Date of Award

11-3-2023

Document Type

Thesis - SCU Access Only

Publisher

Santa Clara : Santa Clara University, 2023.

Degree Name

Doctor of Philosophy (PhD)

Department

Computer Science and Engineering

First Advisor

Yuhong Liu

Second Advisor

Behnam Dezfouli

Abstract

In recent years, the integration of Internet of Things (IoT) technology into our everyday lives has become evident. Despite the numerous advantages of IoT, the unique characteristics of these devices—such as their resource-constrained nature, immense scalability, and diversity—present inherent security vulnerabilities. Central to these challenges is the accurate identification of IoT devices and the detection and analysis of Distributed Denial of Service (DDoS), energy-oriented DDoS (E-DDoS), and Low-rate DDoS (LR-DDoS) attacks. These aspects are crucial for ensuring IoT networks’ security and operational integrity, as they pose substantial risks to the widespread adoption and reliability of IoT in both consumer and industrial applications. To address these challenges and contribute to the field, this research encompasses three primary contributions. We develop an automated testbed using various commercially available WiFibased IoT devices. This testbed is engineered to comprehensively capture benign and malicious network traffic data and power consumption metrics. Through this setup, we conduct detailed quantitative analyses of the effects of DDoS and E-DDoS attacks on IoT networks. A significant finding in our research is identifying a security flaw within the WiFi-protected Access (WPA) Group Temporal Key (GTK) update protocol. This vulnerability can be exploited by adversaries to launch DDoS attacks, leading to disruptions in WiFi connections between IoT devices and Access Point (AP)s, critically undermining network integrity and reliability. Further, our study reveals that when IoT devices are under E-DDoS attacks for one month, the approximate increase in the electricity bills can easily reach $253.7 million. Our second contribution is the development of a lightweight and privacy-preserving feature set explicitly designed for detecting LRDDoS attacks on IoT networks. Utilizing the 802.11 frame aggregation properties, this method is particularly suitable for deployment in resource-constrained APs, a common characteristic of IoT environments. It also considers network conditions such as Channel Utilization (CU) and the physical distance between the device and AP. Validated through extensive experiments with various machine learning algorithms, this approach achieves 98% accuracy by adopting Random Forest (RF) in detecting these attacks, demonstrating its adaptability and robustness in diverse WiFi network conditions. The third aspect of this thesis introduces a set of privacy-preserving and lightweight features for IoT device identification. This approach differs from traditional methods that rely heavily on deep packet inspection and instead focuses on analyzing device latency, and considers network conditions, such as CU, for accurate device identification. By integrating the Light Gradient Boosted Machine (LGBM) algorithm, we achieve a high accuracy rate of up to 97% in device identification. Overall, this thesis presents a comprehensive approach to address the most essential security challenges in the IoT domain. Through our contributions, we address specific vulnerabilities and lay the groundwork for enhancing the security framework of IoT devices, enabling their safe and trustworthy integration into everyday life and assuring the sustainable growth of IoT technologies.

Download

Available for download on Saturday, January 03, 2026

SCU Access Only

To access this paper, please log into or create an account in Scholar Commons using your scu.edu email address.

Share

COinS