Sentinel: A Robust Intrusion Detection System for IoT Networks Using Kernel-Level System Information

Adrien Cosson, Amit Kumar Sikder, Leonardo Babun, Z. Berkay Celik, Patrick McDaniel, A. Selcuk Uluagac

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

The concept of Internet of Things (IoT) has changed the way we live by integrating commodity devices with cyberspace to automate our everyday tasks. Nowadays, IoT devices in the home environment are becoming ubiquitous with seamless connectivity and diverse application domains. Modern IoT devices have adopted a many-to-many connectivity model to enhance user experience and device functionalities compared to early IoT devices with standalone device setup and limited functionalities. However, the continuous connection between devices and cyberspace has introduced new cyber attacks targeting IoT devices and networks. Due to the resource-constrained nature of IoT devices as well as the opacity of the IoT framework, traditional intrusion detection systems cannot be applied here. In this paper, we introduce Sentinel, a novel intrusion detection system that uses kernel-level information to detect malicious attacks. Specifically, Sentinel collects low-level system information (CPU usage, RAM usage, total load, available swap, etc.) of each IoT device in a network and learns the pattern of device behavior to differentiate between benign and malicious events. We evaluated the efficacy and performance of Sentinel in different IoT platforms with multiple devices and settings. We also measured the performance of Sentinel against five types of real-life attacks. Our evaluation shows that Sentinel can detect different attacks to IoT devices and networks with high accuracy (over 95%) and secure the devices in different IoT platforms and configurations. Also, Sentinel achieves minimum overhead in power consumption, ensuring high compatibility in resource-constraint IoT devices.

Original languageEnglish (US)
Title of host publicationIoTDI 2021 - Proceedings of the 2021 International Conference on Internet-of-Things Design and Implementation
PublisherAssociation for Computing Machinery, Inc
Pages53-66
Number of pages14
ISBN (Electronic)9781450383547
DOIs
StatePublished - May 18 2021
Event6th ACM/IEEE International Conference on Internet of Things Design and Implementation, IoTDI 2021 - Virtual, Online, United States
Duration: May 18 2021May 21 2021

Publication series

NameIoTDI 2021 - Proceedings of the 2021 International Conference on Internet-of-Things Design and Implementation

Conference

Conference6th ACM/IEEE International Conference on Internet of Things Design and Implementation, IoTDI 2021
Country/TerritoryUnited States
CityVirtual, Online
Period5/18/215/21/21

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Computer Science Applications
  • Hardware and Architecture

Fingerprint

Dive into the research topics of 'Sentinel: A Robust Intrusion Detection System for IoT Networks Using Kernel-Level System Information'. Together they form a unique fingerprint.

Cite this