 Revised:2017-02-22 Published:2017-11-15

摘要/Abstract

摘要： 目前IoT（Internet of things，物联网）设备安全问题很多，然而由于IoT设备自身限制（嵌入式系统，资源紧张），传统PC的保护手段已经不再适用。提出一种基于无线路由器的IoT设备轻量级防御框架WRGuardian（wireless router guardian），利用家用无线路由器在网络流量的掌控能力和拓扑结构优势，从被动防御和主动防御两个方面入手，及时监测并阻断目前针对IoT设备的主要攻击行为，同时定期扫描检测安全问题并修复。该框架无需外部硬件或者修改设备原有系统，降低了部署难度和成本，有利于后期推广。实验结果显示WRGuardian能够有效对抗针对IoT设备弱口令、命令注入等主要攻击手段，且能排查修复已知风险，是一种低成本可行的轻量级防护方案。

关键词: 无线路由器, IoT设备, 安全防护, 网络流量

Abstract: It is well known that IoT (Internet of things) devices are vulnerable and can be easily intruded by attackers. However, traditional protection methods for PCs are no longer suitable for IoT devices. In this work, we design a router-based lightweight defense framework WRGuardian (wireless router guardian) which uses the router's network traffic controllability and computing capacity to protect IoT devices. It will monitor and block the attack behaviors to IoT devices, and it will detect and fix the security issues by simulating attacks. Because there is no requirement of additional security hardware for the IoT devices, this protection framework has a low cost, and it is convenient to deploy and beneficial for promotion. Our experimental results show that WRGuardian is feasible and protects IoT devices from main attacks. It is an effective lightweight solution.

Key words: wireless router, IoT device, protection, network traffic

中图分类号:

TP393

严志涛, 方滨兴, 刘奇旭, 崔翔. 一种基于无线路由器的IoT设备轻量级防御框架[J]. 中国科学院大学学报, 2017, 34(6): 759-770.

YAN Zhitao, FANG Binxing, LIU Qixu, CUI Xiang. A wireless router-based lightweight defense framework for IoT devices[J]. , 2017, 34(6): 759-770.

参考文献

[1] Gartner. Gartner says the Internet of things installed base will grow to 26 billion units by 2020. (2013-12-12). http://www.gartner.com/newsroom/id/2636073.
[2] Anonymous. Internet census 2012. (2012-12). http://internetcensus2012.bitbucket.org/paper.html.
[3] Paganini P. Lizard stresser hacking tool relies on compromised home routers. (2015-01-10). http://securityaffairs.co/wordpress/32022/cyber-crime/lizard-stresser-hacking-tool.htmlg.
[4] Krebs B. DDoS on Dyn impacts twitter, spotify, reddit. (2016-10-21). https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/.
[5] Flashpoint. Mirai botnet linked to Dyn DNS DDoS attacks. (2016-10-21). https://www.flashpoint-intel.com/mirai-botnet-linked-dyn-dns-ddos-attacks/.
[6] Gamblin J. Leaked Mirai source code for research/IoC development purposes. (2016-10-31). https://github.com/jgamblin/Mirai-Source-Code.
[7] Fazzi F. IRC-based mass router scanner/exploiter. (2015-6-19). https://github.com/eurialo/lightaidra.
[8] Oikarinen J, Reed D. Internet relay chat protocol. (1993-05). https://tools.ietf.org/rfc/rfc1459.txt.
[9] Proofpoint. Proofpoint uncovers Internet of things (IoT) cyberattack. (2014-01-16). http://investors.proofpoint.com/releasedetail.cfm?ReleaseID=819799.
[10] Krebs B. Who makes the IoT things under attack. (2016-10-03). https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/.
[11] DHS. Strategic principles for securing the Internet of things. (2016-11-16). https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_the_Internet_of_Things-2016-1115-FINAL_v2-dg11.pdf.
[12] 左青云,陈鸣,王秀磊,等. 一种基于SDN的在线流量异常检测方法[J]. 西安电子科技大学学报, 2015, 42(1):155-160.
[13] 陈友,程学旗,李洋,等. 基于特征选择的轻量级入侵检测系统[J]. 软件学报, 2007, 18(7):1639-1651.
[14] 朱应武,杨家海,张金祥. 基于流量信息结构的异常检测[J]. 软件学报, 2010, 21(10):2573-2583.
[15] Acunetix. Web application security with Acunetix Vulnerability Scanner. (2016-11). http://www.acunetix.com/vulnerability-scanner/.
[16] IBM. IBM security AppScan. (2016-11). http://www-03.ibm.com/software/products/en/appscan.
[17] Tenable. Nessus vulnerability scanner. (2016-01-01). http://www.tenable.com/products/nessus-vulnerability-scanner.
[18] Levandoski J, Sommer E, Strait M. Application layer packet classifier for Linux. (2009-01-07). http://l7-filter.sourceforge.net/.
[19] Tecgraf. The programming language Lua. (2016-10-14). http://www.lua.org/.
[20] Nehab D. Network support for the Lua language. (2016-07-23). https://github.com/diegonehab/luasocket.
[21] Andersen E. A C library for embedded Linux. (2012-05-15). https://uclibc.org/.
[22] IETF Working Group. Request for comments (RFC). (2016-10-03). http://www.ietf.org/rfc.html.
[23] Gailly J, Adler M. The gzip home page. (2003-07-27). http://www.gzip.org/.
[24] Fielding R, UC Irvine, Gettys J, et al. Hypertext transfer protocol:HTTP/1.1. (1999-06). http://www.ietf.org/rfc/rfc2616.txt.
[25] Herzberg B, Bekerman D, Zeifman I. Breaking down Mirai:an IoT DDoS Botnet analysis. (2016-10-10). https://www.incapsula.com/blog/malware-analysis-mirai-ddos-botnet.html.

