IoTCandyJar: Towards an Intelligent-Interaction Honeypot for IoT Devices

In recent years, the emerging Internet-of-Things (IoT) has led to concerns about the security of networked embedded devices. There is a strong need to develop suitable and costefficient methods to find vulnerabilities in IoT devices in order to address them before attackers take advantage of them. In traditional IT security, honeypots are commonly used to understand the dynamic threat landscape without exposing critical assets. In previous BlackHat conferences, conventional honeypot technology has been discussed multiple times. In this work, we focus on the adaptation of honeypots for improving the security of IoTs, and argue why we need to have a huge innovation to build honeypot for IoT devices. Due to the heterogeneity of IoT devices, manually crafting the low-interaction honeypot is not affordable; on the other hand, purchasing all of physical IoT devices to build highinteraction honeypot is not affordable. This dilemma forced us to seek an innovative way to build honeypot for IoT devices. We propose using machine learning technology to automatically learn behavioral knowledge of IoT devices and build “intelligent-interaction” honeypot. We also leverage multiple machine learning techniques to improve the quality and quantity.