AUTHOR=Chang Yue , Hu Teng , Lou Fang , Zeng Tao , Yin Mingyong , Yang Siqi 

TITLE=Anomalous process detection for Internet of Things based on K-Core

JOURNAL=Frontiers in Physics

VOLUME=Volume 12 - 2024

YEAR=2024

URL=https://www.frontiersin.org/journals/physics/articles/10.3389/fphy.2024.1391266

DOI=10.3389/fphy.2024.1391266

ISSN=2296-424X

ABSTRACT=With the expansion of the Internet of Things industry, the difficulty of IoT security defense is also increasing. In recent years, Internet of Things security incidents occur frequently, which is often accompanied by malicious events. Therefore, anomaly detection is an important part of Internet of Things security defense. In order to protect against attacks, we need to find out anomalous processes in the IoT devices as early as possible. Many algorithms have been proposed to detect anomalous processes. However, these algorithms rare to consider the relationship between the processes and IoT devices. In this paper, we create a process white list based on the K-Core decomposition method, which can be used to detect anomalous processes in IoT devices. The proposed method firstly construct IoT process network based on the relationship between the processes and IoT devices, then create a white list and detect anomalous processes finally. Notably, our work proposed a new method to create a process white list which is transformed to find out core nodes in the network. Moreover, the proposed method is unsupervised. Experiment results demonstrate that our proposed method performs well on real-world process data.