一种基于无线路由器的IoT设备轻量级防御框架

A wireless router-based lightweight defense framework for IoT devices

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

访问统计

联系我们

[1]	戴志明, 周明拓, 杨旸, 李剑, 刘军. 智能工厂中的雾计算资源调度[J]. 中国科学院大学学报, 2021, 38(5): 702-711.
[2]	刘婷, 罗喜良. 移动边缘计算中的在线任务卸载方法[J]. 中国科学院大学学报, 0, (): 21542-21542.
[3]	朱兆伟, 刘婷, 钱骅, 罗喜良. 非稳态雾赋能网络中的在线任务卸载方法[J]. 中国科学院大学学报, 2020, 37(5): 699-707.
[4]	赖训飞, 梁旭文, 谢卓辰, 李宗旺. 基于实体嵌入和长短时记忆网络的入侵检测方法[J]. 中国科学院大学学报, 2020, 37(4): 553-561.
[5]	赵择, 徐佑宇, 唐亮, 卜智勇. 基于改进一对一算法的网络流量分类[J]. 中国科学院大学学报, 2020, 37(4): 570-576.
[6]	薛开平, 柳彬, 李威, 洪佩琳. 一种面向未知链路帧的格式特征提取与分类算法[J]. 中国科学院大学学报, 2018, 35(4): 521-528.
[7]	田洁, 王伟强, 孙翼. 一种免除二值化的视频叠加中文字符识别方法[J]. 中国科学院大学学报, 2018, 35(3): 402-408.
[8]	叶延玲, 傅晓彤, 张玉清, 乐洪舟. 一种自动化的Android应用定向行为测试方法[J]. 中国科学院大学学报, 2018, 35(3): 409-416.
[9]	王开泳, 邓羽. 基于微博数据的中原城市群空间联系强度测度[J]. 中国科学院大学学报, 2016, 33(6): 775-782.
[10]	闫淑筠, 王文杰, 张玉清. 一种有效的Web指纹识别方法[J]. 中国科学院大学学报, 2016, 33(5): 679-685.
[11]	侯金钟, 张立波, 罗铁坚. 一种均衡视频资源的分布存储方法[J]. 中国科学院大学学报, 2016, 33(5): 686-692.
[12]	曹来成, 赵建军, 崔翔, 李可. 基于余弦测度下K-means的网络空间终端设备识别[J]. 中国科学院大学学报, 2016, 33(4): 562-569.
[13]	吴敬征, 武延军, 武志飞, 杨牧天, 罗天悦, 王永吉. 基于有向信息流的Android隐私泄露类恶意应用检测方法[J]. 中国科学院大学学报, 2015, 32(6): 807-815.
[14]	董颖, 张玉清, 乐洪舟. Joomla内容管理系统漏洞利用技术[J]. 中国科学院大学学报, 2015, 32(6): 825-835.
[15]	罗刚, 赵亚伟, 王泳. 基于复杂网络理论的担保网络风险传播模式[J]. 中国科学院大学学报, 2015, 32(6): 836-842.