Abstract
Wide application of IoT devices together with the growth of cyber attacks against them creates a need for a simple and clear system of security metrics for the end users and producers that will allow them to understand how secure their IoT devices are and to compare these devices with each other, as well as to enhance the security of the devices. The paper proposes a security measuring system that is based on the hierarchy of metrics representing different security properties and integrates these security metrics in one clear and reasonable score depending on available data. The algorithms used for metrics calculation are briefly described with the main focus on the algorithms for integral scores. To demonstrate the operation of the proposed security measuring system, the case study describing metrics calculation for the IoT device is given.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Ahmed, M., Mahmood, A.N., Hu, J.: A survey of network anomaly detection techniques. J. Netw. Comput. Appl. 60, 19–31 (2016)
Local Outlier Factor. https://en.wikipedia.org/wiki/Local_outlier_factor
Schölkopf, B., Platt, J.C., Shawe-Taylor, J., Smola, A.J., Williamson, R.C.: Estimating the support of a high-dimensional distribution. Neural Comput. 13(7), 1443–1471 (2001). https://doi.org/10.1162/089976601750264965
Liu, F.T., Ting, K.M., Zhou, Z.-H.: Isolation-based anomaly detection. ACM Trans. Knowl. Discov. Data 6(1), 1–39 (2012). https://doi.org/10.1145/2133360.2133363
Rousseeuw, P.J., Van Driessen, K.: A fast algorithm for the minimum covariance determinant estimator. Technometrics 41(3), 212 (1999)
Novikova, E., Doynikova, E., Kotenko, I.: P2Onto: making privacy policies transparent. In: Katsikas, S., et al. (eds.) CyberICPS/SECPRE/ADIoT -2020. LNCS, vol. 12501, pp. 235–252. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64330-0_15
Peltier, T.R.: Information Security Risk Analysis, 3d edn., p. 456. CRC Press, Boca Raton (2010)
Common Vulnerability Scoring System v3.1: Specification Document. https://www.first.org/cvss/specification-document. Accessed 29 Dec 2019
IoT Security Foundation. https://www.iotsecurityfoundation.org/best-practice-guidelines. Accessed 30 July 2021
Doynikova, E., Chechulin, A., Kotenko, I.: Analytical attack modeling and security assessment based on the common vulnerability scoring system. In: Proceedings of the XXth Conference of Open Innovations Association FRUCT, pp. 53–61 (2017). https://doi.org/10.23919/FRUCT.2017.8071292
Kincaid, J.P., Fishburne, R.P., Rogers, R.L., Chissom, B.S.: Derivation of new readability formulas (automated readability index, fog count, and flesch reading ease formula) for Navy enlisted personnel. Research branch report 8–75. Chief of Naval Technical Training: Naval Air Station Memphis (1975)
Ardagna, C.A., De Capitani di Vimercati, S., Samarati, P.: Enhancing user privacy through data handling policies. In: Damiani, E., Liu, P. (eds.) DBSec 2006. LNCS, vol. 4127, pp. 224–236. Springer, Heidelberg (2006). https://doi.org/10.1007/11805588_16
Pardo, R., Le Métayer, D.: Analysis of privacy policies to enhance informed consent. In: Foley, S.N. (ed.) DBSec 2019. LNCS, vol. 11559, pp. 177–198. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-22479-0_10
Tesfay, W.B., Hofmann, P., Nakamura, T., Kiyomoto, S., Serna, J.: PrivacyGuide: towards an implementation of the EU GDPR on internet privacy policy evaluation. In: Proceedings of the Fourth ACM International Workshop on Security and Privacy Analytics (IWSPA 2018), pp. 15–21. Association for Computing Machinery, New York (2018). https://doi.org/10.1145/3180445.3180447
Wei, R., Cai, L., Yu, A., Meng, D.: AGE: authentication graph embedding for detecting anomalous login activities (2020). https://doi.org/10.1007/978-3-030-41579-2_20
National Cyber Security Center. NCSC CAF guidance. https://www.ncsc.gov.uk/collection/caf/cyber-assessment-framework. Accessed 30 July 2021
IoT Security Foundation, IoT Security Compliance Framework, Release 2, December 2018. https://www.iotsecurityfoundation.org/wp-content/uploads/2018/12/IoTSF-IoT-Security-Compliance-Framework-Release-2.0-December-2018.pdf. Accessed 30 July 2021
Najib, W., Sulistyo, S., Widyawan: Survey on trust calculation methods in Internet of Things. Procedia Comput. Sci. 161, 1300–1307 (2019). https://doi.org/10.1016/j.procs.2019.11.245
Khouzani, M.H.R., Liu, Z., Malacaria, P.: Scalable min-max multi-objective optimization over probabilistic attack graphs. Eur. J. Oper. Res. 278(3), 894–903 (2019)
De, S.J., Le Metayer, D.: Privacy risk analysis to enable informed privacy settings. In: 2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), London, pp. 95–102 (2018)
Bar-Sinai, M., Sweeney, L., Crosas, M.: DataTags, data handling policy spaces and the tags language. In: 2016 IEEE Security and Privacy Workshops (SPW), San Jose, CA, pp. 1–8 (2016)
Métayer, D.: A formal privacy management framework. In: Degano, P., Guttman, J., Martinelli, F. (eds.) FAST 2008. LNCS, vol. 5491, pp. 162–176. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-01465-9_11
Pandit, H.J., Fatema, K., O’Sullivan, D., Lewis, D.: GDPRtEXT - GDPR as a linked data resource. In: Gangemi, A., et al. (eds.) ESWC 2018. LNCS, vol. 10843, pp. 481–495. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-93417-4_31
August Device and Service Privacy Policy. https://august.com/pages/privacy-policy. Accessed 30 Mar 2021
General Data Protection Regulation (GDPR). https://gdpr-info.eu/. Accessed 31 July 2021
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2022 Springer Nature Switzerland AG
About this paper
Cite this paper
Doynikova, E. et al. (2022). Security Measuring System for IoT Devices. In: Katsikas, S., et al. Computer Security. ESORICS 2021 International Workshops. ESORICS 2021. Lecture Notes in Computer Science(), vol 13106. Springer, Cham. https://doi.org/10.1007/978-3-030-95484-0_16
Download citation
DOI: https://doi.org/10.1007/978-3-030-95484-0_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-95483-3
Online ISBN: 978-3-030-95484-0
eBook Packages: Computer ScienceComputer Science (R0)