An Experimental Approach to SYN and ICMP Flood Cyberattacks Detection Through Side-Channel Measurements in IoT Domain

IoT devices particularly suffer the problem of cyber attacks due to their reduced sizes, costs and computational capabilities. Their massive usage in different contexts makes it possible for them to be exposed to several threats, both in terms of passive (listening and content extrapolation) and active attacks. In this work, a side channel approach is used to monitor the devices' behavior, particularly concerning their status of 'regular' or 'under attack' condition. An extensive experimental campaign has been carried out in terms of tested IoT devices as well as the creation of suitable set-ups to perform (in a controlled and isolated environment) attacks on those platforms. A measurement set-up is then adopted to measure the electromagnetic emissions of each device in each condition. Finally, a data processing stage has been employed to distinguish the devices' status between 'baseline' and 'attack' conditions. The obtained results prove how it is generally possible to adopt the methodology to understand the security condition of an IoT device, but the combinations device-attack do not provide homogeneous results, thus needing device-dependent specific customizations in terms of algorithm tuning to get accurate performance.