2026-09-18T21:15:25Zhttps://dspace.mit.edu/server/oai/requestoai:dspace.mit.edu:1721.1/1088392022-02-01T17:31:17Zcom_1721.1_7582com_1721.1_7581col_1721.1_131023
David D. Clark.
Loving, James Howard
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science.
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Massachusetts Institute of Technology. Engineering Systems Division
Massachusetts Institute of Technology. Institute for Data, Systems, and Society
Technology and Policy Program
2017-05-11T19:06:18Z
2017-05-11T19:06:18Z
2017
2017
http://hdl.handle.net/1721.1/108839
986472937
Thesis: S.M. in Technology and Policy, Massachusetts Institute of Technology, School of Engineering, Institute for Data, Systems, and Society, Technology and Policy Program, 2017.
Thesis: S.M., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2017.
This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections.
Cataloged from student-submitted PDF version of thesis.
Includes bibliographical references (pages 79-91).
As the Internet of Things (IoT) grows, malware will increasingly threaten Internet security and stability. Many actors, from individuals installing antivirus on their personal computers to law enforcement conducting botnet takedowns, have some capability to prevent or remediate malware, but these strategies face technical and economic challenges. These challenges worsen as the IoT expands, due to the high number of IoT devices and other characteristics of the IoT. Fortunately, Internet Service Providers (ISPs) are positioned to effectively contribute to malware remediation efforts, through the detection and notification of compromise. However, Network Address Translation (NAT) and IPv6 Privacy Extensions prevent ISPs from identifying the specific compromised device. We refer to this lastmile extension of the IP traceback problem as the residential source identification problem. As the IoT grows, the problem worsens: IoT devices are less capable of self-remediation and expected to soon outnumber traditional devices, thus imposing a significant cost on customers to triangulate and remediate an infection. To address the residential source identification problem, I propose EDICT, an open-source software package for home routers that will enable consumers to identify a specific device, given retrospective notification of the malicious behavior, without compromising the consumer's privacy. EDICT does this by maintaining a mapping of IP flows to devices through a series of scalable Bloom filters, allowing EDICT to operate under the significant memory constraints of home routers. When a customer is informed of compromise, EDICT will query this connection log using a fuzzy check of the timestamp and source port, both provided by the ISP, iterated across a log of identified devices. EDICT will then provide the customer with user-friendly information on the infection's source, enabling remediation.As the Internet of Things (IoT) grows, malware will increasingly threaten Internet security and stability. Many actors, from individuals installing antivirus on their personal computers to law enforcement conducting botnet takedowns, have some capability to prevent or remediate malware, but these strategies face technical and economic challenges. These challenges worsen as the IoT expands, due to the high number of IoT devices and other characteristics of the IoT. Fortunately, Internet Service Providers (ISPs) are positioned to effectively contribute to malware remediation efforts, through the detection and notification of compromise. However, Network Address Translation (NAT) and IPv6 Privacy Extensions prevent ISPs from identifying the specific compromised device. We refer to this lastmile extension of the IP traceback problem as the residential source identification problem. As the IoT grows, the problem worsens: IoT devices are less capable of self-remediation and expected to soon outnumber traditional devices, thus imposing a significant cost on customers to triangulate and remediate an infection. To address the residential source identification problem, I propose EDICT, an open-source software package for home routers that will enable consumers to identify a specific device, given retrospective notification of the malicious behavior, without compromising the consumer's privacy. EDICT does this by maintaining a mapping of IP flows to devices through a series of scalable Bloom filters, allowing EDICT to operate under the significant memory constraints of home routers. When a customer is informed of compromise, EDICT will query this connection log using a fuzzy check of the timestamp and source port, both provided by the ISP, iterated across a log of identified devices. EDICT will then provide the customer with user-friendly information on the infection's source, enabling remediation.
by James Howard Loving.
S.M. in Technology and Policy
S.M.
91 pages
eng
Massachusetts Institute of Technology
MIT theses are protected by copyright. They may be viewed, downloaded, or printed from this source but further reproduction or distribution in any format is prohibited without written permission.
http://dspace.mit.edu/handle/1721.1/7582
Institute for Data, Systems, and Society.
Technology and Policy Program.
Electrical Engineering and Computer Science.
