HTTP Cyberattacks Detection through Automatic Signature Generation in multi-site IoT Deployments
Agustín W. Lara-Romero, Juan Antonio Ternero Muñiz, Rafael Estepa, Antonio Estepa, Fernando Ruiz Robles, Jesús E. Dı́az-Verdejo · 2023
IoT deployments often include a web-interface server for managerial purposes. Signature-based Intrusion Detection Systems are commonly used to detect HTTP attacks on these web servers. The standard signature repositories used by these defensive systems can be enhanced with new signatures generated automatically from attacks detected with anomaly detection techniques. This work presents a scheme for generating such anomaly-based signatures from HTTP attacks in a way that avoids excessive false positives. The signatures generated are distributed to peer sites in a multi-site environment. We also present a case study based on an IoT real-life dataset collected at four different SmartLight deployments from the same organization. Our results show a notable performance improvement (from to ) when anomaly-based signatures are added to the standard default Snort ruleset and distributed to the other three sites.