1. Machine Learning for Cyber Security
Unit : IOT device detection

2. Learning Objectives
Taking a problem
ML pipeline
Raw data ML

3. IOT Device Detection IOT = Internet of Things Alexa Assistant IP Misc
Network
Mobile ?
Power Outlet
camera IP
TCP/IP
Assistant
Alexa
Misc

4. What do we know? Classes? supervised? What are the features?
unsupervised?
How much data do I have?
Label?
Vector
Space
Data

5. IOT data(40 features) Router F1 F2 F3 IP/TCP fields C S1 S2 S3 X Y FX Y F SW S1 S2
Alexa
Camera
TCP/IP
✘ UDP/IP
IP/TCP
Network data
pcap(Wireshark, TCP dump, libpcap)

6. Packet
Eth IP
TCP
Payload ✘
✓ ✓
feature

7. Sample
Per packet basic
Sample
Window of time basic

8. Graph demo
Vector
space ML
Data
clean
Evaluate

9. classes
Supervised
Identity
MAC address
Source IP
Unsupervised

10. TCP/IP headers Source IP, if IP in camera_IPs, class=0 F1 F2 F40 S1 S2
Source IP, if IP in camera_IPs, class=0 X Y

11. Tshark and Python Vector space ML Data clean Evaluate WEKA
Feature extraction

12. Lab Goal is to extract features from pcap file Identify the feature
Write a python script
List of IPs per IOT device for the classes
18 features

13. Lab environment Python Tshark WEKA Pcap Starter code
File
Starter code
Evaluate performance ML
Select 3 algorithms
Evaluate

14. Feature extraction Camera.pcap P1 P2 Camera Server Host Assistant
To use pcap
Misc
Mobile
List of IPs
Camera
Server
Host
Alexa P1 P2

15. Graph Class Data vector Camera.pcap P1 features Camera /P1 P2
Vector space
Camera.pcap
/P1 P2 ML

16. Now we proceed to the code

17. Summary IOT Device Detection Lab Realistic data set Big data
Raw data => VSM
ML pipeline
WEKA