DeepAuditor: Distributed Online Intrusion Detection System for IoT devices via Power Side-channel Auditing

TL;DR

DeepAuditor is a real-time, distributed intrusion detection system for IoT devices that uses power side-channel auditing, lightweight hardware, and privacy-preserving protocols to detect botnet intrusions effectively.

Contribution

It introduces the first online intrusion detection system for IoT devices utilizing power auditing, a lightweight power auditor, and a privacy-preserved distributed CNN classifier.

Findings

Classifier outperforms baseline, especially on unseen patterns.

System achieves real-time detection with acceptable accuracy and processing time.

Distributed CNN design is secure against component attacks.

Abstract

As the number of IoT devices has increased rapidly, IoT botnets have exploited the vulnerabilities of IoT devices. However, it is still challenging to detect the initial intrusion on IoT devices prior to massive attacks. Recent studies have utilized power side-channel information to identify this intrusion behavior on IoT devices but still lack accurate models in real-time for ubiquitous botnet detection. We proposed the first online intrusion detection system called DeepAuditor for IoT devices via power auditing. To develop the real-time system, we proposed a lightweight power auditing device called Power Auditor. We also designed a distributed CNN classifier for online inference in a laboratory setting. In order to protect data leakage and reduce networking redundancy, we then proposed a privacy-preserved inference protocol via Packed Homomorphic Encryption and a sliding window protocol in our system. The classification accuracy and processing time were measured, and the proposed classifier outperformed a baseline classifier, especially against unseen patterns. We also demonstrated that the distributed CNN design is secure against any distributed components. Overall, the measurements were shown to the feasibility of our real-time distributed system for intrusion detection on IoT devices.