IoT & Network Security

Background and Challenges

In recent years, IoT (Internet of Things) devices have spread rapidly across various fields, including smart homes, smart factories, and infrastructure monitoring. However, many of these devices have limited computing resources such as CPU and memory and cannot carry out robust security functions like strong encryption or real-time monitoring software. As a result, they have become prime targets for cyberattacks, such as malware infection and participation in botnets for launching distributed denial-of-service (DDoS) attacks.

Furthermore, attack methods are becoming more sophisticated day by day. Traditional signature-based intrusion detection systems (IDS) and conventional machine learning models that monitor individual communication terminals independently find it difficult to effectively detect unknown zero-day attacks or coordinated botnet activities in real time.

Our Approach

To address these challenges, our laboratory is conducting research from multiple perspectives, combining Artificial Intelligence, cryptographic techniques, and hardware-assisted security.

1. Advanced Intrusion Detection and Explainability using Graph Neural Networks (GNNs)

By modeling terminal-to-terminal relationships and network traffic flows as graph structures and applying GNNs, we can detect malicious activities such as botnets that operate in a coordinated manner across the network with high accuracy. Additionally, we are developing lightweight sampling methods for resource-constrained environments and integrating Explainable AI (XAI) to logically present the root causes of detected anomalies to security administrators.

2. Traffic Obfuscation for Privacy and Confidentiality Protection

Even when packet contents are encrypted, information such as packet size and timing can leak private information about when and which devices are active (traffic analysis attacks). We develop obfuscation techniques that insert controlled noise, delays, or dummy packets into traffic to hide communication patterns securely and with low latency.

3. Secure System Auditing utilizing TEE (Trusted Execution Environment)

If an IoT device is compromised, the attacker may tamper with security logs recorded on the OS. To counter this, we research secure provenance auditing systems. By leveraging processor-level hardware-isolated areas TEEs such as ARM TrustZone, we securely capture and transmit system execution traces, ensuring log integrity even when the OS kernel itself has been compromised.

4. Co-operative Security in Flying Ad-Hoc Networks (FANETs)

In ad-hoc networks consisting of mobile agents like drones (FANETs), malicious nodes may drop or tunnel packets (e.g., wormhole attacks). We study cooperative defense strategies where nodes dynamically evaluate the "trustworthiness" of their neighbors based on behavioral history to autonomously build reliable communication routes.

5. Federated Learning for IoT Zero-Day Attack Detection Based on Autonomously Extracted Anomaly Information

To defend IoT devices against unknown cyberattacks (zero-day attacks), we investigate Federated Learning techniques that cooperatively train anomaly detection models without sharing raw communication data between devices, thereby preserving privacy. We propose a zero-day attack detection framework that enables each IoT node to autonomously extract and learn anomaly features. Integrating these locally trained models achieves both low communication overhead and robust privacy protection.

6. Non-intrusive Intrusion Detection via Active Probing

Deploying dedicated IDS software on each IoT gateway or device is often challenging due to limited resources and cost. To address this, we developed a method that dynamically estimates packet transmission counts from the outside without sniffing traffic. By proactively sending probe packets (e.g., ICMP) and analyzing the increments of the IPID (IPv4 Identification) field in the responses, device activity can be monitored remotely. Using these estimates, machine learning models like One-Class SVM can detect anomalous traffic from attacks like DoS or ARP spoofing. This lightweight, highly deployable defense strategy has received strong recognition.