Enabling malware remediation in expanding home networks
Thesis
application/pdf
false
Publication
unknown
unknown
<Publication xmlns="https://www.openaire.eu/cerif-profile/1.1/" id="a046843f-3471-490e-a42a-cb470b01f3e8">
<Type xmlns="https://www.openaire.eu/cerif-profile/vocab/COAR_Publication_Types">http://purl.org/coar/resource_type/c_1843</Type>
<Language>eng</Language>
<Title>Enabling malware remediation in expanding home networks</Title>
<PublishedIn>
<Publication>
</Publication>
</PublishedIn>
<PublicationDate>2017</PublicationDate>
<Authors>
<Author>
<DisplayName>Loving, James Howard</DisplayName>
<Affiliation>
<OrgUnit>
</OrgUnit>
</Affiliation>
</Author>
</Authors>
<Editors>
</Editors>
<Publishers>
<Publisher>
<DisplayName>Massachusetts Institute of Technology</DisplayName>
<OrgUnit />
</Publisher>
</Publishers>
<License>http://dspace.mit.edu/handle/1721.1/7582</License>
<Keyword>Institute for Data, Systems, and Society.</Keyword>
<Keyword>Technology and Policy Program.</Keyword>
<Keyword>Electrical Engineering and Computer Science.</Keyword>
<Abstract>As the Internet of Things (IoT) grows, malware will increasingly threaten Internet security and stability. Many actors, from individuals installing antivirus on their personal computers to law enforcement conducting botnet takedowns, have some capability to prevent or remediate malware, but these strategies face technical and economic challenges. These challenges worsen as the IoT expands, due to the high number of IoT devices and other characteristics of the IoT. Fortunately, Internet Service Providers (ISPs) are positioned to effectively contribute to malware remediation efforts, through the detection and notification of compromise. However, Network Address Translation (NAT) and IPv6 Privacy Extensions prevent ISPs from identifying the specific compromised device. We refer to this lastmile extension of the IP traceback problem as the residential source identification problem. As the IoT grows, the problem worsens: IoT devices are less capable of self-remediation and expected to soon outnumber traditional devices, thus imposing a significant cost on customers to triangulate and remediate an infection. To address the residential source identification problem, I propose EDICT, an open-source software package for home routers that will enable consumers to identify a specific device, given retrospective notification of the malicious behavior, without compromising the consumer's privacy. EDICT does this by maintaining a mapping of IP flows to devices through a series of scalable Bloom filters, allowing EDICT to operate under the significant memory constraints of home routers. When a customer is informed of compromise, EDICT will query this connection log using a fuzzy check of the timestamp and source port, both provided by the ISP, iterated across a log of identified devices. EDICT will then provide the customer with user-friendly information on the infection's source, enabling remediation.As the Internet of Things (IoT) grows, malware will increasingly threaten Internet security and stability. Many actors, from individuals installing antivirus on their personal computers to law enforcement conducting botnet takedowns, have some capability to prevent or remediate malware, but these strategies face technical and economic challenges. These challenges worsen as the IoT expands, due to the high number of IoT devices and other characteristics of the IoT. Fortunately, Internet Service Providers (ISPs) are positioned to effectively contribute to malware remediation efforts, through the detection and notification of compromise. However, Network Address Translation (NAT) and IPv6 Privacy Extensions prevent ISPs from identifying the specific compromised device. We refer to this lastmile extension of the IP traceback problem as the residential source identification problem. As the IoT grows, the problem worsens: IoT devices are less capable of self-remediation and expected to soon outnumber traditional devices, thus imposing a significant cost on customers to triangulate and remediate an infection. To address the residential source identification problem, I propose EDICT, an open-source software package for home routers that will enable consumers to identify a specific device, given retrospective notification of the malicious behavior, without compromising the consumer's privacy. EDICT does this by maintaining a mapping of IP flows to devices through a series of scalable Bloom filters, allowing EDICT to operate under the significant memory constraints of home routers. When a customer is informed of compromise, EDICT will query this connection log using a fuzzy check of the timestamp and source port, both provided by the ISP, iterated across a log of identified devices. EDICT will then provide the customer with user-friendly information on the infection's source, enabling remediation.</Abstract>
<Access xmlns="http://purl.org/coar/access_right"
>
</Access>
</Publication>