{"id":"https://openalex.org/W2999613521","doi":"https://doi.org/10.1109/tnsm.2020.2966951","title":"IoT-KEEPER: Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the Edge","display_name":"IoT-KEEPER: Detecting Malicious IoT Network Activity Using Online Traffic Analysis at the Edge","publication_year":2020,"publication_date":"2020-01-15","ids":{"openalex":"https://openalex.org/W2999613521","doi":"https://doi.org/10.1109/tnsm.2020.2966951","mag":"2999613521"},"language":"en","primary_location":{"id":"doi:10.1109/tnsm.2020.2966951","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2020.2966951","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"http://resolver.tudelft.nl/uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5041141777","display_name":"Ibbad Hafeez","orcid":"https://orcid.org/0000-0002-9439-3364"},"institutions":[{"id":"https://openalex.org/I133731052","display_name":"University of Helsinki","ror":"https://ror.org/040af2s02","country_code":"FI","type":"education","lineage":["https://openalex.org/I133731052"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Ibbad Hafeez","raw_affiliation_strings":["University of Helsinki, Helsinki, Finland"],"raw_orcid":"https://orcid.org/0000-0002-9439-3364","affiliations":[{"raw_affiliation_string":"University of Helsinki, Helsinki, Finland","institution_ids":["https://openalex.org/I133731052"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005295563","display_name":"Markku Antikainen","orcid":null},"institutions":[{"id":"https://openalex.org/I9927081","display_name":"Aalto University","ror":"https://ror.org/020hwjq30","country_code":"FI","type":"education","lineage":["https://openalex.org/I9927081"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Markku Antikainen","raw_affiliation_strings":["Aalto University, Espoo, Finland"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Aalto University, Espoo, Finland","institution_ids":["https://openalex.org/I9927081"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063593427","display_name":"Aaron Yi Ding","orcid":"https://orcid.org/0000-0003-4173-031X"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Aaron Yi Ding","raw_affiliation_strings":["Delft University of Technology, Delft, The Netherlands"],"raw_orcid":"https://orcid.org/0000-0003-4173-031X","affiliations":[{"raw_affiliation_string":"Delft University of Technology, Delft, The Netherlands","institution_ids":["https://openalex.org/I98358874"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5054443906","display_name":"Sasu Tarkoma","orcid":"https://orcid.org/0000-0003-4220-3650"},"institutions":[{"id":"https://openalex.org/I133731052","display_name":"University of Helsinki","ror":"https://ror.org/040af2s02","country_code":"FI","type":"education","lineage":["https://openalex.org/I133731052"]}],"countries":["FI"],"is_corresponding":false,"raw_author_name":"Sasu Tarkoma","raw_affiliation_strings":["University of Helsinki, Helsinki, Finland"],"raw_orcid":"https://orcid.org/0000-0003-4220-3650","affiliations":[{"raw_affiliation_string":"University of Helsinki, Helsinki, Finland","institution_ids":["https://openalex.org/I133731052"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":18.5465,"has_fulltext":true,"cited_by_count":190,"citation_normalized_percentile":{"value":0.99497994,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"17","issue":"1","first_page":"45","last_page":"59"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8592513799667358},{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.7176192998886108},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.6089438199996948},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5789722204208374},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5638954043388367},{"id":"https://openalex.org/keywords/edge-device","display_name":"Edge device","score":0.5511543154716492},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.46767839789390564},{"id":"https://openalex.org/keywords/edge-computing","display_name":"Edge computing","score":0.43858909606933594},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3174934387207031},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.2708170413970947},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.16818302869796753},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.10793039202690125}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8592513799667358},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.7176192998886108},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.6089438199996948},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5789722204208374},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5638954043388367},{"id":"https://openalex.org/C138236772","wikidata":"https://www.wikidata.org/wiki/Q25098575","display_name":"Edge device","level":3,"score":0.5511543154716492},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.46767839789390564},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.43858909606933594},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3174934387207031},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.2708170413970947},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.16818302869796753},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.10793039202690125},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tnsm.2020.2966951","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2020.2966951","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},{"id":"pmh:oai:tudelft.nl:uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","pdf_url":"http://resolver.tudelft.nl/uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"journal