PhD on the security of the Internet-of-Things

The insecurity of Internet-connected Internet-of-Things (IoT) devices poses a major security risk to critical Internet infrastructure. These IoT devices are often inadequately protected leading to substantial damage.  Currently, the IoT has enabled devices that previously lacked communication capabilities to be controlled and openly accessible through the Internet. The great bulk of these devices do not only lack of adequate security controls but also cannot be updated. Until vendors start manufacturing IoT devices with security in mind, it is important for network operators to have tools available to detect intrusion attempts and infected devices before they participate in a DDoS attack or other malicious activity. In addition to the technical aspects, there are also economic forces at play which are incentivizing profit motivated attackers to infect large numbers of IoT devices and rent out the resulting botnets for DDoS attacks. Understanding the economics behind IoT botnets and structure of intermediaries they depend on (i.e. anti-DDoS services, customer support, hosting, and payment processors) might illuminate bottlenecks in the operation that lead to effective non-technical or hybrid approaches for mitigating profit-fueled IoT-based DDoS services. 

During this thesis, the PhD student will partner with the Dutch registry and New York University to design, build, and evaluate practical techniques and tools for mitigating the threat from IoT powered DDoS attacks.