Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering

Angelo Feraudo; Diana Andreea Popescu; Poonam Yadav; Richard Mortier; Paolo Bellavista

doi:10.1145/3631461.3631549

Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering

Angelo Feraudo, Diana Andreea Popescu, Poonam Yadav, Richard Mortier, Paolo Bellavista

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

As the prevalence of Internet-of-Things (IoT) devices becomes more and more dominant, so too do the associated management and security challenges. One such challenge is the exploitation of vulnerable devices for recruitment into botnets, which can be used to carry out Distributed Denial-of-Service (DDoS) attacks. The recent Manufacturer Usage Description (MUD) standard has been proposed as a way to mitigate this problem, by allowing manufacturers to define communication patterns that are permitted for their IoT devices, with enforcement at the gateway home router. In this paper, we present a novel integrated system implementation that uses a MUD manager (osMUD) to parse an extended set of MUD rules, which also allow for rate-limiting of traffic and for setting appropriate thresholds. Additionally, we present two new backends for MUD rule enforcement, one based on eBPF and the other based on the Linux standard iptables. The evaluation results reported show that these techniques are feasible and effective in protecting against attacks, with minimal impact on legitimate traffic and on the home gateway.

Original language	English
Title of host publication	ACM International Conference Proceeding Series
Publisher	ACM
Pages	164-173
Number of pages	10
ISBN (Electronic)	979-8-4007-1673-7
DOIs	https://doi.org/10.1145/3631461.3631549
Publication status	Published - 22 Jan 2024

Access to Document

10.1145/3631461.3631549Licence: CC BY

3631461.3631549
© 2024 Copyright held by the owner/author(s)
Final published version, 0.98 MBLicence: CC BY

Cite this

@inproceedings{328db4cc10f54123a96222e6d40e25f2,

title = "Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering",

abstract = "As the prevalence of Internet-of-Things (IoT) devices becomes more and more dominant, so too do the associated management and security challenges. One such challenge is the exploitation of vulnerable devices for recruitment into botnets, which can be used to carry out Distributed Denial-of-Service (DDoS) attacks. The recent Manufacturer Usage Description (MUD) standard has been proposed as a way to mitigate this problem, by allowing manufacturers to define communication patterns that are permitted for their IoT devices, with enforcement at the gateway home router. In this paper, we present a novel integrated system implementation that uses a MUD manager (osMUD) to parse an extended set of MUD rules, which also allow for rate-limiting of traffic and for setting appropriate thresholds. Additionally, we present two new backends for MUD rule enforcement, one based on eBPF and the other based on the Linux standard iptables. The evaluation results reported show that these techniques are feasible and effective in protecting against attacks, with minimal impact on legitimate traffic and on the home gateway.",

author = "Angelo Feraudo and Popescu, {Diana Andreea} and Poonam Yadav and Richard Mortier and Paolo Bellavista",

year = "2024",

month = jan,

day = "22",

doi = "10.1145/3631461.3631549",

language = "English",

pages = "164--173",

booktitle = "ACM International Conference Proceeding Series",

publisher = "ACM",

address = "United States",

}

TY - GEN

T1 - Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering

AU - Feraudo, Angelo

AU - Popescu, Diana Andreea

AU - Yadav, Poonam

AU - Mortier, Richard

AU - Bellavista, Paolo

PY - 2024/1/22

Y1 - 2024/1/22

N2 - As the prevalence of Internet-of-Things (IoT) devices becomes more and more dominant, so too do the associated management and security challenges. One such challenge is the exploitation of vulnerable devices for recruitment into botnets, which can be used to carry out Distributed Denial-of-Service (DDoS) attacks. The recent Manufacturer Usage Description (MUD) standard has been proposed as a way to mitigate this problem, by allowing manufacturers to define communication patterns that are permitted for their IoT devices, with enforcement at the gateway home router. In this paper, we present a novel integrated system implementation that uses a MUD manager (osMUD) to parse an extended set of MUD rules, which also allow for rate-limiting of traffic and for setting appropriate thresholds. Additionally, we present two new backends for MUD rule enforcement, one based on eBPF and the other based on the Linux standard iptables. The evaluation results reported show that these techniques are feasible and effective in protecting against attacks, with minimal impact on legitimate traffic and on the home gateway.

AB - As the prevalence of Internet-of-Things (IoT) devices becomes more and more dominant, so too do the associated management and security challenges. One such challenge is the exploitation of vulnerable devices for recruitment into botnets, which can be used to carry out Distributed Denial-of-Service (DDoS) attacks. The recent Manufacturer Usage Description (MUD) standard has been proposed as a way to mitigate this problem, by allowing manufacturers to define communication patterns that are permitted for their IoT devices, with enforcement at the gateway home router. In this paper, we present a novel integrated system implementation that uses a MUD manager (osMUD) to parse an extended set of MUD rules, which also allow for rate-limiting of traffic and for setting appropriate thresholds. Additionally, we present two new backends for MUD rule enforcement, one based on eBPF and the other based on the Linux standard iptables. The evaluation results reported show that these techniques are feasible and effective in protecting against attacks, with minimal impact on legitimate traffic and on the home gateway.

UR - http://www.scopus.com/inward/record.url?scp=85184282571&partnerID=8YFLogxK

U2 - 10.1145/3631461.3631549

DO - 10.1145/3631461.3631549

M3 - Conference contribution

AN - SCOPUS:85184282571

SP - 164

EP - 173

BT - ACM International Conference Proceeding Series

PB - ACM

ER -

Mitigating IoT Botnet DDoS Attacks through MUD and eBPF based Traffic Filtering

Abstract

Access to Document

Other files and links

Cite this