article"}],"best_oa_location":{"id":"pmh:oai:tudelft.nl:uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","is_oa":true,"landing_page_url":"http://resolver.tudelft.nl/uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","pdf_url":"http://resolver.tudelft.nl/uuid:b917bb85-b1ce-4608-a6f1-83f26d22007a","source":{"id":"https://openalex.org/S4306400906","display_name":"Research Repository (Delft University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I98358874","host_organization_name":"Delft University of Technology","host_organization_lineage":["https://openalex.org/I98358874"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"journal article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4157955438","display_name":null,"funder_award_id":"314008","funder_id":"https://openalex.org/F4320321108","funder_display_name":"Academy of Finland"}],"funders":[{"id":"https://openalex.org/F4320321108","display_name":"Academy of Finland","ror":"https://ror.org/05k73zm37"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2999613521.pdf","grobid_xml":"https://content.openalex.org/works/W2999613521.grobid-xml"},"referenced_works_count":55,"referenced_works":["https://openalex.org/W1608999459","https://openalex.org/W1775772884","https://openalex.org/W1944603233","https://openalex.org/W1983198760","https://openalex.org/W1987971958","https://openalex.org/W2011778831","https://openalex.org/W2039024677","https://openalex.org/W2070855977","https://openalex.org/W2071949631","https://openalex.org/W2084752903","https://openalex.org/W2093331366","https://openalex.org/W2096118443","https://openalex.org/W2104927807","https://openalex.org/W2131912515","https://openalex.org/W2132537021","https://openalex.org/W2142972529","https://openalex.org/W2156715830","https://openalex.org/W2170975407","https://openalex.org/W2293201672","https://openalex.org/W2296141686","https://openalex.org/W2557469050","https://openalex.org/W2559360880","https://openalex.org/W2574448563","https://openalex.org/W2612104483","https://openalex.org/W2732124327","https://openalex.org/W2739052910","https://openalex.org/W2748868501","https://openalex.org/W2749429923","https://openalex.org/W2767094836","https://openalex.org/W2787422226","https://openalex.org/W2799763618","https://openalex.org/W2804338997","https://openalex.org/W2905169636","https://openalex.org/W2912386632","https://openalex.org/W2921669466","https://openalex.org/W2961066337","https://openalex.org/W2963197901","https://openalex.org/W2997947960","https://openalex.org/W3010612350","https://openalex.org/W3016607949","https://openalex.org/W3020993522","https://openalex.org/W3098577220","https://openalex.org/W3103656239","https://openalex.org/W4245409806","https://openalex.org/W4294141750","https://openalex.org/W4298388032","https://openalex.org/W6636558983","https://openalex.org/W6638021444","https://openalex.org/W6674005338","https://openalex.org/W6743493502","https://openalex.org/W6743673742","https://openalex.org/W6748371706","https://openalex.org/W6750546519","https://openalex.org/W6751377261","https://openalex.org/W6966861994"],"related_works":["https://openalex.org/W4283221139","https://openalex.org/W4322761281","https://openalex.org/W4238233472","https://openalex.org/W4313463218","https://openalex.org/W4312996489","https://openalex.org/W3111395152","https://openalex.org/W4313526662","https://openalex.org/W3106131444","https://openalex.org/W3216099748","https://openalex.org/W4205963435"],"abstract_inverted_index":{"IoT":[0,21,28,100,129],"devices":[1,22,111],"are":[2],"notoriously":[3],"vulnerable":[4],"even":[5],"to":[6,26,60,79],"trivial":[7],"attacks":[8],"and":[9,18,33,75,83,105,141,162,166],"can":[10,164],"be":[11],"easily":[12],"compromised.":[13],"In":[14],"addition,":[15],"resource":[16,160],"constraints":[17],"heterogeneity":[19],"of":[20,51,71],"make":[23],"it":[24,107,163],"impractical":[25],"secure":[27],"installations":[29],"using":[30,118],"traditional":[31],"endpoint":[32],"network":[34,81,86,96,150,169],"security":[35],"solutions.":[36],"To":[37],"address":[38],"this":[39,103,132],"problem,":[40],"we":[41],"present":[42],"IoT-Keeper,":[43],"a":[44,69,119,124],"lightweight":[45],"system":[46],"which":[47],"secures":[48],"the":[49],"communication":[50],"IoT.":[52],"IoT-Keeper":[53,93,117,157],"uses":[54,68],"our":[55,134],"proposed":[56,135],"anomaly":[57],"detection":[58],"technique":[59,136],"perform":[61],"traffic":[62,82],"analysis":[63],"at":[64],"edge":[65],"gateways.":[66],"It":[67],"combination":[70],"fuzzy":[72,76],"C-means":[73],"clustering":[74],"interpolation":[77],"scheme":[78],"analyze":[80],"detect":[84,165],"malicious":[85,89,149],"activity.":[87,151],"Once":[88],"activity":[90],"is":[91],"detected,":[92],"automatically":[94],"enforces":[95],"access":[97],"restrictions":[98],"against":[99],"device":[101],"generating":[102],"activity,":[104],"prevents":[106],"from":[108,123],"attacking":[109],"other":[110],"or":[112,175],"services.":[113],"We":[114],"have":[115],"evaluated":[116],"comprehensive":[120],"dataset,":[121,133],"collected":[122],"real-world":[125],"testbed,":[126],"containing":[127],"popular":[128],"devices.":[130],"Using":[131],"achieved":[137],"high":[138],"accuracy":[139],"(\u22480.98)":[140],"low":[142,159],"false":[143],"positive":[144],"rate":[145],"(\u22480.02)":[146],"for":[147],"detecting":[148],"Our":[152],"evaluation":[153],"also":[154],"shows":[155],"that":[156],"has":[158],"footprint,":[161],"mitigate":[167],"various":[168],"attacks-without":[170],"requiring":[171],"explicit":[172],"attack":[173],"signatures":[174],"sophisticated":[176],"hardware.":[177]},"counts_by_year":[{"year":2026,"cited_by_count":8},{"year":2025,"cited_by_count":22},{"year":2024,"cited_by_count":40},{"year":2023,"cited_by_count":36},{"year":2022,"cited_by_count":29},{"year":2021,"cited_by_count":41},{"year":2020,"cited_by_count":14}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}