An analytics framework to detect compromised IoT devices using mobility behavior

Certain security mechanisms assume that the end device is secured. In an IoT network, the IoT device itself could be compromised. An attacker could steal the device, gain access to it and use this for more damaging attacks. I propose an analytical framework where I specify certain mobility behavior indicators that are computed at network nodes and optionally at IoT devices. These are communicated to an analytics server using lightweight protocol enhancements specified here. IoT user specifies expected behavior using these indicators. Analytics server analyzes expected and observed values of these indicators and informs if it detects some unusual activity.