Modeling and clustering attacker activities in IoT through machine learning techniques

Abstract With the rise of the Internet of Things, malicious attacks pose serious threats to the massive vulnerable IoT devices. Recently, attackers have initiated increasingly coordinated attack activities commonly pertaining to botnets. However, how to effectively detect the botnet based on attacker activities is proven challenging. In this paper, we propose a Machine Learning-based method for modeling attacker activities based on the following intuitive observations: attackers in the same botnet tend to launch temporally close attacks. We then directly model attack temporal patterns using a special class of point process called Multivariate Hawkes Process. Intuitively, Multivariate Hawkes Process identifies the latent influences between attackers by utilizing the mutually exciting properties. We then cluster the attacker activities based on the inferred weighted influence matrix with resort to the graph-based clustering approach. To evaluate the applicability of our method, we deployed 10 honeypots in a real-world environment, and conduct experiments on the collected dataset. The results show that we can identify the activity pattern and the structure of botnets effectively.