A bayesian inference-based detection mechanism to defend medical smartphone networks against insider attacks

Abstract

With the increasing digitization of the healthcare industry, a wide range of devices (including traditionally non-networked medical devices) are Internet- and inter-connected. Mobile devices (e.g. smartphones) are one common device used in the healthcare industry to improve the quality of service and experience for both patients and healthcare workers, and the underlying network architecture to support such devices is also referred to as medical smartphone networks (MSNs). MSNs, similar to other networks, are subject to a wide range of attacks (e.g. leakage of sensitive patient information by a malicious insider). In this work, we focus on MSNs and present a compact but efficient trust-based approach using Bayesian inference to identify malicious nodes in such an environment. We then demonstrate the effectiveness of our approach in detecting malicious nodes by evaluating the deployment of our proposed approach in a real-world environment with two healthcare organizations.

Introduction

With the rapid advancements and interconnectivity of information and communications technologies (ICT), it is no surprise that ICT form the backbone of many aspects of the healthcare and medical industry. For example, it has been estimated that ICT could save 63 billion dollars in healthcare costs over the next fifteen years, with a 15–30% reduction in hospital equipment costs (Evans and Annunziata, 2012).

However, healthcare or medical networks are subject to more stringent scrutiny, in comparison to traditional networks (Symantec, 2015), due to the sensitivity of information (e.g. patient data and medical history) and the number and diversity of devices that could potentially be exploited to target the system (Williams and Woodward, 2015). According to a survey by Harries (2014), for example, the number of information security breaches reported by healthcare providers soared 60% from 2013 to 2014, which is almost double the increase in other industries. A more recent McAfee report explained that vulnerabilities affecting networked medical devices are not different from other operational technologies (e.g. medical devices), consumer technologies (e.g. smartphones) and other forms of ICT (e.g. hospital networks) (Healey et al., 2015). The networked medical devices may be vulnerable to accidental failures, privacy violations, intentional disruption, and widespread disruption.

It is no surprise that medical and mobile devices are targeted by cybercriminals due to the use of such devices to store and/or access sensitive information such as patient's personally identifiable information (PII) and medical history. In addition, with the widespread adoption of mobile technologies and the descreasing costs of mobile devices (e.g. Android and iOS devices), mobile devices are increasingly integrated in MSNs (e.g. recording patient's medical conditions and accessing patient's records in real-time during ward visits). These devices are generally connected to the organization's wireless network; thus, each device can be considered a node. Although such networks are private, they can be compromised by exploiting vulnerabilities in process, people and technology (Choo et al., 2014, Williams and Woodward, 2015). For example, an attacker may seek to infect a mobile device with malware with the aim of stealing sensitive information and compromising other devices in the network (Choo, 2011). Recent studies demonstrated that air-gapped devices and wearable devices (e.g. smartwatch) can also be compromised to covertly exfiltrate data using inaudible sound waves (Do et al., 2015, Do et al., 2016, O'Malley and Choo, 2014).

Thus, the capability to identify malicious devices in MSNs is crucial in ensuring the security of the network and the privacy of the data. This is the contribution we need to address in this paper. Specifically, in this paper, we first introduce the background of MSNs and describe the operational requirements (see Section 2). We observe that while a centralized security mechanism with dynamic traffic monitoring is desirable in MSNs, trust-based approaches are often used to defend against insider attacks in the literature (Bao et al., 2012, Duma et al., 2016, Shaikh et al., 2009). Therefore, to satisfy the requirements in the healthcare and medical industry, we apply and evaluate a trust-based detection approach based on Bayesian inference (Meng et al., 2013) to identify malicious nodes within the networks. In particular, our mechanism employs a hierarchical infrastructure in order to facilitate trust computation and management. To investigate the performance, we evaluate the proposed mechanism in real-world medical environments under different scenarios. The experimental results demonstrate that our approach is more effective in detecting malicious nodes with an acceptable workload, in comparison to other similar trust models.

The remainder of this paper is organized as follows. In Section 2, we introduce medical smartphone networks. Section 3 describes the practical requirements and proposes a security mechanism for securing medical networks from insider attacks. Section 4 presents our evaluation and discusses some challenges. Section 5 describes related work. Finally, we conclude the work in Section 6.