Passive Data Collection and Threat Identification Through Use of a Graph Database in IoT Devices

Abstract

Connected devices are everywhere and are rapidly becoming a part of everyday life, inviting these devices into our home from smart speakers with assistances’ that can help control TVs, lights, outlets, and refrigerators to security systems that are relied on to keep homes safe. Cisco, an industry leader in information technology, networking, and cybersecurity, estimates Internet of Things (IoT) devices will make up more than half of all global connected devices by 2022 or roughly 14.6 billion connected devices, which will serve as a catalyst for improved network security and other network innovations (Cisco, 2020b). With the growing research in the field of IoT security, there are still areas that have just started to be explored by engineers, especially on realizing the powerful insight the use of a graph can yield to secure IoT home networks. One such way to grasp the power of the realization is through formulating a framework that allows for the ability to detect malicious or nefarious activity inside a home network by taking principles and paradigms used in other industries. By studying malicious activity closer to its origins and generating a framework around this data will bring to light new areas of early cyberattack detection. The framework will allow for a better understanding of how graph databases can be utilized to secure that home network and devices at the edge of the Internet. The framework will explore passive data collection options that allow for data aggregation and storage into a graph database to demonstrate the viability and resourcefulness that graph databases have in the IoT security space. By collecting data passively from routers within a home network and aggregate data from multiple routers into a graph database, including normal and malicious traffic. Two such strategies that will be investigated are anomaly detection through statistical examination as well as entity link analysis, a key concept of fraud detection used to analyze relationships.