物联网设备识别及异常检测研究综述

随着物联网技术的发展,物联网设备广泛应用于生产和生活的各个领域,但也为设备资产管理和安全管理带来了严峻的挑战.首先,由于物联网设备类型和接入方式的多样性,网络管理员通常难以得知网络中的物联网设备类型及运行状态.其次,物联网设备由于其计算、存储资源有限,难以部署传统防御措施,正逐渐成为网络攻击的焦点.因此,通过设备识别了解网络中的物联网设备并基于设备识别结果进行异常检测,以保证其正常运行尤为重要.近几年来,学术界围绕上述问题开展了大量的研究.系统地梳理物联网设备识别和异常检测方面的相关工作.在设备识别方面,根据是否向网络中发送数据包,现有研究可分为被动识别方法和主动识别方法.针对被动识别方法按照识别方法、识别粒度和应用场景进行进一步的调研,针对主动识别方法按照识别方法、识别粒度和探测粒度进行进一步的调研.在异常检测方面,按照基于机器学习算法的检测方法和基于行为规范的规则匹配方法进行梳理.在此基础上,总结物联网设备识别和异常检测领域的研究挑战并展望其未来发展方向.

Survey on IoT Device Identification and Anomaly Detection

With the development of Internet of Things (IoT) technology, IoT devices are widely applied in many areas of production and life. However, IoT devices also bring severe challenges to equipment asset management and security management. Firstly, Due to the diversity of IoT device types and access modes, it is often difficult for network administrators to know the IoT device types and operating status in the network. Secondly, IoT devices are becoming the focus of cyber attacks due to their limited computing and storage resources, which makes it difficult to deploy traditional defense measures. Therefore, it is important to acknowledge the IoT devices in the network through device identification and detect anomalies based on the device identification results, so as to ensure the normal operation of IoT devices. In recent years, academia has carried out a lot of research on the above issues. This study systematically reviews the work related to IoT device identification and anomaly detection. In terms of device identification, existing research can be divided into passive identification methods and active identification methods according to whether data packets are sent to the network. The passive identification methods are further investigated according to the identification method, identification granularity, and application scenarios. The study also investigates the active identification methods according to the identification method, identification granularity, and detection granularity. In terms of anomaly detection, the existing work can be divided into detection methods based on machine learning algorithms and rule-matching methods based on behavioral norms. On this basis, challenges in IoT device identification and anomaly detection are summarized, and the future development direction is proposed.