IoT devices fundamentally lack built-in security mechanisms to protect
themselves from security attacks. Existing works on improving IoT security
mostly focus on detecting anomalous behaviors of IoT devices. However, these
existing anomaly detection schemes may trigger an overwhelmingly large number
of false alerts, rendering them unusable in detecting compromised IoT devices.
In this paper we develop an effective and efficient framework, named CUMAD, to
detect compromised IoT devices. Instead of directly relying on individual
anomalous events, CUMAD aims to accumulate sufficient evidence in detecting
compromised IoT devices, by integrating an autoencoder-based anomaly detection
subsystem with a sequential probability ratio test (SPRT)-based sequential
hypothesis testing subsystem. CUMAD can effectively reduce the number of false
alerts in detecting compromised IoT devices, and moreover, it can detect
compromised IoT devices quickly. Our evaluation studies based on the
public-domain N-BaIoT dataset show that CUMAD can on average reduce the false
positive rate from about 3.57% using only the autoencoder-based anomaly
detection scheme to about 0.5%; in addition, CUMAD can detect compromised IoT
devices quickly, with less than 5 observations on average.

该研究提出了一种名为 CUMAD 的有效和高效的框架，通过结合基于自编码器的异常检测子系统和基于顺序假设检验的顺序概率比测试子系统，累积足够的证据以检测受损的物联网设备，从而有效降低了误报数目，同时能快速检测到受损的物联网设备。