Lightweight collaborative anomaly detection for the IoT using blockchain

Yisroel Mirsky, Tomer Golomb, Yuval Elovici

Abstract: Highlights•Efficient software exploit detection can be performed on IoT devices by modeling the application’s control-flow over regions of memory. The additional overhead of using the proposed method is negligible (6% CPU and 0.8% memory of a Raspberry Pi 3B).•The modeling (training) of an anomaly detection model can be performed across numerous devices in parallel using an Extensible Markov chain. Safe collaboration requires both self-attestation and abnormality-filtration when sharing and merging knowledge among participants.•Using a blockchain protocol, IoT devices can collaborate with each other on forming a single trusted and robust anomaly detection model.•Collaborative training, using the proposed framework, significantly reduces the train-time, lowers the false positive rate, and makes the overall process resistant to adversarial poising attacks.•Deadlocks in p2p blockchain sharing/collaboration can be prevented through a direct messaging protocol, proven in this paper.